Tabletop Exercise Design Methodology
Sets exercise objectives, participant selection, inject design and evaluation criteria so results are comparable across years.
Available soon
- Format
- Word
- Size
- 76 KB
- Length
- 26 pages
- Version
- 1.2
- Updated
What's inside
What changed
- 1.2
DORA Article 11(6) quoted in full: the yearly test covers ICT systems supporting all functions.
- 1.1
The worked containment step now uses the least disruptive containment that stops the harm, and brings in the service owner and specialists before stopping a service people depend on for safety or essential operations, as P09's IM-08 now says.
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
Purpose
This methodology is how [[Organisation Name]] designs and judges its incident exercises, so that an exercise in one year can be compared with the next. It sets who is exercised and how often, how a scenario is chosen, how objectives are written, who takes part, how injects are written and how each objective is rated.
An exercise is only worth running if it tests the decisions the Incident Response Plan asks people to take: who isolates, who declares, who reports and by when, who speaks outside, who decides on a ransom. This method keeps every exercise pointed at those decisions, and keeps the measuring stick the same every year. The scenario changes; the objective categories, the audiences and the four ratings do not.
It sets the rules EX-01 to EX-12. Every other document in the Cyber Incident Exercises & Tabletop Scenario Library pack cites them by number.
Guidance — delete before approval
This method exercises the incident response plan; it does not restate it. Severity levels, decision rights, reporting clocks and message templates come from your incident management documents (P09 in this library). If your plan changes, the objectives change with it.
Replace every value in [[double brackets]] before approval, and name real roles, not people.
The rules
These twelve rules are the method. The sections that follow explain each one; the rest of the pack quotes them by number.
EX-01 The exercise programme must be approved by executive management every year. It is owned by the Head of Information Security and sets which audiences are exercised, when, and on which scenarios.
EX-02 Each audience must be exercised at least as often as the audience table sets: the executive and crisis team at least every 12 months, as the incident response plan requires (P09 IM-12). A live incident does not count as an exercise.
EX-03 Every exercise must test decisions. Each objective names a decision, who takes it and the rule or plan step it is judged against. Knowing what the plan says is not an objective on its own.
EX-04 Between three and six objectives must be set, and approved by the sponsor, before the scenario is written. The scenario is then written to test them.
EX-05 Each scenario must come from a top risk in the risk register (P05) or from a recent incident. The same audience must not be given the same scenario at two exercises in a row.
EX-06 Participants must not see the injects in advance. The facilitator must take no decisions in the scenario, and at least one observer must be independent of the team being tested.
EX-07 Every role holder in the incident response plan, and every deputy, must take part in an exercise at least every [[24]] months.
EX-08 A hot debrief must be held the same day, before participants leave. Observers' written notes must follow within [[2]] working days.
EX-09 The after-action report must be approved by the sponsor within [[10]] working days of the exercise, with every objective rated on the evaluation scale.
EX-10 Every finding must have an improvement action with one owner, a due date set by its priority, and the document or control it changes. Actions are tracked until closed.
EX-11 An objective rated Partly met or Not met must be re-tested within [[6]] months of its improvement action being done, and its finding stays open until then. A live incident can serve as the re-test when its post-incident review rates the same decision.
EX-12 The plan and the playbooks an exercise tested must be reviewed after it. The exercise measures are reported to executive management every quarter, with the incident measures (P09 IM-12).
Guidance — delete before approval
EX-07, EX-08, EX-09 and EX-11 carry template defaults in [[double brackets]]: every role holder and deputy exercised at least every 24 months, observers' notes within 2 working days, the after-action report within 10 working days and a re-test within 6 months. You may change them. Change them here, in the Exercise Planning & Facilitation Procedure and in the Exercise Observations & Improvement Tracker together.
EX-02 may not be loosened for the executive and crisis team: the incident response plan must be exercised at least once a year (P09 IM-12).
Principles
Most questions about why an exercise was designed or rated as it was are answered by one of these.
- Test decisions, not knowledge. Every objective names a decision, who takes it and the rule it is judged against (EX-03). Knowing where the plan is kept is not an objective.
- The plan is on trial, not the people. No blame. The exercise tests the plan and the organisation, never the people in the room. Ratings describe what the organisation did, and findings are reported without names.
- Objectives first, scenario second. The sponsor approves what is to be tested before anyone writes the story (EX-04). A scenario written first tests whatever it happens to reach.
- Keep the measuring stick fixed. The same eight objective categories, the same audiences and the same four ratings every year. Only then can this year be compared with last year (COMPARISON_RULE).
- Not tested is never met. A decision the exercise did not reach is carried to the next exercise, and never counted as a success.
- A live incident can prove a fix, and never replaces an exercise. An incident does not reset the clock for any audience (EX-02). Its post-incident review can serve as the re-test of a decision an exercise found wanting (EX-11).
- Every gap becomes an owned action, and every action is re-tested. A finding stays open until the change has been made and shown to work (EX-10, EX-11).
- When observers disagree, take the lower rating. Record both views and the reason. A generous rating hides the gap the exercise was run to find.
Inputs
The exercise lead gathers these before the sponsor approves the objectives. The Exercise Planning & Facilitation Procedure says when in the planning timeline each is needed.
Input | Question it answers | Where it comes from | If it is not known |
|---|---|---|---|
Last exercise of each audience | Which audience is due, and by when? | The approved programme (EX-01); the Exercise Observations & Improvement Tracker | Treat the audience as overdue |
Top risks and their position | Which scenarios matter most? | The Information Security Risk Register (P05) | Record the risk owners' worst credible scenario as a risk first (EX-05) |
Incidents and near misses | What went wrong, or nearly did, for real? | The Incident Case & Action Log and each post-incident review (P09, Post-Incident Review Template) | Use top risks only |
Re-tests due | What must this exercise re-test? | The Exercise Observations & Improvement Tracker | Re-test every objective not Met last time |
The plan and its playbooks | Which rule is each decision judged against? | The Incident Response Plan, the Incident Classification, Severity & Escalation Matrix, the playbooks and the Incident Communications Template Set (P09) | Write the missing step first, in a workshop that is not rated |
Role holders and deputies | Who must take part this time? | The plan's contact directory; the Exercise Observations & Improvement Tracker | Invite every deputy (EX-07) |
Critical suppliers | Which supplier joins which exercise? | The plan's supplier list (P06 TP-10, Third-Party Security Policy) | Ask each supplier owner |
Scales and criteria
Six fixed lists make the method. They change only when this methodology is reviewed, never for a single exercise.
Kinds of exercise
Three kinds of exercise, each for a different purpose. The tabletop is the main tool; a drill checks that one step works for real.
Kind | What it is | What it tests | Length |
|---|---|---|---|
Tabletop | A facilitated discussion of one scenario, in three phases, with a hot debrief. | Decisions, decision rights, reporting and communication. The main tool in this pack. | 3 hours |
Board session | A shorter tabletop on the decisions only the board, or its equivalent, takes. | A ransom demand, a public statement, stopping a core service for days, spending outside budget. | 90 minutes |
Drill | One part of the plan done for real, at a planned time. | Whether a step works and how long it takes: the out-of-hours call route, isolating a site, restoring a system. | 1 hour |
A drill is rated on the same scale as a tabletop, on the one or two objectives it tests. A live incident is none of these (EX-02).
Audiences and intervals
Each audience must be exercised at least as often as the audience table sets: the executive and crisis team at least every 12 months, as the incident response plan requires (P09 IM-12). A live incident does not count as an exercise. The interval is the longest gap allowed between two exercises for that audience.
Audience | Who | At least every | Format | Why |
|---|---|---|---|---|
AU-01 Board, or its equivalent | [[board members, or the owners or trustees where there is no board]] | 24 months | Board session, or the last hour of the executive exercise | Only the board decides on a ransom (P09 IM-08). It should have met that decision before it meets it for real. |
AU-02 Executive management and the crisis team | Executive incident lead, crisis team members and their deputies | 12 months | Tabletop | The incident response plan must be exercised at least once a year (P09 IM-12). |
AU-03 Incident response team | Incident manager and deputy, Head of Information Security, Data Protection Officer, Legal, communications lead | 6 months | Tabletop, once a year with the executive exercise and once on its own; or a drill | The people who run the first hours need practice more often than the executives they brief. |
AU-04 Technical responders | IT operations, the managed IT provider and the security monitoring provider | 6 months | Technical tabletop or drill | Isolation, restores and the out-of-hours route are skills that fade. |
AU-05 Critical suppliers with a part in the plan | Each Tier 1 supplier the plan names (P06 TP-10) | 12 months | Joins an exercise that involves its service | The contract asks each such supplier to take part in our exercises (P06 clause CL-11). |
- Every role holder in the incident response plan, and every deputy, must take part in an exercise at least every [[24]] months. Where a deputy has never taken part, bring them into the next exercise of their audience, even if the role holder took part last time.
- An interval is met only by an exercise in which the audience took part in its own roles. One exercise can serve two audiences if each has objectives of its own in it.
Objective categories
Every objective belongs to one of eight categories, and keeps it across years. The category is what makes results comparable: a ransomware exercise and a payment fraud exercise both test "Detection and escalation".
Category | The question it asks |
|---|---|
OC-01 Detection and escalation | Did the right people hear of it, and declare it, in time? |
OC-02 Containment decisions | Did the right person stop the harm spreading, in time, without waiting for permission they did not need? |
OC-03 Reporting duties | Did we know which reports were due, to whom and by when, and decide in time? |
OC-04 Communication | Did staff, customers and the press hear one approved message, from the right person? |
OC-05 Recovery priorities | Did we restore in the right order, from checked backups, only once it was safe? |
OC-06 Decision rights and governance | Were the big decisions taken by the people entitled to take them, with the advice they needed? |
OC-07 Supplier coordination | Did we know what depends on each supplier, and use the contract to get their help? |
OC-08 Evidence and records | Did we keep the evidence and the record that the investigation, the insurer and the authorities will need? |
Kinds of inject
Five kinds of inject, each forcing a different question. A good scenario uses at least three of them.
Kind | What happens | The question it forces |
|---|---|---|
Development | The incident grows or changes: more systems, more data, a new fact. | Does the severity, the scope or the plan change? |
Outside contact | A customer, journalist, regulator, supplier, bank or attacker gets in touch. | Who answers, and what do we say? |
Complication | Something the plan relies on fails: a backup, a person, a tool, a log. | What is our fallback? |
Pressure | Time, money or a senior person pushes for a shortcut. | Do we hold to the rule, and who decides? |
Deadline | A legal or contractual clock is running out. | Do we report now, with what we know? |
The evaluation scale
Every objective is rated on this scale, in words. There is no score out of 100 and no average: four ratings, each with an anchor that applies to any objective.
Rating | Anchor |
|---|---|
Met | The right person took the decision the rule requires, within its time and for sound reasons, without a prompt from the facilitator. |
Partly met | The decision was right in substance but late, taken by the wrong person, or reached only after a prompt; or part of it was missed. |
Not met | The decision was wrong or not taken, or would have broken a rule, a legal clock or a decision right. |
Not tested | The exercise did not reach the decision: time ran out or the discussion went another way. Carried to the next exercise, and never counted as met. |
The anchor is read against the objective's own success statement. That statement names the decision, who takes it, the rule and, where it matters, the time. "Met" means all of them held.
Finding priority
Every finding must have an improvement action with one owner, a due date set by its priority, and the document or control it changes. Actions are tracked until closed. The priority sets the due date, in calendar days from the approval of the after-action report.
Priority | When | Due within |
|---|---|---|
High | An objective Not met; or a gap that would break a legal clock, a decision right or a Severity 1 or 2 step | 30 days |
Medium | An objective Partly met; or a gap that would slow the response | 90 days |
Low | An improvement that would make the response easier | 180 days |
An objective rated Not met always gives at least one High finding; one rated Partly met gives at least a Medium one. A gap on a Met objective can still be a finding, usually Medium or Low.
An improvement action is Open, In progress, Done, Closed or Withdrawn. It is Closed only once its re-test, where EX-11 requires one, is Met; the Exercise Observations & Improvement Tracker defines each status.
Decision logic
The steps
- Approve the programme for the year: audiences, dates and scenarios (EX-01).
- Choose the scenario for the audience that is due (EX-05; see "Choosing a scenario").
- Write between three and six objectives, each in a category, and have the sponsor approve them before the scenario is written (EX-03, EX-04).
- Select the participants and observers, including deputies and suppliers (EX-06, EX-07).
- Write the injects so each objective is tested at least once (INJECT_RULES).
- Run the exercise and the hot debrief the same day, as the Exercise Planning & Facilitation Procedure sets out (EX-08).
- Rate each objective on the evaluation scale, with the observations behind it (EX-09).
- Turn each gap into a finding and an action with a priority, an owner and a due date (EX-10).
- Re-test each objective rated Partly met or Not met once its action is done (EX-11).
- Compare and report the results by category and audience, every quarter (EX-12, COMPARISON_RULE).
Building the programme
The exercise programme must be approved by executive management every year. It is owned by the Head of Information Security and sets which audiences are exercised, when, and on which scenarios.
- List the audiences. For each, find the date of its last exercise and add its interval. That is the date by which it must be exercised again.
- Place each exercise before its due date. Where an audience is already past its date, exercise it in the next quarter.
- Keep exercises out of the organisation's busiest weeks: [[e.g. the peak trading season, the year-end close]].
- Pair audiences where the scenario needs both. The executive exercise usually brings in the incident response team; the board can join for its last hour.
- Place each critical supplier in an exercise that involves its service, within 12 months (AU-05).
- Check that every role holder and deputy is invited to at least one exercise inside 24 months (EX-07).
- Choose each exercise's scenario (see below), and take the programme to executive management for approval.
Guidance — delete before approval
A live incident does not move any audience's due date (EX-02). Its post-incident review is still an input: it may change which scenario comes next, and it may serve as a re-test (EX-11).
Choosing a scenario
Each scenario must come from a top risk in the risk register (P05) or from a recent incident. The same audience must not be given the same scenario at two exercises in a row. Where more than one scenario qualifies for an audience, go down this list and stop at the first step that applies. Apply the no-repeat rule first.
Step | It applies when | Choose |
|---|---|---|
1. A re-test is due | An objective this audience rated Partly met or Not met has its improvement action done, and its re-test window is running (EX-11). | A scenario with an objective in the same category that tests the same decision. |
2. A top risk is outside appetite | A top risk in the register is outside appetite or outside tolerance. | The scenario that risk points to. |
3. A serious incident happened | A Severity 1 or 2 incident, or a near miss on a top risk, happened in the last 12 months. | The scenario closest to it, to test the decisions the post-incident review changed. |
4. A top risk has never been exercised | A top risk this audience has never met in an exercise. | The scenario that risk points to. |
5. None of these | Every top risk has been exercised and nothing is due. | The top risk this audience exercised longest ago. |
The scenario library, with the EXAMPLE top risks and incidents that point to each. Your own register and incident log replace these.
Scenario | Audiences it is written for | EXAMPLE top risks (P05) | EXAMPLE incidents (P09) |
|---|---|---|---|
SC-01 Ransomware encryption of core systems (A04) | AU-02, AU-03 | R-01 Ransomware takes online ordering offline for more than 2 days R-04 Ransomware spreads from warehouse office PCs to warehouse systems R-10 Backups cannot restore a critical system | INC-2026-014 |
SC-02 Critical supplier outage (A05) | AU-02, AU-03, AU-05 | R-01 Ransomware takes online ordering offline for more than 2 days R-06 Managed IT provider fails or is compromised | None |
SC-03 Insider data exfiltration (A06) | AU-03 | None | None |
SC-04 Cloud tenant account takeover (A07) | AU-03, AU-04, AU-05 | R-09 Staff account taken over through phishing | INC-2026-017 |
SC-05 Executive payment fraud (A08) | AU-02, AU-03 | R-02 Payment fraud through a compromised supplier email account | INC-2026-015 |
SC-06 Personal data breach against the clock (A09) | AU-03 | R-03 Customer data exposed through the ordering service R-11 Cloud storage misconfigured and customer files exposed | INC-2026-016 |
Guidance — delete before approval
A scenario with no top risk and no incident behind it may not be used (EX-05). In the EXAMPLE, SC-03 insider data exfiltration has neither. If it matters to you, record the risk in your register first; if it does not, leave the scenario out.
Writing objectives that test decisions
Every exercise must test decisions. Each objective names a decision, who takes it and the rule or plan step it is judged against. Knowing what the plan says is not an objective on its own. Between three and six objectives must be set, and approved by the sponsor, before the scenario is written. The scenario is then written to test them.
An objective has five parts. The EXAMPLE is SC-01's first objective.
Part | Question | EXAMPLE: SC-01 O1 |
|---|---|---|
Category | Which of the eight categories does it test? | OC-02 Containment decisions |
Decision | What must be decided? | Whether to isolate the affected systems, and who may decide it |
Who | Who is entitled to take it? | The incident manager, without waiting for the executive |
Rule | Which rule or plan step is it judged against? | P09 IM-08, P09 IM-07 |
Success | What does Met look like, and by when? | The incident manager decides to isolate the affected systems within [[30]] minutes of declaration, without waiting for the executive (IM-08). |
Objectives that fail EX-03, and the objective from the library that replaces each:
Not an objective | Why it fails | Written to test a decision |
|---|---|---|
Participants understand the incident response plan. | Tests knowledge, not a decision. Nobody can be rated on it. | SC-01 O1 Isolate without waiting |
Test our ransomware response. | A topic. It names no decision, no decision-maker and no rule. | SC-01 O4 Restore in the right order, safely |
Communicate effectively with stakeholders. | No one can say what "effectively" means, so every rating is an opinion. | SC-01 O6 Speak with one voice |
Improve our GDPR awareness. | Training, not an exercise objective. The exercise tests whether the decision is taken, and when. | SC-06 O3 Decide on notification in time |
- Three objectives suit a 90-minute session; six is the most a 3-hour tabletop can test well.
- Participants hear each objective and the decision it tests, at the pre-brief. What Met looks like stays with the facilitator and the observers: a room that knows the answer plays to it (EX-06).
- Spread them across categories. Two objectives in the same category are allowed where the scenario tests two different decisions.
- Carry forward any objective due a re-test (EX-11), in its category, written for the new scenario.
Selecting participants
Participants must not see the injects in advance. The facilitator must take no decisions in the scenario, and at least one observer must be independent of the team being tested. Everyone in the room has one role.
Role | Who, in your organisation | What they do |
|---|---|---|
Exercise sponsor | [[e.g. Chief Operating Officer, usually the executive incident lead]] | The executive who asks for the exercise, approves its objectives and approves the after-action report. |
Exercise lead | [[e.g. Head of Information Security, who owns the programme]] | Owns the programme, plans the exercise and drafts the after-action report. |
Facilitator | [[the exercise lead, or an outside facilitator; never a participant]] | The person who runs the exercise. Gives the injects, keeps time and keeps the discussion on the objectives. Takes no decisions in the scenario. |
Scribe | [[e.g. a security analyst or an assistant]] | The person who records each decision, who took it and when, as the exercise runs. |
Observers | [[at least one independent of the team tested, e.g. Internal Audit]] | A person who watches and records against the objectives, and takes no part in the discussion or the decisions. |
Scenario checker | [[a subject expert who does not take part, e.g. the managed IT provider's lead]] | Checks the scenario for realism before the day, and does not take part. |
Participants | [[the role holders and deputies of the audience being exercised]] | A person who plays their own real role in the scenario and takes the decisions that role would take. |
- Invite the people who hold the roles in the plan, and their deputies. A stand-in who would not hold the role in a real incident tests nothing.
- Keep the table to [[6 to 12]] participants. Beyond that, split the audiences, or seat the extra people as observers.
- Bring a critical supplier in when the scenario involves its service (AU-05). It plays its own part, under the contract.
- Where the exercise lead facilitates, their own role in the scenario is played by their deputy. The independent observer can be internal audit, a peer from another site or an outside facilitator.
Designing injects
Injects are written after the objectives are approved, to test them. Every scenario deck in this pack follows these rules:
- Every inject forces at least one decision. The facilitator's card names the decision, the expected good answer and the rule it is judged against.
- Every objective has at least one inject that tests it.
- No more than one inject every 10 to 15 minutes, so each gets a decision before the next arrives.
- Scenario time can jump (Day 2, 09:00) while the exercise clock runs on. Each inject states both.
- At most one Complication per phase: a scenario where everything fails tests nothing.
- Injects are never shown to participants in advance (EX-06). The facilitator may hold one spare inject per phase for a discussion that stalls.
Each inject is written on a card for the facilitator. The EXAMPLE card is SC-01 I2.
Field | EXAMPLE: SC-01 I2 |
|---|---|
Exercise clock | Minute 30, in Phase 1: first signs and the first hour |
Scenario time | Day 1, 07:10 |
Kind | Development |
Objective | O1 Isolate without waiting |
What participants hear | Encryption now shows on the [[core business system]] servers. A ransom note is on screen. |
The decision it forces | Isolate now, or investigate first? Who decides? |
Expected good answer | The incident manager isolates at once. Harm is spreading, so containment comes before investigation (IM-07). Use the least disruptive containment that stops the harm, and bring in the service owner and specialists before any action that would stop a service people depend on for safety or essential operations. Tell the executive incident lead at the next update. |
Judged against | P09 IM-07, P09 IM-08 |
Before the scenario is approved, the exercise lead checks that every objective has an inject, and that the injects are spread across the three phases of the 180-minute session:
SC-01 objective | Category | Injects that test it |
|---|---|---|
O1 Isolate without waiting | Containment decisions | I2: Phase 1, minute 30, Development |
O2 Declare and escalate, in and out of hours | Detection and escalation | I1: Phase 1, minute 15, Development I3: Phase 1, minute 45, Pressure I9: Phase 3, minute 135, Complication |
O3 Screen the reporting duties | Reporting duties | I4: Phase 2, minute 65, Deadline |
O4 Restore in the right order, safely | Recovery priorities | I5: Phase 2, minute 80, Complication I8: Phase 3, minute 125, Pressure |
O5 Put the extortion demand to the right people | Decision rights and governance | I6: Phase 2, minute 95, Outside contact |
O6 Speak with one voice | Communication | I7: Phase 3, minute 110, Outside contact |
Each phase holds 3 injects. Phase 1 has no Complication; Phase 2 has one Complication (I5); Phase 3 has one Complication (I9).
Rating each objective
Observers rate each objective against its success statement, in this order. Stop at the first answer that decides it.
- Did the exercise reach the decision? If not, because time ran out or the discussion went elsewhere: Not tested. Carry it to the next exercise.
- Was the decision wrong, not taken, or would it have broken a rule, a legal clock or a decision right? If so: Not met.
- Was it taken by the right person, within its time, without a prompt from the facilitator, and in full? If all four hold: Met. If any one fails: Partly met.
Each rating is recorded with the observations behind it, written as fact, with the exercise time. The hot debrief gives a first view (EX-08); the after-action report fixes the rating (EX-09).
Comparing results across years
Results are compared by objective category and audience, as counts: Met, Partly met and Not met out of the objectives tested. Not tested is shown on its own line and never counted as met. A category rated Not met at two exercises in a row for the same audience is reported to executive management as a finding in its own right.
- Stays the same every year: the eight objective categories, the audiences and their intervals, the four ratings and their anchors, and how results are counted.
- Changes from one exercise to the next: the scenario, the injects, the wording of each objective and the number of objectives, from three to six.
- Report counts, never a percentage. "2 of 6" tells the reader how few objectives there were; "33%" hides it.
- Compare an audience with itself. The board and the technical responders face different decisions, and their counts are not added together.
- A category that is not tested this year keeps its last result, shown with its date.
Worked examples
The examples are from the EXAMPLE organisation used throughout this library: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Figures are as at 30 Sep 2026. Its busiest season is November and December, so no exercise is held then. Every date, interval and deadline below is worked out by the rules above.
Example 1: the ransomware tabletop of 18 Mar 2026
EX-2026-01 was the yearly exercise of the plan that P09 IM-12 requires. It ran SC-01 Ransomware encryption of core systems for three audiences.
Step | EX-2026-01 |
|---|---|
Audiences (EX-02) | AU-02 Executive management and the crisis team AU-03 Incident response team AU-04 Technical responders |
Why this scenario (EX-05) | R-01 and R-04: the two ransomware risks in the register |
Sponsor and scribe | Chief Operating Officer (executive incident lead); security analyst |
Facilitator (EX-06) | Head of Information Security; their own role was played by their deputy |
Observers (EX-06) | Internal Audit Manager (independent); Quality and Compliance Manager (not a participant) |
Participants | Chief Operating Officer; Information Security Manager (incident manager); Deputy incident manager; Head of IT; Data Protection Officer; Legal counsel; Head of Marketing and Communications; Head of Logistics; Managed IT provider (SUP-001); Security monitoring provider (SUP-006) |
Suppliers (AU-05) | SUP-001 Managed IT service provider SUP-006 Security monitoring provider |
Objectives (EX-04) | 6, approved before the scenario was written |
Debrief (EX-08) | Hot debrief 18 Mar 2026, the same day; observers' notes 20 Mar 2026, 2 working days after |
After-action report (EX-09) | Approved 31 Mar 2026, 9 working days after (limit 10) |
Each objective was rated by the steps in "Rating each objective":
Objective | Rating | Observation | Why this rating |
|---|---|---|---|
O1 Isolate without waiting | Partly met | OB-01: Isolation was agreed 40 minutes after declaration, after a debate over whether the incident manager could stop dispatch without the Chief Operating Officer. | The right decision, by the right person in the end, but late: after the target, and after a debate about a permission the plan did not require. |
O2 Declare and escalate, in and out of hours | Not met | OB-03: The monitoring provider's out-of-hours analyst could reach only the IT service desk, which then had to find the incident manager: 25 minutes lost before anyone could declare. | The alert route the objective tests did not work. The incident manager, who must declare, could not be reached directly, so the declaration the rule requires was not taken in time. |
O3 Screen the reporting duties | Met | OB-02: The screen was finished in time, but only after Legal looked up whether the firm is an important entity under NIS2. Nobody else knew. | The screen was complete in time. It depended on one person knowing the firm's NIS2 status, so a gap was still recorded against a Met objective. |
O4 Restore in the right order, safely | Partly met | OB-04: Nobody could say when a backup of the ordering platform was last restored and checked. | The recovery order was right, but nobody could show the backups had been checked, which the recovery criteria require before restoring. |
O5 Put the extortion demand to the right people | Met | OB-07: The Chief Operating Officer refused to discuss paying and asked for the board chair, Legal and the insurer within ten minutes of the demand. | The demand went to the people entitled to decide, with the advice they needed, without a prompt. |
O6 Speak with one voice | Partly met | OB-05: The customer notice took 70 minutes to approve, because it was written from scratch. | The right person approved the customer notice, but after the target, because it was written from scratch. |
OB-01 records isolation after 40 minutes against O1's target of 30; OB-05 records 70 minutes for the customer notice against O6's 60. In both, the right person took the right decision late, which the scale rates Partly met.
One gap was about no objective: Two of the five deputies named in the plan had never taken part in an exercise. It was still a finding (EX-07).
Result, counted by the comparison rule: 2 met, 3 partly met, 1 not met, of 6 tested (18 Mar 2026).
The findings became actions, each due by its priority from the report's approval on 31 Mar 2026:
Action | From | What changes | Priority and due | Status | Re-test (EX-11) |
|---|---|---|---|---|---|
EA-01 | OB-01 (O1, Partly met) | Write into the plan that the incident manager may isolate a system, site or account without waiting for the executive | High 30 Apr 2026 | Closed 22 Apr 2026 | INC-2026-014, 12 Aug 2026: Met |
EA-02 | OB-02 (O3, Met) | Confirm the firm's NIS2 status in writing and put the three legal questions into the first-hour steps | Medium 29 Jun 2026 | Closed 8 May 2026 | Not required |
EA-03 | OB-03 (O2, Not met) | Give the monitoring provider's out-of-hours analysts a direct route to the incident manager or their deputy | High 30 Apr 2026 | Done 10 Sep 2026 | EX-2026-02, 6 Oct 2026: awaited |
EA-04 | OB-04 (O4, Partly met) | Restore and check a backup of the ordering platform every month, with the backup provider | Medium 29 Jun 2026 | Closed 28 May 2026 | INC-2026-014, 13 Aug 2026: Met |
EA-05 | OB-05 (O6, Partly met) | Pre-approve the customer notice and the media holding statement, with blanks for the facts | Medium 29 Jun 2026 | Done 12 Jun 2026 | EX-2026-02, 6 Oct 2026, CT-04 EX-2026-03, 22 Oct 2026, CT-09: awaited |
EA-06 | OB-06 | Bring every deputy named in the plan into an exercise | Low 27 Sep 2026 | Open | Not required |
Five months later, the 12 Aug 2026 ransomware incident (P09 INC-2026-014) tested several of the same decisions for real. Its post-incident review rated them, and served as the re-test where EX-11 allows:
Objective | Rating on 18 Mar 2026 | In the August incident | What it showed |
|---|---|---|---|
O1 Isolate without waiting | Partly met | Met | Isolation decided by the incident manager 30 minutes after declaration, as EA-01 wrote into the plan. |
O2 Declare and escalate, in and out of hours | Not met | Partly met | Escalation after declaration was on time, but the alert still reached the IT service desk first: EA-03 was still open. The review raised it again as PIA-05. |
O3 Screen the reporting duties | Met | Met | Screen complete inside the 4 hours; early warning 7 hours 15 minutes after declaration. |
O4 Restore in the right order, safely | Partly met | Met | Backups checked before restoring, as EA-04 set up. |
O5 Put the extortion demand to the right people | Met | Not tested | No ransom was demanded. |
O6 Speak with one voice | Partly met | Not tested | No customer service was affected, so no customer notice was needed. |
What it shows. The two fixes made quickly held under real pressure. The one action left open, the out-of-hours alert route, failed again in August exactly as the exercise had predicted. An exercise finding is only as good as the action that closes it.
Example 2: the programme for the fourth quarter of 2026
As at 30 Sep 2026, each audience's last exercise, the date by which it must be exercised again (EX-02) and what is planned:
Audience | Last exercise | Interval | Due by | Status at 30 Sep 2026 | Next planned |
|---|---|---|---|---|---|
AU-01 Board, or its equivalent | EX-2025-03 20 Nov 2025 | 24 months | 20 Nov 2027 | Within interval | EX-2027-01 17 Mar 2027, tabletop |
AU-02 Executive management and the crisis team | EX-2026-01 18 Mar 2026 | 12 months | 18 Mar 2027 | Within interval | EX-2026-03 22 Oct 2026, tabletop |
AU-03 Incident response team | EX-2026-01 18 Mar 2026 | 6 months | 18 Sep 2026 | Past interval | EX-2026-02 6 Oct 2026, drill |
AU-04 Technical responders | EX-2026-01 18 Mar 2026 | 6 months | 18 Sep 2026 | Past interval | EX-2026-02 6 Oct 2026, drill |
Critical suppliers the plan names (AU-05):
Supplier | Took part in the last 12 months | Next planned |
|---|---|---|
SUP-001 Managed IT service provider | EX-2026-01, 18 Mar 2026 | EX-2026-02, 6 Oct 2026 |
SUP-006 Security monitoring provider | EX-2026-01, 18 Mar 2026 | EX-2026-02, 6 Oct 2026 |
SUP-011 Backup service provider | No | EX-2026-02, 6 Oct 2026 |
SUP-002 Cloud hosting provider | No | EX-2027-01, 17 Mar 2027 |
SUP-005 Email and office software provider | No | EX-2026-03, 22 Oct 2026 |
What the August incident changed in the programme:
- The post-incident review of the Severity 1 incident also reviewed the plan, as P09 IM-12 requires after every Severity 1 incident.
- EA-03 was still open, and the review raised the same gap again as PIA-05. One change, made on 10 Sep, answers both. Its re-test is the 06:30 drill on 6 Oct.
- The executive exercise moved to payment fraud (SC-05): ransomware was exercised in March and handled for real in August, while payment fraud is outside appetite.
- The live incident did not reset the exercise clock. The incident response team and the technical responders are past their six-month interval, and both are exercised in October.
The two exercises of the quarter:
EX-2026-02 | EX-2026-03 | |
|---|---|---|
Date | 6 Oct 2026 | 22 Oct 2026 |
Kind | Drill | Tabletop |
Scenario | No scenario: a drill | SC-05 Executive payment fraud |
Audiences | AU-03 Incident response team AU-04 Technical responders Executive incident lead (AU-02) joins for SC-01.O6 only | AU-02 Executive management and the crisis team AU-03 Incident response team |
Suppliers | SUP-001 Managed IT service provider SUP-006 Security monitoring provider SUP-011 Backup service provider | SUP-005 Email and office software provider |
Re-tests (EX-11) | SC-01.O2 Declare and escalate, in and out of hours SC-01.O6 Speak with one voice, for the customer notice (CT-04) | SC-01.O6 Speak with one voice, through SC-05 O6 Handle the reputational side, for the media holding statement (CT-09) |
Why | Planned for 24 Jun 2026 to re-test the out-of-hours alert route for real, at 06:30 (SC-01 O2, through EA-03). Postponed so that the warehouse network separation (P05 TA-04) could finish first. It also re-tests approval of the customer notice (SC-01 O6, through EA-05): the executive incident lead, who approves it, joins for that step as a participant. It does not count as an exercise for AU-02 (executive management and the crisis team). After INC-2026-014 it rehearses isolating a site as well | R-02: payment fraud is outside appetite, and INC-2026-015 was a €84,000 near miss. Held before the peak season |
How the scenario for EX-2026-03 was chosen, step by step through "Choosing a scenario":
Step | What the EXAMPLE found | Scenarios left |
|---|---|---|
No repeat (EX-05) | The executive team last exercised SC-01 Ransomware encryption of core systems. | SC-02, SC-03, SC-04, SC-05, SC-06 |
1. A re-test is due | EA-05 (O6, Communication) was done on 12 Jun 2026. Its re-test needs a communication objective. | SC-02, SC-03, SC-05, SC-06 |
2. A top risk is outside appetite | R-01 Ransomware takes online ordering offline for more than 2 days; R-02 Payment fraud through a compromised supplier email account: outside appetite, within tolerance. | SC-02, SC-05 |
3. A serious incident happened | INC-2026-015: request to change a supplier's bank details from its compromised mailbox, stopped by the call-back check. | SC-05 |
SC-02 critical supplier outage was not dropped. It is planned for 17 Mar 2027, when the board joins for the last hour.
Example 3: comparing March with October
The executive team (AU-02) will have met two different scenarios. The comparison rule sets them side by side by category:
Category | 18 Mar 2026: SC-01 | 22 Oct 2026: SC-05 | What the comparison rule does |
|---|---|---|---|
OC-01 Detection and escalation | O2 Declare and escalate, in and out of hours: Not met | O2 Declare and escalate: [[rating]] | Not met in March. If Not met again, reported to executive management as a finding in its own right. |
OC-02 Containment decisions | O1 Isolate without waiting: Partly met | O1 Recall the money fast: [[rating]] | Compared with March. |
OC-03 Reporting duties | O3 Screen the reporting duties: Met | O4 Make the reports: [[rating]] | Compared with March. |
OC-04 Communication | O6 Speak with one voice: Partly met | O6 Handle the reputational side: [[rating]] | Compared with March. |
OC-05 Recovery priorities | O4 Restore in the right order, safely: Partly met | — | Not tested in October. The March result stays the latest for this category. |
OC-06 Decision rights and governance | O5 Put the extortion demand to the right people: Met | O5 Fix the control, blame nobody: [[rating]] | Compared with March. |
OC-07 Supplier coordination | — | — | Not tested by either. A gap in coverage for the programme to fill. |
OC-08 Evidence and records | — | O3 Keep the evidence: [[rating]] | First result for this audience in this category. |
What it shows. Only OC-01 Detection and escalation was Not met in March and is tested again in October. If it is Not met again, that is reported to executive management as a finding in its own right, whatever the scenario. The March count, "2 met, 3 partly met, 1 not met, of 6 tested (18 Mar 2026)", sits beside October's in the quarterly report, never averaged with it.
How to defend the method to an auditor
An auditor will usually test that incident response is planned and prepared for, with roles set and tested; that tests happen at planned intervals; and that what they find leads to improvements that are tracked and checked (ISO/IEC 27001 Annex A 5.24 and 5.27). Regulated entities will also be asked to show a testing programme with scenario-based tests, and a way to prioritise and fix what the tests find (see "Adapting this template").
Evidence to have ready
- This methodology and the exercise programme, both approved by executive management within the last 12 months (EX-01).
- For each exercise: the approved objectives dated before the scenario (EX-04), the attendance list, the observers' notes and the approved after-action report (EX-08, EX-09).
- The Exercise Observations & Improvement Tracker: every finding with its action, owner, due date, status and re-test (EX-10, EX-11), and each audience's exercise dates (EX-02).
- The quarterly reports to executive management with EXM-01, EXM-02, EXM-03, EXM-04, EXM-05 (EX-12).
The re-derivation test
Invite the auditor to pick [[3]] objectives from the last two after-action reports. For each, read the observations behind it and apply the rating steps: the rating should come out the same. Then check that each finding's due date is its priority's days after the report's approval, and that each Partly met or Not met objective has a re-test inside the window. Run this test yourself each quarter, so the first time is not in front of the auditor.
Questions auditors commonly ask
Question | Answer the method gives |
|---|---|
How do you know an exercise was a real test? | Objectives were approved before the scenario was written, participants did not see the injects, the facilitator took no decisions and at least one observer was independent (EX-04, EX-06). |
How do you compare this year with last year, when the scenario changed? | By objective category and audience, as counts on a fixed four-point scale (COMPARISON_RULE). The scenario changes; the categories and the scale do not. |
How do you know the fixes work? | Every objective rated Partly met or Not met is re-tested within 6 months of its action being done, and its finding stays open until then (EX-11). EXM-04 reports any re-test past its window. |
Limitations
No exercise method is complete. These are this one's known weaknesses, and how they are managed.
Limitation | Effect | How it is managed |
|---|---|---|
A tabletop tests what people say they would do. | A decision taken easily in the room can fail on the night: the phone number is wrong, the restore takes longer. | Drills test the steps that must work for real. Live incidents are used as re-tests where their reviews rate the same decision. |
Ratings are judgements. | Two observers can differ by one rating. | Written anchors, rating steps in order, the lower rating when observers disagree, and yearly calibration. |
Categories hide how hard the scenario was. | A category Met in an easy scenario and Partly met in a hard one looks like a decline. | Report the scenario beside each result, and read two results in a row before calling a trend (COMPARISON_RULE). |
Participants learn the scenarios. | The same people met with the same story will do better the second time for the wrong reason. | No audience gets the same scenario twice running (EX-05). Injects are never shared in advance (EX-06). |
The facilitator shapes the result. | A prompt at the right moment turns Not met into Partly met. | Every prompt is recorded by the scribe; a decision reached only after a prompt is never Met. |
Calibration and review
Calibrating observers
- Before their first exercise, and every year after, each observer rates the cases below on their own, using the rating steps.
- Compare with the expected ratings and discuss each difference. A pattern of differences shows an anchor that needs clearer wording: change it here, and record the change below.
- After each exercise, compare the observers' first views from the hot debrief with the ratings in the approved report. Where the sponsor changed a rating, record why.
Rating calibration cases
Case | What the observer saw | Rating | Why |
|---|---|---|---|
1 | The incident manager isolates the servers 20 minutes after declaration, on their own authority, without a prompt. The objective's target is 30 minutes. | Met | Right person, right decision, within time, no prompt. |
2 | The same decision is taken in 20 minutes, but only after the facilitator asks "who is allowed to decide this?" | Partly met | Reached only after a prompt. |
3 | The team agrees to isolate, but waits 45 minutes for the executive's permission, which the plan says it does not need. | Partly met | Right in substance, but late and by the wrong person. |
4 | The team decides to restore from backup before anyone has checked how the attacker got in. | Not met | The decision would break a rule (the recovery criteria, P09 IM-10). |
5 | The team discusses the GDPR clock at length and agrees to "come back to it". The session ends first. | Not met | The decision was reached and not taken. Only a decision the exercise never reached is Not tested. |
6 | The extortion inject is never given because Phase 2 overran. | Not tested | The exercise did not reach the decision. Carried to the next exercise. |
7 | The chief executive decides to pay the ransom in the room, without the board. | Not met | It breaks a decision right: only the board or its equivalent may decide (P09 IM-08). |
Every quarter
Head of Information Security reports these measures to executive management with the incident measures (EX-12). The EXAMPLE column is as at 30 Sep 2026.
Measure | Definition | Target | EXAMPLE |
|---|---|---|---|
EXM-01 Audiences exercised within their interval | Audiences AU-01 to AU-04 whose last exercise (not a live incident) is within the interval the audience table sets, out of four. | All four | 2 of 4 (AU-03 and AU-04 past their interval) |
EXM-02 Objectives met at the last exercise | At the latest exercise of the executive and crisis team: objectives Met, Partly met and Not met, out of those tested, with Not tested on its own line. | No category Not met at two exercises in a row (COMPARISON_RULE) | 2 met, 3 partly met, 1 not met, of 6 tested (18 Mar 2026) |
EXM-03 Exercise actions overdue | Open improvement actions from exercises past their due date. | None more than 30 days overdue | 1 (EA-06, 3 days) |
EXM-04 Re-tests outstanding | Objectives rated Partly met or Not met whose action is done and whose re-test has not yet happened; and of those, how many are past the re-test window (EX-11). | None past the window | 2 awaiting re-test (EA-03 on 6 Oct 2026; EA-05 on 6 Oct 2026 and 22 Oct 2026); 0 past the window |
EXM-05 Critical suppliers exercised | Suppliers the incident response plan names, that took part in an exercise in the last 12 months, out of all of them. | All, by [[year end]] | 2 of 5 |
And checks these signals that the method needs attention:
Check | Signal |
|---|---|
Ratings | Every objective Met, exercise after exercise: the scenarios are too easy, or the success statements too loose. |
Not tested | More than [[one]] objective Not tested per exercise: too many injects, or phases too short. |
Coverage | A category not tested for an audience in [[24]] months. |
Live incidents | A decision rated Met in an exercise that failed in a real incident: the exercise did not test it hard enough. |
Review
This methodology is reviewed at least every 12 months, with the exercise programme (EX-01). It is also reviewed after a Severity 1 incident, when the incident response plan changes, or when the quarterly checks show the same signal twice. The review is approved by executive management. A change to the categories or the scale breaks the comparison with earlier years: record it, and show the old and new results separately.
Calibration record
Date | Observers | Cases rated | Differences | Change made | Approved by |
|---|---|---|---|---|---|
[[YYYY-MM-DD]] | [[Roles]] | [[n]] | [[n]] | [[None / description]] | [[Name]] |
Related documents
Document | Relationship |
|---|---|
Exercise Planning & Facilitation Procedure | Plans and runs an exercise to these rules: timeline, run of show, roles, hot debrief |
The six scenario decks, A04 to A09: ransomware encryption of core systems; critical supplier outage; insider data exfiltration; cloud tenant account takeover; executive payment fraud; personal data breach against the clock | SC-01 to SC-06, written to EX-03 to EX-06 and the inject rules |
Exercise Logistics & Participant Readiness Checklist | Checks the logistics and the participants before the day |
Exercise Observations & Improvement Tracker | Records observations, findings, actions and re-tests (EX-10, EX-11) |
Exercise After-Action Report Template | Reports each exercise, with every objective rated on the scale (EX-09) |
Incident Response Plan (P09) | The plan every exercise tests; must be exercised yearly (IM-12) |
Information Security Risk Register (P05) | The top risks each scenario must come from (EX-05) |
Adapting this template
Guidance — delete before approval
Small organisation: keep the eight categories, the four ratings and the rules on objectives and re-tests; they are what makes results comparable. Audiences may merge: in a firm of [[20]], the executive team and the incident response team may be the same [[4]] people, exercised together once a year with a drill six months later. Where there is no internal audit, an outside facilitator or a peer from another firm can be the independent observer (EX-06).
Regulated entity (NIS2, DORA): NIS2 Article 21(2)(f) asks for procedures to assess whether your security measures work; this method and its records are one. Digital providers bound by Implementing Regulation (EU) 2024/2690 must test their incident response procedures at planned intervals (Annex, point 3.5.5): the programme is those intervals. Financial entities under DORA test their response and recovery plans at least yearly, with cyber-attack scenarios, and test their crisis communication plans (Article 11(6)); record the tabletop as a scenario-based test within the testing programme (Articles 24(1) and 25(1)), and the tracker as the way issues are prioritised and remedied (Article 24(5)).
IT run by a service provider: the provider's people are technical responders (AU-04) and a critical supplier (AU-05). They take part in their own roles, and may help write injects for their service. Their staff may observe, but never as the only observer or as the independent one. When the exercise tests the provider's own service, its staff take part as participants instead, and it is never the scenario checker for a scenario that tests it.
An existing exercise programme: keep one scale. Map your current ratings onto the four here and record the mapping, so earlier results can still be compared.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR).
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 5.24 — Information security incident management planning and preparation | The whole method |
ISO/IEC 27001:2022 | Annex A 5.27 — Learning from information security incidents | Evaluation scale; findings, actions and re-tests (EX-09 to EX-11) |
NIST CSF 2.0 | ID.IM-02 — “Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties” | The whole method; suppliers in exercises (AU-05) |
NIST CSF 2.0 | ID.IM-04 — “Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved” | EX-12: the plan and playbooks reviewed after each exercise |
NIST CSF 2.0 | GV.SC-08 — “Relevant suppliers and other third parties are included in incident planning, response, and recovery activities” | Audiences: critical suppliers take part (AU-05) |
NIST CSF 2.0 | PR.AT-02 — “Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind” | Audiences and intervals: people in incident roles practise them (EX-02, EX-07) |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | Evaluation scale and comparison across years |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 3.5.5 — “The relevant entities shall test at planned intervals their incident response procedures.” | The programme and the intervals (EX-01, EX-02) |
DORA — Regulation (EU) 2022/2554 | Article 11(6) — test the ICT business continuity plans and the ICT response and recovery plans “in relation to ICT systems supporting all functions at least yearly, as well as in the event of any substantive changes to ICT systems supporting critical or important functions”, and test the crisis communication plans (Article 14); financial entities other than microenterprises include in the testing plans “scenarios of cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups and redundant facilities”; the policy and plans are regularly reviewed taking into account test results and recommendations from audit checks or supervisory reviews | Regulated-entity tailoring |
DORA — Regulation (EU) 2022/2554 | Article 24(1) — “For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures”, financial entities other than microenterprises establish, maintain and review a digital operational resilience testing programme | The programme as part of a testing programme |
DORA — Regulation (EU) 2022/2554 | Article 24(5) — procedures and policies to prioritise, classify and remedy all issues revealed by the tests, and internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed | Finding priority, improvement actions and re-tests |
DORA — Regulation (EU) 2022/2554 | Article 25(1) — the testing programme provides for appropriate tests, among them “scenario-based tests” | The tabletop as a scenario-based test |
Definitions
Term | Meaning in this methodology |
|---|---|
After-action report | The written report of an exercise: what was tested, the result for each objective, what held, what failed and the improvement actions agreed. Approved by the sponsor. |
Audience | A group exercised together because it takes the same kind of decisions, AU-01 to AU-05, each with its own interval (EX-02). |
Drill | A short exercise of one part of the plan, done for real: calling the out-of-hours numbers, isolating a site, or restoring a system from backup. |
Evaluation scale | The four ratings every objective receives: Met, Partly met, Not met, Not tested. |
Exercise | A planned rehearsal of the incident response plan on a made-up incident: a discussion of a scenario, a test of one part (a restore, a call tree), or a full simulation. A live incident is not an exercise. |
Exercise programme | The approved plan of which audiences are exercised, when and on which scenarios, for the coming year (EX-01). |
Finding | An observation, or several, confirmed at the hot debrief or in the after-action report as a gap that needs a change. |
Hot debrief | A short, structured discussion held straight after the exercise, the same day, while memories are fresh. |
Improvement action | The change that closes a finding, with one owner, a due date and the document or control it changes. |
Inject | A new piece of the scenario given to participants at a set time: a fact, a message, a call or a problem. Each inject forces at least one decision. |
Objective | A decision the exercise sets out to test, written before the scenario, with who takes it and the rule it is judged against. |
Objective category | One of eight fixed groups of decisions, OC-01 to OC-08, used to compare results across scenarios and years. |
Observation | Something an observer saw during the exercise, written as fact: what happened, when, and which objective it concerns. It can be a strength or a gap. |
Re-test | Testing the same decision again once its improvement action is done, to show the change works. |
Tabletop | An exercise held as a discussion. Participants sit together, receive the scenario in stages and say what they would decide and do. Nothing is switched off or restored. |
Top risk | A risk in the register reported to the board, from which scenarios are chosen (EX-05). |