Exercise Observations & Improvement Tracker
Turns observer notes into owned improvement actions linked to the plans and playbooks they will change.
Available soon
- Format
- Excel
- Size
- 115 KB
- Length
- 12 sheets
- Version
- 1.1
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.1
DORA Article 11(6) quoted in full: the yearly test covers ICT systems supporting all functions.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Set the As-at date on the Summary sheet. The EXAMPLE uses 2026-09-30, the example quarter end; use today's date, or type =TODAY(). |
| 2 | List every exercise on the Exercises sheet when it is planned: its ID, date, kind, scenario, the audiences and suppliers it involves (IDs separated by commas), and why this scenario (EX-05). When it is held, set the status to Held and enter the dates of the hot debrief, the observers' notes and the approved after-action report: the timings of EX-08 and EX-09 calculate. |
| 3 | Enter each observer's notes on the Observations sheet within 2 working days (EX-08): the objective and the inject it concerns, the observer's role, what happened with the exercise time, and whether it is a strength or a gap. No names, no opinion. |
| 4 | At the hot debrief and in the after-action report, decide which gaps are findings. Give each finding a priority: High, an objective Not met; or a gap that would break a legal clock, a decision right or a Severity 1 or 2 step, due within 30 days; Medium, an objective Partly met; or a gap that would slow the response, due within 90 days; Low, an improvement that would make the response easier, due within 180 days. |
| 5 | Enter each objective's rating on the Objectives and re-tests sheet, on the evaluation scale (EX-09): Met, Partly met, Not met, Not tested. |
| 6 | Raise one improvement action per finding on the Actions sheet (EX-10): the exercise and observation it closes, what will change, the document it changes by its document ID and the part of it, and one owner. The due date calculates from the report's approval and the priority. Keep the status up to date: Open, In progress, Done, Closed, Withdrawn. |
| 7 | When the action for an objective rated Partly met or Not met is done, plan its re-test on the Objectives and re-tests sheet within 6 months (EX-11): name the exercise, or the live incident whose post-incident review rated the same decision, and the date. Enter the result on the evaluation scale. Only a Met closes the finding: then set the action to Closed. |
| 8 | Take the Summary figures to executive management every quarter, with the incident measures (EX-12). Delete the EXAMPLE rows on every sheet before the tracker is approved. Do not type over the white calculated columns. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its tabletop of 18 Mar 2026 (EX-2026-01) ran the ransomware scenario, with 7 observations and 6 actions, as at 30 Sep 2026. The ransomware incident of 12 Aug 2026 (INC-2026-014) re-tested two of the fixes for real. 1 action overdue and 2 re-tests awaited: see the Summary sheet.
Document IDs in the EXAMPLE are the CISO Times template IDs of the documents each action changes (P09-A03 is the Incident Response Plan). Use your own document IDs.
Tailoring — small organisation: the Observations and Actions sheets are the minimum. Keep the ratings on the Objectives sheet even for a short session: they are what the next exercise re-tests.
Tailoring — regulated financial entity: DORA asks for issues revealed by tests to be prioritised, classified and remedied, with a way to check they are fully addressed (Article 24(5)). The priority, the due date and the re-test are that method: keep every re-test result.
Tailoring — IT run by a managed service provider: give the provider's observer a row like any other. A provider's staff are never the only or the independent observer, and where the exercise tests the provider's own service, its staff are participants and record no observations on it. Raise actions the provider owns with the provider named as owner and the contract clause in the Changes column.
Exercises
Every exercise, planned and held. Audiences are the IDs of the audience table (AU-01 to AU-05); suppliers are your supplier register's references. A live incident is not an exercise.
| Example | Exercise ID | Date | Kind | Scenario | Audiences | Suppliers | Status | Why this scenario (EX-05) | Hot debrief held | Observers' notes in | After-action report approved | Debrief and notes (EX-08) | Report (EX-09) | Re-tests it carries (EX-11) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | EX-2025-03 | 20 Nov 2025 | Board session | SC-01 | AU-01 | Held | R-01: ransomware takes online ordering offline; the board's part is the ransom decision | |||||||
| EXAMPLE | EX-2026-01 | 18 Mar 2026 | Tabletop | SC-01 | AU-02, AU-03, AU-04 | SUP-001, SUP-006 | Held | R-01 and R-04: the two ransomware risks in the register | 18 Mar 2026 | 20 Mar 2026 | 31 Mar 2026 | On time | On time | |
| EXAMPLE | EX-2026-02 | 6 Oct 2026 | Drill | AU-03, AU-04 | SUP-001, SUP-006, SUP-011 | Planned | Planned for 24 Jun 2026 to re-test the out-of-hours alert route for real, at 06:30 (SC-01 O2, through EA-03). Postponed so that the warehouse network separation (P05 TA-04) could finish first. It also re-tests approval of the customer notice (SC-01 O6, through EA-05): the executive incident lead, who approves it, joins for that step as a participant. It does not count as an exercise for AU-02 (executive management and the crisis team). After INC-2026-014 it rehearses isolating a site as well | SC-01.O2, SC-01.O6 | ||||||
| EXAMPLE | EX-2026-03 | 22 Oct 2026 | Tabletop | SC-05 | AU-02, AU-03 | SUP-005 | Planned | R-02: payment fraud is outside appetite, and INC-2026-015 was a €84,000 near miss. Held before the peak season | SC-01.O6 | |||||
| EXAMPLE | EX-2027-01 | 17 Mar 2027 | Tabletop | SC-02 | AU-01, AU-02, AU-03 | SUP-001, SUP-002 | Planned | R-01 and R-06: online ordering depends on the hosting provider and the managed IT provider. The board joins for the last hour | ||||||
| EXAMPLE | EX-2027-02 | 31 Mar 2027 | Tabletop | SC-04 | AU-03, AU-04 | SUP-005, SUP-006 | Planned | R-09: staff accounts taken over through phishing, and the INC-2026-017 mailbox takeover |
Observations
What observers saw, as fact, with the exercise time and the objective it concerns. Observation IDs are unique within an exercise. Observer: a role, never a name.
| Example | Observation ID | Exercise | Objective | Inject | Observer | What happened | Strength or gap | Finding | Priority | Improvement action | Action status | Check | Lookup key (calculated) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | OB-01 | EX-2026-01 | O1 | I2 | Internal Audit Manager (independent) | At minute 30: Isolation was agreed 40 minutes after declaration, after a debate over whether the incident manager could stop dispatch without the Chief Operating Officer. | Gap | Yes | High | EA-01 | Closed | OK | EX-2026-01|OB-01 |
| EXAMPLE | OB-02 | EX-2026-01 | O3 | I4 | Internal Audit Manager (independent) | At minute 65: The screen was finished in time, but only after Legal looked up whether the firm is an important entity under NIS2. Nobody else knew. | Gap | Yes | Medium | EA-02 | Closed | OK | EX-2026-01|OB-02 |
| EXAMPLE | OB-03 | EX-2026-01 | O2 | I1 | Quality and Compliance Manager (not a participant) | At minute 15: The monitoring provider's out-of-hours analyst could reach only the IT service desk, which then had to find the incident manager: 25 minutes lost before anyone could declare. | Gap | Yes | High | EA-03 | Done | OK | EX-2026-01|OB-03 |
| EXAMPLE | OB-04 | EX-2026-01 | O4 | I5 | Quality and Compliance Manager (not a participant) | At minute 80: Nobody could say when a backup of the ordering platform was last restored and checked. | Gap | Yes | Medium | EA-04 | Closed | OK | EX-2026-01|OB-04 |
| EXAMPLE | OB-05 | EX-2026-01 | O6 | I7 | Internal Audit Manager (independent) | At minute 110: The customer notice took 70 minutes to approve, because it was written from scratch. | Gap | Yes | Medium | EA-05 | Done | OK | EX-2026-01|OB-05 |
| EXAMPLE | OB-06 | EX-2026-01 | General | Internal Audit Manager (independent) | Two of the five deputies named in the plan had never taken part in an exercise. | Gap | Yes | Low | EA-06 | Open | OK | EX-2026-01|OB-06 | |
| EXAMPLE | OB-07 | EX-2026-01 | O5 | I6 | Internal Audit Manager (independent) | At minute 95: The Chief Operating Officer refused to discuss paying and asked for the board chair, Legal and the insurer within ten minutes of the demand. | Strength | No | OK | EX-2026-01|OB-07 |
Actions
One owned action per finding (EX-10). Priority comes from the observation; the due date from the report's approval and the priority. Overdue is measured at the As-at date on the Summary sheet.
| Example | Action ID | Exercise | Observation ID | Objective | Objective rating | Priority | Report approved | Due | Improvement action | Changes: document ID | Changes: part | Owner | Status | Done | Days overdue | Flag (EXM-03) | Notes | Lookup key (calculated) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | EA-01 | EX-2026-01 | OB-01 | O1 | Partly met | High | 31 Mar 2026 | 30 Apr 2026 | Write into the plan that the incident manager may isolate a system, site or account without waiting for the executive | P09-A03 | decision rights | Head of Information Security | Closed | 22 Apr 2026 | Closed | EX-2026-01|OB-01 | ||
| EXAMPLE | EA-02 | EX-2026-01 | OB-02 | O3 | Met | Medium | 31 Mar 2026 | 29 Jun 2026 | Confirm the firm's NIS2 status in writing and put the three legal questions into the first-hour steps | P09-A05 | reporting screen | Head of Information Security | Closed | 8 May 2026 | Closed | EX-2026-01|OB-02 | ||
| EXAMPLE | EA-03 | EX-2026-01 | OB-03 | O2 | Not met | High | 31 Mar 2026 | 30 Apr 2026 | Give the monitoring provider's out-of-hours analysts a direct route to the incident manager or their deputy | P09-A03 | contact directory; monitoring contract | Head of Information Security | Done | 10 Sep 2026 | Done, awaiting re-test | Waited on a change to the monitoring contract. Still open on 12 Aug; the post-incident review raised the same gap again as PIA-05 | EX-2026-01|OB-03 | |
| EXAMPLE | EA-04 | EX-2026-01 | OB-04 | O4 | Partly met | Medium | 31 Mar 2026 | 29 Jun 2026 | Restore and check a backup of the ordering platform every month, with the backup provider | P09-A06 | recovery; backup schedule | Head of IT | Closed | 28 May 2026 | Closed | EX-2026-01|OB-04 | ||
| EXAMPLE | EA-05 | EX-2026-01 | OB-05 | O6 | Partly met | Medium | 31 Mar 2026 | 29 Jun 2026 | Pre-approve the customer notice and the media holding statement, with blanks for the facts | P09-A10 | CT-04 and CT-09 | Head of Marketing and Communications | Done | 12 Jun 2026 | Done, awaiting re-test | Not tested in August: no customer service was affected. Re-tested in two parts: the customer notice (CT-04) at EX-2026-02 on 6 Oct 2026, and the media holding statement (CT-09) at EX-2026-03 on 22 Oct 2026. Closed only when both are Met | EX-2026-01|OB-05 | |
| EXAMPLE | EA-06 | EX-2026-01 | OB-06 | General | Low | 31 Mar 2026 | 27 Sep 2026 | Bring every deputy named in the plan into an exercise | Exercise programme | invitation lists | Head of Information Security | Open | 3 | Overdue | The two deputies are invited to EX-2026-03 on 22 Oct | EX-2026-01|OB-06 |
Objectives and re-tests
Each objective's rating on the evaluation scale, and the re-test of every objective rated Partly met or Not met, within 6 months of its action being done (EX-11).
| Example | Exercise | Objective | Category | Category name | Objective title | Rating | Re-test needed (EX-11) | Action ID | Action status | Action done | Re-test window ends | Re-test by (exercise or incident) | Re-test date (held or planned) | Re-test result | Re-test state | Note | Lookup key (calculated) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | EX-2026-01 | O1 | OC-02 | Containment decisions | Isolate without waiting | Partly met | Yes | EA-01 | Closed | 22 Apr 2026 | 22 Oct 2026 | INC-2026-014 | 12 Aug 2026 | Met | Passed | August (INC-2026-014): rated Met. Isolation decided by the incident manager 30 minutes after declaration, as EA-01 wrote into the plan. | EX-2026-01|O1 |
| EXAMPLE | EX-2026-01 | O2 | OC-01 | Detection and escalation | Declare and escalate, in and out of hours | Not met | Yes | EA-03 | Done | 10 Sep 2026 | 10 Mar 2027 | EX-2026-02 | 6 Oct 2026 | Awaiting re-test | August (INC-2026-014): rated Partly met. Escalation after declaration was on time, but the alert still reached the IT service desk first: EA-03 was still open. The review raised it again as PIA-05. | EX-2026-01|O2 | |
| EXAMPLE | EX-2026-01 | O3 | OC-03 | Reporting duties | Screen the reporting duties | Met | No | EA-02 | Closed | 8 May 2026 | Not needed | August (INC-2026-014): rated Met. Screen complete inside the 4 hours; early warning 7 hours 15 minutes after declaration. | EX-2026-01|O3 | ||||
| EXAMPLE | EX-2026-01 | O4 | OC-05 | Recovery priorities | Restore in the right order, safely | Partly met | Yes | EA-04 | Closed | 28 May 2026 | 28 Nov 2026 | INC-2026-014 | 13 Aug 2026 | Met | Passed | August (INC-2026-014): rated Met. Backups checked before restoring, as EA-04 set up. | EX-2026-01|O4 |
| EXAMPLE | EX-2026-01 | O5 | OC-06 | Decision rights and governance | Put the extortion demand to the right people | Met | No | Not needed | August (INC-2026-014): No ransom was demanded. | EX-2026-01|O5 | |||||||
| EXAMPLE | EX-2026-01 | O6 | OC-04 | Communication | Speak with one voice | Partly met | Yes | EA-05 | Done | 12 Jun 2026 | 12 Dec 2026 | EX-2026-02 and EX-2026-03 | 22 Oct 2026 | Awaiting re-test | August (INC-2026-014): No customer service was affected, so no customer notice was needed. Re-tested in 2 parts: the customer notice (CT-04) at EX-2026-02 on 6 Oct 2026; the media holding statement (CT-09) at EX-2026-03 on 22 Oct 2026. The date is the last part's; the result is entered once every part has one. | EX-2026-01|O6 |
Summary
Exercise measures
Every figure is calculated from the Exercises, Actions and Objectives and re-tests sheets at the As-at date. Report them to executive management each quarter, with the incident measures (EX-12).
| As-at date | 30 Sep 2026 | EXAMPLE: the example quarter end. Use today's date, or type =TODAY(). |
| Observers' notes within (working days) | 2 | EX-08. |
| After-action report approved within (working days) | 10 | EX-09. |
| Re-test within (months of the action being done) | 6 | EX-11. |
| EXM-03 target: overdue by no more than (days) | 30 | From the target "None more than 30 days overdue". |
| EXM-02 audience | AU-02 | Executive management and the crisis team: the audience EXM-02 reports on. |
| EXM-05 window (months) | 12 | Suppliers that took part in an exercise within this many months of the As-at date. |
Headline measures
| Measure | Result | Detail | Target | Status | What it means | |
|---|---|---|---|---|---|---|
| EXM-01 Audiences exercised within their interval | 2 | of 4 | All four | Action needed | Audiences AU-01 to AU-04 whose last exercise (not a live incident) is within the interval the audience table sets, out of four. Detail: out of how many. | |
| EXM-02 Objectives met at the last exercise | 2 | 2 met, 3 partly met, 1 not met, of 6 tested; 0 not tested | No category Not met at two exercises in a row (COMPARISON_RULE) | On target | At the latest exercise of the executive and crisis team: objectives Met, Partly met and Not met, out of those tested, with Not tested on its own line. Result: objectives met. At the exercise named below, by category. | |
| EXM-03 Exercise actions overdue | 1 | 0 more than limit | None more than 30 days overdue | On target | Open improvement actions from exercises past their due date. Detail: how many are more than the limit overdue. | |
| EXM-04 Re-tests outstanding | 2 | 0 past the window | None past the window | On target | Objectives rated Partly met or Not met whose action is done and whose re-test has not yet happened; and of those, how many are past the re-test window (EX-11). Result: awaiting re-test; detail: past the window. | |
| EXM-05 Critical suppliers exercised | 2 | of 5 | All, by [[year end]] | Action needed | Suppliers the incident response plan names, that took part in an exercise in the last 12 months, out of all of them. Detail: out of how many. | |
EXAMPLE results: 2 of 4 (AU-03 and AU-04 past their interval); 2 met, 3 partly met, 1 not met, of 6 tested (18 Mar 2026); 1 (EA-06, 3 days); 2 awaiting re-test (EA-03 on 6 Oct 2026; EA-05 on 6 Oct 2026 and 22 Oct 2026); 0 past the window; 2 of 5.
Audiences exercised within their interval (EXM-01)
| Audience | ID | Interval (months) | Last exercised | Interval ends | Within? |
|---|---|---|---|---|---|
| Board, or its equivalent | AU-01 | 24 | 20 Nov 2025 | 20 Nov 2027 | Yes |
| Executive management and the crisis team | AU-02 | 12 | 18 Mar 2026 | 18 Mar 2027 | Yes |
| Incident response team | AU-03 | 6 | 18 Mar 2026 | 18 Sep 2026 | No |
| Technical responders | AU-04 | 6 | 18 Mar 2026 | 18 Sep 2026 | No |
Objectives at the latest executive exercise, by category (EXM-02)
| Latest exercise of the audience | EX-2026-01 | 18 Mar 2026 |
| The one before it | — |
| Category | Met | Partly met | Not met | Not tested | Not met at the one before | Not met twice running |
|---|---|---|---|---|---|---|
| OC-01 Detection and escalation | 0 | 0 | 1 | 0 | 0 | No |
| OC-02 Containment decisions | 0 | 1 | 0 | 0 | 0 | No |
| OC-03 Reporting duties | 1 | 0 | 0 | 0 | 0 | No |
| OC-04 Communication | 0 | 1 | 0 | 0 | 0 | No |
| OC-05 Recovery priorities | 0 | 1 | 0 | 0 | 0 | No |
| OC-06 Decision rights and governance | 1 | 0 | 0 | 0 | 0 | No |
| OC-07 Supplier coordination | 0 | 0 | 0 | 0 | 0 | No |
| OC-08 Evidence and records | 0 | 0 | 0 | 0 | 0 | No |
| All categories | 2 | 3 | 1 | 0 | 0 | 0 |
| Results are compared by objective category and audience, as counts: Met, Partly met and Not met out of the objectives tested. Not tested is shown on its own line and never counted as met. A category rated Not met at two exercises in a row for the same audience is reported to executive management as a finding in its own right. | ||||||
Critical suppliers exercised (EXM-05)
| Supplier the incident response plan names | Reference | Last exercise | In the window? | Its part in the plan | ||
|---|---|---|---|---|---|---|
| Managed IT service provider | SUP-001 | 18 Mar 2026 | Yes | Isolates networks and systems, rebuilds devices, restores from backup | ||
| Security monitoring provider | SUP-006 | 18 Mar 2026 | Yes | Detects and alerts around the clock; supplies logs and analysis | ||
| Backup service provider | SUP-011 | No | Confirms backup integrity and supports restoration | |||
| Cloud hosting provider | SUP-002 | No | Protects and restores the hosted ordering platform | |||
| Email and office software provider | SUP-005 | No | Suspends accounts, removes mail rules and supplies mailbox audit logs | |||
Add a row for each supplier your plan names. Suppliers are matched by reference in the Exercises sheet's Suppliers column.
Quarterly report record
| Item | Entry | |||||
|---|---|---|---|---|---|---|
| Reported to executive management by (name, role) and date | [[Name, role, YYYY-MM-DD]] | |||||
| Categories Not met twice running, and what is being done | [[e.g. none]] | |||||
| Decisions needed from executive management | [[e.g. approve the exercise programme for next year (EX-01)]] | |||||
Lists
| ExerciseKind | ExerciseStatus | Kind | YesNo | PriorityName | PriorityDays | ActionStatus | Rating | CategoryID | CategoryName |
|---|---|---|---|---|---|---|---|---|---|
| Tabletop | Planned | Strength | Yes | High | 30 | Open | Met | OC-01 | Detection and escalation |
| Board session | Held | Gap | No | Medium | 90 | In progress | Partly met | OC-02 | Containment decisions |
| Drill | Cancelled | Low | 180 | Done | Not met | OC-03 | Reporting duties | ||
| Closed | Not tested | OC-04 | Communication | ||||||
| Withdrawn | OC-05 | Recovery priorities | |||||||
| OC-06 | Decision rights and governance | ||||||||
| OC-07 | Supplier coordination | ||||||||
| OC-08 | Evidence and records |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Observation | Something an observer saw during the exercise, written as fact: what happened, when, and which objective it concerns. It can be a strength or a gap. |
| Finding | An observation, or several, confirmed at the hot debrief or in the after-action report as a gap that needs a change. |
| Improvement action | The change that closes a finding, with one owner, a due date and the document or control it changes. |
| Re-test | Testing the same decision again once its improvement action is done, to show the change works. |
| Hot debrief | A short, structured discussion held straight after the exercise, the same day, while memories are fresh. |
| After-action report | The written report of an exercise: what was tested, the result for each objective, what held, what failed and the improvement actions agreed. Approved by the sponsor. |
| Exercise | A planned rehearsal of the incident response plan on a made-up incident: a discussion of a scenario, a test of one part (a restore, a call tree), or a full simulation. A live incident is not an exercise. |
| Rating: Met | The right person took the decision the rule requires, within its time and for sound reasons, without a prompt from the facilitator. |
| Rating: Partly met | The decision was right in substance but late, taken by the wrong person, or reached only after a prompt; or part of it was missed. |
| Rating: Not met | The decision was wrong or not taken, or would have broken a rule, a legal clock or a decision right. |
| Rating: Not tested | The exercise did not reach the decision: time ran out or the discussion went another way. Carried to the next exercise, and never counted as met. |
| Priority: High | An objective Not met; or a gap that would break a legal clock, a decision right or a Severity 1 or 2 step. Due within 30 calendar days of the after-action report's approval. |
| Priority: Medium | An objective Partly met; or a gap that would slow the response. Due within 90 calendar days of the after-action report's approval. |
| Priority: Low | An improvement that would make the response easier. Due within 180 calendar days of the after-action report's approval. |
| Status: Open | Agreed, not started. |
| Status: In progress | Work started; due date unchanged. |
| Status: Done | The change is made. Where its objective was Partly met or Not met, it waits for its re-test (EX-11). |
| Status: Closed | Done, and re-tested where EX-11 requires it. |
| Status: Withdrawn | Dropped, with the sponsor's recorded reason. |
| OC-01 Detection and escalation | Did the right people hear of it, and declare it, in time? |
| OC-02 Containment decisions | Did the right person stop the harm spreading, in time, without waiting for permission they did not need? |
| OC-03 Reporting duties | Did we know which reports were due, to whom and by when, and decide in time? |
| OC-04 Communication | Did staff, customers and the press hear one approved message, from the right person? |
| OC-05 Recovery priorities | Did we restore in the right order, from checked backups, only once it was safe? |
| OC-06 Decision rights and governance | Were the big decisions taken by the people entitled to take them, with the advice they needed? |
| OC-07 Supplier coordination | Did we know what depends on each supplier, and use the contract to get their help? |
| OC-08 Evidence and records | Did we keep the evidence and the record that the investigation, the insurer and the authorities will need? |
| Re-test window | An objective rated Partly met or Not met must be re-tested within [[6]] months of its improvement action being done, and its finding stays open until then. A live incident can serve as the re-test when its post-incident review rates the same decision. |
| Overdue (action) | An action Open or In progress whose due date is before the As-at date (EXM-03). |
| Tracker fields | The fields of the Tabletop Exercise Design Methodology's tracker, and where each is kept: Observation ID (Observations); Exercise (Observations); Objective (Observations); Inject (Observations); Observer (Observations); What happened (Observations); Strength or gap (Observations); Finding (Observations); Priority (Observations); Improvement action (Actions); Changes (Actions); Owner (Actions); Due (Actions); Status (Actions); Done (Actions); Re-test (Objectives and re-tests); Re-test result (Objectives and re-tests). |
| Document ID | The ID of the document an action changes, in your document register. The EXAMPLE uses the CISO Times template IDs: P09-A03 is the Incident Response Plan. |
| AU-01 to AU-05 | The audiences of the Tabletop Exercise Design Methodology: AU-01 board, or its equivalent, every 24 months; AU-02 executive management and the crisis team, every 12 months; AU-03 incident response team, every 6 months; AU-04 technical responders, every 6 months; AU-05 critical suppliers with a part in the plan, every 12 months. |
| EX-nn, EXM-nn | Rule and measure numbers of the Tabletop Exercise Design Methodology. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. Delete the EXAMPLE rows before approval. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.27 — Learning from information security incidents | Observations, findings and actions: knowledge gained from exercises used to strengthen incident management |
| ISO/IEC 27001:2022 | Clause 10.2 — Nonconformity and corrective action | Actions with owners, due dates and re-tests that show the correction worked |
| NIST CSF 2.0 | ID.IM-02 — “Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties” | The tracker as a whole: improvements identified from exercises, including those with suppliers |
| NIST CSF 2.0 | ID.IM-04 — “Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved” | Changes: document ID: each action names the plan or playbook it changes |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | Summary measures: the effectiveness of incident handling assessed and reported each quarter |
| DORA — Regulation (EU) 2022/2554 | Article 24(5) — procedures and policies to prioritise, classify and remedy all issues revealed by the tests, and internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed | Priority, due date and re-test: issues revealed by tests prioritised, remedied and checked as fully addressed |
| DORA — Regulation (EU) 2022/2554 | Article 11(6) — test the ICT business continuity plans and the ICT response and recovery plans “in relation to ICT systems supporting all functions at least yearly, as well as in the event of any substantive changes to ICT systems supporting critical or important functions”, and test the crisis communication plans (Article 14); financial entities other than microenterprises include in the testing plans “scenarios of cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups and redundant facilities”; the policy and plans are regularly reviewed taking into account test results and recommendations from audit checks or supervisory reviews | Objectives and re-tests: the plans reviewed taking into account the results of tests |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR)