text: ISO 22398:2013, Societal security – Guidelines for exercises. 2 ISO 22361:2022, Security and resilience – Crisis management: Guidelines.

text: Directive (EU) 2022/2555

text: . 4

text: Regulation (EU) 2025/37

text: Regulation (EU) 2024/2847

text: Regulation (EU) 2022/2554

text: . 7

text: Regulation (EU) 2016/679

text: . 8 Council Recommendation of 6 June 2025 on an EU blueprint for cyber crisis management (C/2025/3445).

text: Establish the Select Define the Run the exercise, Collect and Disseminate foundation of exercise scenario and including pre- analyse results among the exercise by scope, storyline, plan exercise activities, qualitative and relevant planning identifying the practicalities scenario execution quantitative data, stakeholders, timelines, right players and introduce and real-time document results create an action selecting the to involve in data collection monitoring to to capture plan and appropriate type the exercise, and tools ensure smooth lessons identified monitor its of exercise, linked with management. execution and and frame them progress. involving capabilities to gathering of in a structured stakeholders test. valuable insights. manner. and evaluating requests.

text: Figure 1 – Key phases of the methodology

text: Figure 2 – Evolution of deliverables along the phases

text: European Cybersecurity Skills Framework

text: 1.1 - Why do you want to organise an This chapter provides guidance on exercise? initiating a new cybersecurity exercise project. It determines the project’s 1.2 - Choose the right exercise type viability, sets expectations and outlines 1.3 - Define the required resources requirements for later stages. 1.4 - Assess your cybersecurity posture 1.5 - Assess the feasibility of an exercise

text: Initiate the exercise plan Exercise request template

text: • Risk identification and

text: identification and mitigation of

text: vulnerabilities and gaps in

text: • Incident response preparedness: practice and

text: protocols and decision-making

text: via simulated real-world cyber

text: incidents in a controlled environment.

text: • Stakeholder collaboration:

text: and external stakeholders, strengthening collective

text: response capabilities.

text: continuous evaluation and improvement of cybersecurity

text: strategies, policies and

text: threat. threats.

text: with relevant regulatory

text: frameworks and industry

text: standards.

text: Table 1 - Decision criteria to choose the right exercise type

text: Test actual response capabilities and Exercise Discuss strategic, policy or procedural aspects operational readiness in a simulated ‘whys’/goals without deploying resources. environment.

text: • Response teams • Political decision makers • Communication teams

text: Target audience

text: • Mid to upper-level management • Cybersecurity analysts • More operational stakeholders

text: Suitable when resources are limited; focuses Requires more resources to simulate a real- Resources and on understanding, communication and world environment for testing physical and logistics coordination. Appropriate when the objective is technical responses. Appropriate when a to limit costs. sizeable budget is available.

text: Ideal for early stages of cybersecurity Used to assess effectiveness in a real-time framework development, reviewing response Readiness level scenario, testing systems, communication and plans due to changes and assessing performance under stress. applicability to real-world situations.

text: Raises awareness, educates on new Trains personnel in specific roles, tests

text: Training and

text: threats/policies and improves strategic operational procedures and enhances hands-

text: understanding through discussions. on skills.

text: Provides a comprehensive evaluation of Evaluation and Identifies knowledge and strategic planning operational effectiveness, identifying technical improvement without complex logistics. and procedural improvements.

text: Table 2 - Different categories of exercises, including exercise type, description and level of interaction

text: Exercise Level of Indicative Target Category Description Effort Type interaction Duration Audience

text: Formal educational event,

text: focusing on delivering

text: information or insights on a Low Seminar/ specific topic or research Low 1-4 hours (< 4 weeks workshop area. It is often lecture to plan) based, with the goal of

text: informing or educating the Decision makers Discussion- audience. Mid to upper-

text: based Facilitated interactive level

text: session that focuses on management

text: building specific skills or Medium knowledge through active Tabletop Very High 2-8 hours (4–8 weeks participation. It is usually to plan) more practical and task

text: oriented, designed to solve

text: problems or develop skills.

text: Focused exercise aimed at

text: testing the effectiveness of a High

text: specific part of a (16 –32 Drill Moderate 1-2 hours cybersecurity playbook, such weeks to Response as incident response to a plan) teams phishing attack. Communication

text: Competitive, scenario-based teams

text: activity that simulates Cybersecurity

text: cybersecurity incidents to analysts High encourage learning through More (8 –16 operational Game strategy and problem-solving High 2-8 hours weeks to stakeholders in a controlled, plan) gamified/simulated

text: environment (e.g. a cyber

text: range).

text: Comprehensive exercise that simulates a real-life cybersecurity incident, testing the organisation’s Very high response and coordination Operational Very High 1- 2+ days (32+ weeks across all functions and to plan) teams, internal and external. These exercises can be operational, technical or both.

text: European Cybersecurity Skills Framework. 11 This methodology's terminology aligns with ENISA's usage and may differ from common industry terms. A complete list of definitions is in the glossary.

text: Table 3 – Description of different teams participating in an exercise

text: Type Mandatory

text: • Cybersecurity educator Main ECSF- • Chief information security officer (CISO) linked roles For more information see Annex D ‘Potential exercise roles mapping with the European Cybersecurity Skills Framework’.

text: • Launch the exercise organisation process, including requesting relevant authorisation from key stakeholders/decision-makers. • Lead the scenario definition and development, to ensure the scope aligns with the needs of the organisation(s), and the smooth running of the exercise execution, assuming the facilitator role when needed. Technical expertise may be required, depending on the type of exercises, to make the scenario relevant to the latest threats. • Lead the evaluation tasks, including the definition of objectives, data collection methods and evaluation criteria, the monitoring activities during the exercise execution, and the

text: assessment of the exercise and reporting and dissemination of findings. • Designate, prepare and assist players to ensure the best possible exercise experience. They do not take part in the exercise as players. • Take/ensure ownership and act on exercise findings. Designate, prepare and assist players to ensure the best possible exercise experience. They do not take part in the exercise as players • Take /ensure ownership and act on exercise findings.

text: Type Mandatory

text: Most ECSF roles could be part of the team of players, depending on the scope of the exercise.

text: Main ECSF-

text: For more information see: Section 2.3 ‘Choose the right players’ and Annex D ‘Potential

text: linked roles

text: exercise roles mapping with the European Cybersecurity Skills Framework’.

text: • Implement all preparations required by planners before the execution of the exercise, such as accessing any preparation material or training. • Take an active part in the exercise execution by reacting and responding to the exercise injects as in reality (i.e. through usual communication channels, in accordance with Tasks relevant procedures, collaborating with other exercise players). They follow general exercise guidelines and specific indications from the planners before, during and after the exercise execution. • Provide feedback information requested for the evaluation of the exercise and read/disseminate, as applicable, the exercise after-action report when available.

text: Type Mandatory

text: Most ECSF roles could be part of the team of observers, depending on the scope of the Main ECSF- exercise and the need for expert observations to be included. linked roles For more information see Annex D ‘Potential exercise roles mapping with the European Cybersecurity Skills Framework’.

text: • Contribute to the scenario definition, providing expert insights to ensure realism. • Support the evaluation tasks, mainly contributing to the monitoring activities and providing Tasks their expert observations and insights. • They can also support the definition of objectives, the assessment of the exercise and the dissemination of findings within their expert communities when applicable.

text: Figure 3 – Deliverable status at the end of the Initiation phase

text: This chapter provides guidance on 2.1 Define the objectives structuring and defining the essential 2.2 Define the scope aspects of the exercise once its feasibility 2.3 Choose the right players has been confirmed. It defines the scope, 2.4 Start communicating about the objectives and players. exercise

text: Finalise the exercise plan Templates for exercise plan, evaluation Initiate the evaluation plan and the communications plan plan and communication plan Exercise selection workflow, go/nogo checklist

text: • Demonstrate compliance with NIS2 incident reporting requirements within mandated time frames. • Test the incident response team's ability to detect and contain a phishing campaign within two hours. • Verify cross-team and cross-organisation communication protocols during a supply chain compromise.

text: Map each objective Document system • Resources: budget, Explicitly state what is Review the scope to specific systems, interconnections, personnel, time OUT of scope: against available teams and processes data flows and team • Technical: system • ‘Production customer resources. Can you that must be handoffs. A payment availability, databases will not be realistically simulate involved. If testing system test may maintenance accessed’ the identified scenarios incident response to require including the windows • ‘No actual malware with your budget and ransomware, identify database team, • Business: will be deployed on timeline? which critical network team and acceptable risk live systems’ systems would customer service. levels, regulatory • ‘Physical security realistically be requirements testing is excluded’ affected. • Safety: what MUST remain operational

text: Figure 4 – Process to effectively define scope

text: Table 4 - Common pitfalls when defining the scope

text: Too broad Diluted results, resource exhaustion, Focus on two or three critical “Test everything” unclear objectives processes or systems per exercise

text: Too narrow Missing interdependencies, unrealistic Include connected systems and “Test only email server” isolation dependent processes

text: Undefined boundaries Confusion, missing stakeholders, Create explicit participant matrix with “Vague participant list” incomplete testing roles and responsibilities

text: Unrealistic scenarios

text: Align threats with actual risk profile “Nation state attacking Wasted resources, irrelevant findings and threat intelligence

text: small business”

text: Ignoring dependencies

text: Map all critical dependencies during “Testing without key Incomplete response, false confidence planning

text: Table 5 - Exercise playing teams

text: • Manage the organisation’s response to the simulated cyber incident. Chief information • Assure information exchange with external authorities and security officer professional bodies. • Ensure that business continuity and critical functions are protected during the exercise.

text: • Analyse, evaluate and mitigate the impact of cybersecurity incidents. Identify cyber incidents’ root causes and malicious Cyber incident actors. responder • In accordance with the organisation’s incident response plan,

text: restore functionality of systems and processes to an operational

text: response team state, collecting evidence and documenting actions taken.

text: • Conduct a simulated forensic investigation to uncover the root Digital forensics cause and scope of the breach. investigator • Provide analysis, reconstruction and interpretation of the digital evidence based on a qualitative opinion.

text: • Analyse simulated threat intelligence feeds to identify malicious Cyber threat actors, their motives and their attack methods during the intelligence exercise. specialist • Share relevant information to contribute to situational awareness efforts.

text: Cybersecurity • Act as a ‘red team’ member, conducting a simulated attack engineering Penetration tester against the target systems. team • Act as a ‘blue team’ member, defending against the attack.

text: • Report simulated incidents in line with legal and regulatory Cyber legal, obligations.

text: policy and • Ensure that compliance policies are followed during the

text: Legal team

text: compliance officer response, recommending remediation strategies/solutions to ensure compliance.

text: Table 6 - First activities of the communication plan

text: • Stakeholder identification. Identify • Initial meetings. Conduct initial all relevant internal and external meetings with stakeholders to stakeholders, including employees, Ensure that all discuss the exercise objectives and partners, third-party vendors and stakeholders are scope, and their roles. regulatory bodies.

text: informed about

text: • Preferred channels. Establish • Communication plan. Develop a

text: the exercise

text: preferred communication channels objectives and comprehensive communication plan for each stakeholder, such as email, scope, and their that outlines the objectives, key phone, instant messaging or roles. It helps messages and preferred collaboration platforms. secure buy-in communication channels for each and fosters • Regular updates. Provide regular stakeholder. collaboration. updates to keep stakeholders • Early engagement. Engage informed about the planning stakeholders early in the planning progress and any changes. process to ensure their input and

text: buy-in.

text: Figure 5 - Deliverable status at the end of the Design phase

text: This chapter provides guidance on 3.1 Define the scenario defining the scenario, planning the 3.2 Define the evaluation strategy practicalities and defining the evaluation 3.3 Prepare the stakeholders criteria, choosing the appropriate data collection methods and tools to capture the data required during the exercise.

text: Finalise the evaluation plan and the master scenario Template for master scenario event list. Update the communication plan event list

text: ENISA Threat Landscape.

text: Figure 6 – Hierarchical structure of scenario

text: Figure 7 – Chronological structure of the scenario

text: Figure 8 – Main elements of an inject

text: Table 7 - Defining evaluation criteria

text: • Time to detect (quantitative). The time elapsed between the email being sent and the Enhance the Timely detection and first report from a participant. organisation’s ability to reporting of a simulated • Reporting accuracy (qualitative). The quality detect and respond to phishing email and completeness of the information provided phishing attacks in the report, such as correctly identifying the malicious link and sender.

text: • Direct observation. Assess satisfaction, collaboration, • 1-on-1 interviews. Capture communication and stress qualitative feedback on content, levels. format and facilitation. 1. Reaction Not applicable • 1-on-1 interviews. Gather • Feedback survey. Collect initial experiences. quantitative feedback from a • Debriefing. Discuss strengths, larger audience. weaknesses, lessons identified and areas for improvement. • Direct observation. Focus on • Post-exercise (self)- • Pre-exercise (self)- learning outcomes and assessments. Measure assessments. Tailor the performance. achievement of learning exercise to participants’ • Expert assessments. Evaluate objectives and new skills, needs and skill levels and performance based on identify areas for improvement 2. Learning establish current predefined criteria. and measure progress. knowledge. • Logs and recording analysis. • Peer review mechanisms. • Knowledge checks. Capture system interactions, Learn from each other’s Ensure understanding of communication and responses experiences. fundamental concepts. (e.g. replies to email inject, chat • Knowledge checks. Identify logs). areas needing extra clarification. • Direct observation. Evaluate the transfer of learning to the job. 3. Behaviour Not applicable Not applicable • 1-on-1 interviews. Determine if acquired skills and knowledge are being used and if behaviour has changed. • Analytics. Track participation and performance, providing insights into decision-making. • Feedback platforms. Gather additional input to identify 4. Results Not applicable Not applicable strengths and areas for improvement. • Learning management system platforms. Track progress in a predefined learning curriculum.

text: Kirkpatrick model.

text: Table 8 - Data collection elements

text: • Time to detect (quantitative). The time elapsed between the

text: Logs and recordings.

text: email being sent and the first Enhance the report from a participant. A report by email from a Timely detection organisation’s ability • Reporting accuracy participant: and reporting of a to detect and (qualitative). The quality and simulated phishing • email timestamp respond to phishing completeness of the email (quantitative); attacks information provided in the • content of the email report, such as correctly (qualitative). identifying the malicious link and sender.

text: Figure 9 - Deliverable status at the end of the Preparation phase

text: This chapter describes the final steps to 4.1 Pre-exercise activities execute an exercise, including pre-exercise activities, what to pay special attention to 4.2 Exercise execution during the execution, and important activities 4.3 Post-exercise activities to be performed afterwards to allow for a proper evaluation.

text: Update the Communications Plan Execution guiding checklists

text: • Logistics check • Scenario execution - • Data collection • Scenario readiness facilitation • Logistics check • Debriefing and • Planners' readiness • Real-time monitoring • Scenario readiness feedback and support - • Planners' readiness • Players' readiness observation • Players' readiness

text: Figure 10 – Stages for exercise execution

text: Figure 11 - Deliverable status at the end of the Execution phase

text: This chapter describes the final steps to 5.1 Analysis and assessment evaluate an exercise and ensure data 5.2 Reporting collected from the exercise are transformed into actionable findings. Different techniques to evaluate data collected are proposed and essential aspects to include in the Afteraction report are identified.

text: Finalise the After-action report After-action report template

text: Figure 12: Structure of analysis techniques

text: Table 3: Techniques to analyse quantitative data

text: • Measuring the average time taken by Describes the main response teams to detect and respond to features of a dataset in This is the first incidents quantitative terms, Descriptive step for all • Determining the range of scores achieved in allowing you to analysis quantitative different tasks understand what data • Identifying the standard deviation in the happened during the effectiveness of response strategies across exercise teams

text: • Measuring the impact of prior training on

text: These tests performance by comparing the success rates

text: reveal whether of teams or individuals with different levels of

text: Determines whether observed training

text: there is a significant differences • Examining the relationship between the type

text: association between between of cyber incident and the likelihood of it being

text: two categorical groups are correctly reported to the relevant authorities

text: variables meaningful or or internal management

text: just random • Investigating whether the complexity of the

text: chance cyber incident affects the success rate of

text: incident resolution

text: • Determining how the allocation of resources

text: impacts the efficiency and effectiveness of Examines the This is for incident resolution relationship between a when you • Modelling how various factors like the dependent (target) need to complexity of the attack, the number of variable and one or understand Regression simultaneous incidents and the team’s more independent cause-andanalysis experience level predict the time taken to (predictor) variables, effect detect cybersecurity incidents helping you understand relationships • Analysing how different response strategies what factors predict between (independent variables) affect the success success variables rate (dependent variable) of mitigating

text: cybersecurity threats

text: Figure 13 - Deliverable status at the end of the Evaluation phase

text: This chapter describes the crucial process 6.1 Disseminate the exercise results of acting upon the findings of the exercise, from both an organisational improvement 6.2 Act on the findings perspective and a capacity-building programme angle. The dissemination of the results is also highlighted

text: Template for action plan Finalise the communication plan

text: Table 4: Stakeholders and dissemination tools with their descriptions

text: Documentation capturing exercise events, All Combination Clear AAR lessons identified and improvement recommendations.

text: Exercise players: Structured meetings before and after the Briefings and exercise, in which objectives and outcomes • cross-functional debriefings are discussed, and feedback is given for teams next steps. • technical teams • departmental Interactive sessions with a deep dive into teams Workshops • remote teams exercise findings and recommendations.

text: Documentation capturing exercise events, Amber AAR lessons identified and improvement Participating recommendations only for planners.

text: Platform where posts are regularly put to Exercise planners Intranet ensure engagement with and awareness of the exercise results.

text: Detailed reports tailored to specific Internal reports departments, focusing on relevant findings and actions to take.

text: Webinars and Virtual sessions for sharing the findings Exercise observers online with a broader audience, allowing presentations engagement and questions.

text: Analysis of specific exercise incidents or scenarios, which offers them insights into Rest of the organisation Case studies the decision-making process and lessons identified.

text: Visualisations summarising key exercise Press Infographics data, findings and recommendations.

text: Sharing insights and best practices through audience Social media posts General public social media to promote awareness and and website continuous improvement.

text: High-level overview focusing on key findings, business impact and strategic Management board Executive summary recommendations for the management board.

text: Figure 14 – Steps to create an effective action plan

text: Figure 15 - Deliverable status at the end of the Moving Forward phase

text: Objective Definition Objective themes categories

text: Enhanced cybersecurity posture – organisation’s overall security measures and resilience. High-level objectives that align with the Compliance and regulatory adherence – organisation’s Strategic organisation’s overall compliance with all relevant legal and regulatory requirements. strategy and long-term vision Risk management – management of cybersecurity risks to protect organisational assets.

text: Incident response – organisation’s ability to detect, respond to and recover from cybersecurity incidents.

text: Situational awareness – ability of an organisation to accurately perceive, understand and respond to cyber threats and incidents in real time.

text: Technical support and analysis – Expertise of an organisation to identify, troubleshoot and resolve security issues, and to analyse security data to prevent future incidents. Specific tasks and activities that need to Incident reporting – process of documenting and communicating

text: be performed during details about security breaches or threats to ensure timely response the exercise and mitigation.

text: Cooperation and information sharing – collaborative exchange of information and best practices among organisations and stakeholders.

text: Communication procedures – internal and external communication during a cybersecurity event.

text: Coordination and collaboration – coordination between different teams and departments during an incident.

text: Security awareness – level of cybersecurity awareness among Human elements of employees. Human cybersecurity, factors including awareness, Upskilling and reskilling – opportunities to upskill or reskill training and behaviour resources based on specific skills gaps identified during an exercise.

text: Behavioural analysis – employee behaviour and adherence to security policies and procedures.

text: Policy and procedure evaluation – assessment of cybersecurity policies and procedures. Identifying and Process improving existing Incident management process – assessment of an organisation’s improvement processes and incident management process. procedures Continuous improvement – identification of areas for continuous improvement in cybersecurity practices.

text: Business impact analysis – assessment of the potential impact of cybersecurity incidents on business operations. Ensuring that the organisation can Business Disaster recovery – ability to recover from a cybersecurity incident continue operations continuity following disaster recovery plans and procedures. during and after a cybersecurity incident Resilience building – organisation’s resilience to withstand and recover from cyber incidents.

text: Regulatory compliance – compliance with relevant laws, regulations and standards. Ensuring adherence to Compliance Data protection – effectiveness of data protection measures and legal and regulatory and legal compliance with data privacy regulations. requirements Audit readiness – level of preparation for passing cybersecurity audits and assessments.

text: Existence: This level examines whether a process or behaviour is present and operational. 2. Implementation: This level assesses the efficiency of a process or behaviour, based on criteria like speed, quality, and quantity.

text: Figure 16 – From objectives to capabilities, indicators and metrics

text: Profile responsibilities ECSF Team Mission Profiles Linked to Planner Role Linked to Player Role

text: • Manage the organisation’s response • Define and communicate the to the simulated cyber incident. Chief exercise’s vision, strategy, policies • Assure information exchange with information and procedures. external authorities and professional security • Ensure that the exercise is aligned bodies. officer with the organisation’s overall risk • Ensure that business continuity and management plan. critical functions are protected during the exercise. • Analyse, evaluate and mitigate the impact of cybersecurity incidents. • Contribute to preparing the Identify cyber incidents’ root causes

text: Identify and

text: analyse threats. exercise’s scenario, ensuring and malicious actors.

text: realism with regard to injects and • In accordance with the organisation’s

text: Coordinate timelines. incident response plan, restore

text: containment and • Identify and define the response functionality of systems and processes mitigation procedures to be tested. to an operational state, collecting actions. evidence and documenting actions taken. Conduct • Conduct a simulated forensic • Plan for the provision/collection of forensic investigation to uncover the root cause Digital simulated digital evidence. investigations. and scope of the breach. forensics • Define how artefacts should be • Provide analysis, reconstruction and investigator handled and what information interpretation of the digital evidence should be logged. based on a qualitative opinion. • Analyse simulated threat intelligence feeds to identify malicious actors, their Cyber threat • Analyse current and emerging motives and their attack methods intelligence threats to create a realistic and during the exercise. specialist relevant exercise scenario. • Share relevant information to contribute to situational awareness efforts.

text: Profile responsibilities Team Mission ECSF profiles Linked to planner role Linked to player role

text: • Design a scenario that tests the

text: • Plan and

text: resilience of the organisation’s

text: Cybersecurity existing security architecture. • Apply security controls as

text: architect • Evaluate the effectiveness of part of the response effort. design architectural cybersecurity defences

text: solutions. during the exercise.

text: deploy and • Prepare and deploy the required

text: operate cybersecurity solutions in the

text: cybersecurity exercise environment.

text: solutions. Cybersecurity • Configure the tools needed for the • Apply security controls as

text: implementer exercise scenario. part of the response effort. • Assess the • Operate, monitor and troubleshoot

text: effectiveness cybersecurity solutions during the

text: of security simulated incident.

text: controls, and

text: assess • Act as a ‘red team’ member,

text: conducting a simulated attack

text: criticality of

text: • Design the technical aspects of the against the target systems.

text: cybersecurity Penetration

text: scenario, including potential red team vulnerabilities tester • Act as a ‘blue team’ member, and blue team roles. if exploited by defending against the attack

text: threat actors.

text: • Research the

text: • Conduct fundamental research on • Analyse simulated data and

text: emerging threats, attack vectors and new threat intelligence during

text: domain and

text: technologies to include in the the exercise to adapt incorporate Cybersecurity exercise design. defensive strategies in real

text: results in researcher • Ensure the inclusion of innovative time.

text: cybersecurity attack methods in the scenario to test • Report on novel attack

text: solutions. the organisation’s readiness for techniques discovered during

text: future threats. the response.

text: • Develop and deliver pre-exercise

text: • Improve training sessions to ensure that

text: cybersecurity participants have the necessary skills. knowledge, Cybersecurity • Create educational materials that • Not applicable skills and educator support the exercise’s learning

text: competencies of objectives.

text: humans. • Identify and document learning gaps to

text: inform future training needs.

text: • Advise on data • Report simulated incidents

text: protection laws

text: in line with legal and

text: and regulations.

text: regulatory obligations. • Handle legal Cyber legal, • Identify and incorporate relevant legal • Ensure that compliance documentation policy and and regulatory requirements (e.g. policies are followed during and reporting. compliance GDPR, NIS2) into the exercise scenario the response, • Manage officer and evaluation plan. recommending remediation

text: strategies/solutions to

text: with regulatory

text: ensure compliance.

text: bodies.

text: Team Mission Profile responsibilities ECSF profiles Linked to planner role Linked to player role

text: • Design the evaluation and audit plan for

text: • Identify potential the exercise.

text: risks and • Ensure that the exercise tests the

text: vulnerabilities. organisation’s compliance with internal

text: • Develop risk and external standards. • Not applicable

text: mitigation • Collect evidence of the response

text: strategies. process and identify non-compliance or

text: • Monitor risk procedural weaknesses during the

text: levels simulated incident.

text: throughout the • Make sure that the exercise’s objectives Cybersecurity • Make risk-based decisions exercise. and scope include relevant risks to the risk manager during the response. organisation.

text: Team Team Mission Profiles Profile responsibilities

text: Ensures that cybersecurity risks are Board member – provides adequately managed and mitigated. governance and oversight for Supports the development and the organisation’s implementation of cybersecurity cybersecurity policies and • Approve the exercise strategies. Monitors compliance with initiatives. plan and objectives. cybersecurity regulations and standards.

text: • Ensure alignment with

text: Executive organisational goals.

text: management • Participate in decision- Chief Executive / Defines and implements the making during critical Information / Technology organisation’s IT and cybersecurity points of the exercise. Officer – oversees the strategies. Ensures alignment with overall strategic direction business objectives and regulatory and operational requirements. Promotes a culture of management of the cybersecurity awareness and resilience organisation’s IT and across the organisation. cybersecurity functions.

text: Oversees the implementation of IT manager – manages the cybersecurity measures within the IT IT infrastructure and department. Coordinates with other operations to ensure the departments to ensure that cybersecurity availability, integrity and policies are adhered to. Manages IT staff security of digital systems and resources to support cybersecurity and services. initiatives.

text: • Monitor and maintain

text: system integrity. System administrator – • Detect and respond to Implements and monitors security maintains and supports the IT team technical incidents. controls on IT systems. Performs regular organisation’s IT systems • Implement recovery security assessments and updates. and networks to ensure their processes. Responds to and mitigates security secure and efficient incidents. operation.

text: Network engineer – Ensures the security and resilience of designs, implements and network systems. Monitors network traffic manages secure network for suspicious activities. Implements infrastructure to support the network security protocols and measures. organisation’s operations.

text: • Advise on data Advises on legal implications of

text: protection laws and General counsel – provides cybersecurity policies and incidents.

text: regulations. legal advice and support on Ensures that the organisation’s

text: • Handle legal cybersecurity-related matters cybersecurity practices comply with

text: Legal team documentation and to ensure compliance with relevant laws and regulations. Represents

text: reporting. laws and regulations. the organisation in legal proceedings

text: • Manage communication related to cybersecurity.

text: with regulatory bodies. Data protection officer –

text: ensures the organisation’s

text: compliance with data Monitors and advises on data protection

text: protection laws and practices. Conducts data protection

text: regulations. impact assessments. Coordinates with

text: other departments to ensure personal

text: data are handled securely.

text: Supports the development and Legal advisor – provides implementation of cybersecurity policies. specialised legal advice on Advises on legal risks and compliance cybersecurity and data requirements. Assists in the resolution of protection issues. cybersecurity-related legal issues.

text: Develops and implements communication Communications director – strategies for cybersecurity awareness. manages the organisation’s Coordinates communication during internal and external cybersecurity incidents. Ensures clear communications related to and effective communication of cybersecurity. cybersecurity policies and procedures.

text: • Develop communication Develops and executes public relations strategies. Public relations strategies for cybersecurity incidents. • Handle media inquiries specialist – manages the Communication Communicates with media and and public relations. organisation’s public image team stakeholders during incidents. Promotes • Communicate with and communication during the organisation’s cybersecurity initiatives stakeholders and cybersecurity incidents. and achievements. customers.

text: Internal communications Ensures that employees are informed

text: coordinator – facilitates about cybersecurity policies and

text: internal communication procedures. Coordinates internal

text: about and awareness of communication during cybersecurity

text: cybersecurity policies and incidents. Promotes cybersecurity

text: practices. awareness and training programmes.

text: HR manager – manages the Develops and implements HR policies

text: organisation’s human that support cybersecurity initiatives.

text: resources functions with a Coordinates recruitment and training for

text: focus on cybersecurity- cybersecurity roles. Ensures compliance

text: related roles and with cybersecurity-related human

text: responsibilities. resource regulations. • Organise training

text: sessions for

text: participants. Identifies training needs related to • Ensure employee Training coordinator – cybersecurity. Develops and delivers Human awareness and develops and manages training programmes. Evaluates the resources team readiness. cybersecurity training effectiveness of training programmes and • Manage internal programmes for employees. updates them as needed. communications related

text: to the exercise.

text: Promotes a culture of cybersecurity

text: Employee relations

text: awareness among employees. Addresses specialist – manages employee concerns related to employee relations with a cybersecurity policies. Ensures focus on cybersecurity compliance with cybersecurity-related awareness and compliance. human resource policies.

text: External stakeholders

text: Threat intelligence Collects and analyses threat intelligence • Provide support and analyst – analyses and data. Identifies and assesses potential resources. monitors cybersecurity cybersecurity threats. Provides • Share threat threats to provide actionable recommendations to mitigate identified intelligence and best Partners intelligence. threats. practices.

text: • Participate in joint

text: response actions. Partner liaison – manages Coordinates with external partners on relationships with external cybersecurity matters. Ensures that partners to support the partners comply with the organisation’s

text: organisation’s cybersecurity cybersecurity policies. Facilitates initiatives. information exchange and collaboration with external partners.

text: Develops and implements incident Response coordinator – response plans. Coordinates response coordinates the efforts during cybersecurity incidents. organisation’s response to Ensures effective communication and cybersecurity incidents. collaboration during incidents.

text: Vendor manager – Evaluates and selects vendors based on manages relationships with cybersecurity criteria. Monitors vendor third-party vendors to ensure compliance with cybersecurity policies. their compliance with Coordinates with vendors on cybersecurity policies. cybersecurity matters.

text: • Provide cybersecurity tools and solutions. Advises on the development and • Assist with threat Cybersecurity consultant – Third-party implementation of cybersecurity policies. detection and analysis. provides expert advice and vendors Conducts cybersecurity assessments and • Support recovery and support on cybersecurity audits. Provides recommendations to remediation efforts. matters. improve cybersecurity posture.

text: Recovery specialist – Develops and implements recovery plans. manages the organisation’s Coordinates recovery efforts following recovery efforts following incidents. Ensures the restoration of cybersecurity incidents. affected systems and services.

identifier: The ENISA Cybersecurity Exercise Methodology

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: The ENISA Cybersecurity Exercise Methodology

serie: rapporter

text: TLP-CLEAR

type: rubrik

text: The ENISA Cybersecurity Exercise Methodology

text: End-to-end guide on how to plan, run and evaluate an exercise FEBRUARY 2026

text: The ENISA Cybersecurity Exercise Methodology Version: 1.0

type: stycke

text: About ENISA

text: The European Union Agency for Cybersecurity, ENISA, is dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost the resilience of the Union’s infrastructure and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: AUTHORS

text: Alexandros Zacharis, ENISA Anna Sarri, ENISA Christian Van Heurck, ENISA Fanouris Fanourakis, ENISA Gema Fernández, ENISA Nikolaos Christoforatos, ENISA Radu Arcus, ENISA

text: ACKNOWLEDGEMENTS

text: Deloitte Belgium

text: LEGAL NOTICE

text: This publication represents the views and interpretations of ENISA unless otherwise stated. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to

text: Regulation (EU) 2019/881

text: . ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must mention ENISA as its source. Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. ENISA maintains its intellectual property rights in relation to this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2026 Unless otherwise noted, the reuse of this document is authorised under the Creative Commons. Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided appropriate credit is given and any changes are indicated. For any use or reproduction of photos or other materials that are not the copyright of ENISA, permission must be sought directly from the copyright holders.

text: ISBN 978-92-9204-735-1, DOI 0.2824/4949728

text: Executive Summary

text: In today’s digital landscape, organisations face increasing cyber threats. Cybersecurity exercises are essential for preparing, testing and enhancing team and system capabilities to respond to these threats. A well-structured cybersecurity exercise methodology ensures a comprehensive approach to simulation and training, building resilience and agility in mitigating cyber risks.

text: What is the ENISA Cybersecurity Exercise Methodology?

text: The methodology offers an end-to-end theoretical framework for planning, running and evaluating cybersecurity exercises. It ensures the right profiles and stakeholders are involved at the right time. The methodology provides theoretical material based on lessons identified, industry best practices and cybersecurity expertise, and is designed to be used alongside a support toolkit, including a set of templates and guiding material to empower planners to organise effective exercises.

text: Who is the methodology for?

text: The methodology is designed for any cybersecurity professional, organisation or government who wishes to: • Learn about organising and planning a cybersecurity exercise; • Assess their current cyberattack response capabilities; • Convince management of the importance of organising cybersecurity exercises; • Test skills, response to and resilience against cyber threats, and compliance with legal and regulatory requirements. Developed and used for EU-level crisis management exercises, the methodology’s current focus is ideal for planners organising national or sector-level exercises.

text: What will the methodology do?

text: The methodology provides a structured, straightforward approach to planning, running and evaluating exercises, together with a support toolkit to provide practical guidance.

text: Go/no-go checklists

text: Go/no-go points between each phase of a cybersecurity exercise life cycle are crucial to ensure all necessary preparations and conditions are met before proceeding. These checkpoints reduce the risk of unforeseen issues, enhance overall effectiveness, allow for timely adjustments and ensure resource allocation aligns with objectives.

text: Alignment with standards

text: The methodology is flexible and built to align with established standards like ISO 22398:2013 ( ) and ISO 22361:2022 ( ).

text: Support and community use

text: ENISA offers resources, regular workshops and a community of cybersecurity experts to support planners. Contact ENISA for workshop schedules and community access.

text: Introduction What’s in it for you?

text: Testing your organisation’s capabilities and its response to and resilience against a cyber crisis is crucial to ensure the right skills, processes and policies are in place. ENISA’s documentation makes this process easy and clear with a structured, end-to-end approach:

text: • Just fill it in. The methodology and support toolkit covers all aspects of a cybersecurity exercise. Simply follow the structure and fill in the points relevant to you. This significantly reduces the time you will need for planning compared with starting from scratch, and the comprehensive checklists help eliminate the most common planning oversights. The documentation is designed to be easily understood and communicated across different levels of cybersecurity maturity. • Improve and stay compliant. Identify lessons learned, create an action plan for improvement and ensure your organisation’s processes align with relevant regulations and standards. For ENISA’s stakeholders, this includes key regulations and directives such as the Network and 3 4 Information Security Directive (known as NIS2) ( ), the EU Cybersecurity Act ( ), the Cyber 5 6 Resilience Act ( ), the Digital Operational Resilience Act ( ) and the General Data Protection 7 8 Regulation (GDPR) ( ), and relevant frameworks such as the EU Cyber Blueprint ( ). • Show the value early. From the start, you will be able to identify at an early stage reasons why your organisation would benefit from running an exercise. The documentation helps you efficiently identify lessons learned and create an action plan to address them. • You are not alone. ENISA offers regular workshops and working sessions to assist planners. You can also access a community of cybersecurity experts for advice and shared experiences.

text: How it works: core principles

text: The ENISA Cybersecurity Exercise Methodology guides organisations in developing effective cybersecurity exercises. The principles presented below serve as the foundation for the entire process.

text: • Structured planning. Ensure a systematic, user-friendly, comprehensive approach to designing and implementing exercises. The methodology is designed to make the planning process clear and straightforward, covering all dimensions, including compliance with European regulations and standards. • Capacity building. Systematically assess skills, processes and technologies, identifying gaps and areas for improvement, by setting clear, measurable objectives for effective evaluation and analysis. The methodology is designed to help you efficiently identify lessons learned and create actionable plans, helping your organisation continuously enhance its cybersecurity posture.

text: • Flexibility. The methodology is adaptable to organisations’ specific needs and maturity level, supporting various exercise types, complexities and sizes. It allows you to easily showcase the benefits of cybersecurity exercises to management and justify the investment. • Resources ecosystem. This theoretical guide for planning, running and evaluating exercises is aligned with, and works together with, the European Cybersecurity Skills Framework and a support toolkit, which includes templates for main exercise documentation and practical checklists to guide you through the process and provide inspiration and insights for your exercise. • Community collaboration. You are not alone in the process. The methodology has been designed following feedback from the exercise planner experts’ community and will keep evolving over time to reflect the reality of this community. Regular workshops are organised, where discussion and knowledge exchange are encouraged throughout the exercise expert community.

text: Phases

text: The methodology is divided into six key phases to guide organisations in creating effective cybersecurity exercises, ensuring they are realistic, impactful and aligned with organisational goals.

text: In parallel, the support toolkit provides step-by-step documentation to plan, run and report on a cybersecurity exercise, ensuring organisations can develop, implement and refine effective exercises for improved preparedness for and resilience against cyber threats.

text: Key deliverables

text: This methodology helps prepare key deliverables for a successful cybersecurity exercise throughout the exercise-planning life cycle.

text: A complete set of deliverable templates is available in the support toolkit.

text: The European Cybersecurity Skills Framework

text: ENISA uses the European Cybersecurity Skills Framework (ECSF) ( ) to map stakeholders, defining 12 typical cybersecurity professional role profiles. These profiles outline the main missions, tasks and skills needed in a professional cybersecurity context. Using the ECSF ensures common terminology and shared understanding of cybersecurity roles across the EU, enables the identification of critical skill sets required for the cybersecurity workforce, and promotes harmonisation in cybersecurity education, training and workforce development programmes. This mapping will be used throughout this document to align typical cybersecurity exercise roles with the ECSF.

text: SECTION 1

text: Initiation

text: 1. Initiation 1.1 Why do you want to organise an exercise? PRO-TIP

text: The decision to proceed with a cybersecurity exercise needs to start by understanding the underlying purpose of a cybersecurity exercise for oneself, whether it is at the individual, organisational or Reasons to organise an governmental level. This is fundamental to achieving meaningful exercise outcomes.

text: Typically referred to as the goal, the ‘why’ provides the foundational mitigation: proactive

text: reason for the exercise, ensuring stakeholder buy-in, motivation and

text: alignment with broader strategic goals. It helps to frame the objectives cybersecurity posture. with the right focus. The central question to address is.

text: The ‘why’ is the purpose and mission of the person, organisation or refinement of response public administration organising an exercise. It is not an objective. procedures, communication

text: While the ‘why’ outlines the core mission, the objectives define ‘how’

text: you will fulfil that mission.

text: Concise and understandable messages that resonate with a broad

text: audience will motivate stakeholders to actively engage and enhanced collaboration and collaborate, serving as a call to action for the exercise. coordination among internal

text: Five Whys: supporting technique

text: The five ‘whys’ method involves repeatedly asking ‘why’ to drill down • Continuous improvement: to the core purpose. The following is an example of a sequence. regular exercises allowing for

text: 1. Why will I participate in Cyber Europe? To be a part of a pan-

text: European large-scale exercise. procedures based on lessons 2. Why? To test my country’s response to a potential cybersecurity identified and emerging

text: 3. Why? To make sure the right people have the right skills. • Compliance and regulatory 4. Why? To ensure they we can detect, respond to, operate and requirements: compliance

text: recover from that cybersecurity threat.

text: 5. Why? To make Europe safer from cybersecurity threats.

text: 1.2 Choose the right exercise type

text: Organisations can employ various types of exercise to test their preparedness for and resilience against cybersecurity threats. These exercises evaluate different aspects of cybersecurity readiness and response capabilities. Planners must choose the appropriate exercise type based on the defined objectives and capabilities. Two examples are given below.

text: • Discussion-based exercises: ▪ Focus on collaborative discussions and decision-making; ▪ Enhance awareness, understanding and communication of cybersecurity risks, policies, procedures and roles; ▪ Explore response strategies to simulated scenarios, emphasising communication and planning without physical deployment.

text: Example: Discussion-based exercises facilitate interactive discussions to evaluate preparedness, response strategies and decision-making processes.

text: • Operation-based exercises: ▪ Test and validate operational procedures, technical capabilities and response actions in a simulated environment; ▪ Assess the effectiveness of incident response plans, procedures and technical controls; ▪ Are scenario-driven exercises that allow planners to test actual response processes and operational readiness in a simulated but realistic environment.

text: Example: Operation-based exercises provide an immersive platform to test the practical application of response plans and technical capabilities in simulated scenarios.

text: When selecting the right type of cybersecurity exercise, planners must ensure that the exercise aligns with their objectives, capabilities and risk profile (see table below).

text: Decision Discussion-based Operation-based Criteria

text: Exercise planners can select from various types of exercise within the discussion-based category. The table below helps planners choose the most suitable exercise by describing each type, considering specifics like duration, target audience and planning effort required (a minimum of six months for discussion-based exercises).

text: Organisations can thoroughly assess their readiness by choosing the most appropriate type of exercise based on specific objectives and capabilities. By considering criteria such as objectives, audience and resources, planners can tailor exercises to their needs.

text: 1.3 Define the required resources

text: Organising a cybersecurity exercise requires careful resource allocation in terms of people, technology, budget and time. Effective resource allocation ensures that the exercise is well supported, realistic and impactful, leading to improved cybersecurity preparedness and resilience.

text: 1.3.1 Exercise stakeholders

text: The exercise-planning process should involve a diverse group of stakeholders from various organisational functions and external partners, whose involvement typically varies depending on the type of exercise.

text: Engaging stakeholders can be difficult, especially when it comes to obtaining senior management buy-in and coordinating schedules and priorities. Exercises contribute to overcoming resistance to change, addressing siloed attitudes and fostering a culture of cybersecurity awareness and collaboration; this is why establishing a clear stakeholder mapping early in the initiation phase is crucial to maximise engagement among relevant stakeholders and therefore key to a successful exercise.

text: To streamline the mapping process for a cybersecurity exercise, the ECSF ( ) provides a structured reference for relevant professional profiles and their main responsibilities. ENISA uses these 12 profiles to define the missions, tasks and skills needed in a professional context. Using the ECSF ensures common terminology and a shared understanding across the EU, which in turn helps identify critical skill sets and promotes harmonisation in education, training and workforce development programmes. For the purpose of the exercises discussed here, stakeholders ( ) are divided into participating and non-participating audiences, both of which have vital roles.

text: Participating Audience

text: Participating audience members have an active involvement in the exercise life cycle, with specific tasks across the different phases of organising the cybersecurity exercise. They are divided into teams, with specific skills required within each, as presented below.

text: Team of planners

text: Responsible for the whole organisation of the exercise. They are the main target audience of this methodology.

text: Team of players

text: Actively engaged in reacting and responding to the simulated actions of the exercise scenario execution.

text: Team of expert observers

text: Provide insights and feedback before, during and after the exercise in line with their expertise, which contributes to the realism of the scenario and the identification of improvement opportunities.

text: Non-participating audience

text: Non-participating audience members do not have an active role in the planning, execution and evaluation of the exercise, but provide important inputs and are the key outcomes consumers of the exercise. They can be categorised as follows.

text: ▪ Key decision-makers/stakeholders. Their main role is to provide a clear vision and oversee the exercise activities. They provide strategic direction, ensure resource allocation and make critical decisions to ensure the exercise’s success, such as initiating or approving the exercise activities or ensuring alignment with organisational goals. ▪ External visitors. They are individuals or entities that do not participate directly in the exercise activities, but are key stakeholders for the organisation. Their perspectives, feedback or observations may still be valuable for assessing the exercise’s effectiveness and informing the decision-making processes. They contribute greatly to the dissemination process. Some examples are the press, other teams within the organisation’s constituency and key partners. ▪ General public. They are not directly involved in the planning the exercise but may be impacted by its outcomes and would like to be informed about them.

text: 1.3.2 Technology and tools

text: Effective exercise organisation requires providing the necessary technology and tools to simulate realistic scenarios and support the exercise activities. While deploying these tools, we can encounter potential technical limitations, such as issues with infrastructure, data access and network connectivity, which can impact the whole exercise life cycle.

text: Design and preparation

text: Technology is at this stage crucial for managing the exercise from a logistical standpoint and crafting the scenario. This includes using project management software to track tasks and timelines, and collaboration platforms for a unified workspace to develop objectives, write injects and design the exercise narrative. These tools ensure the entire planning team coordinates with one another.

text: Execution

text: Technology is used in this phase to deliver the simulated scenario to the participants. The tools will depend on the selected exercise type, as follows.

text: • Discussion based. For a seminar-type exercise, basic presentation and collaboration platforms, together with videoconferencing tools, are used to facilitate discussion and present key information. For a tabletop exercise, interactive polling tools or dedicated web applications are deployed to enable real-time collection of participant answers and decisions. • Operation based. Specialised email injection and simulation platforms may be needed to deliver the scenario information to players. Moreover, cyber ranges and virtualised network environments provide a safe, controlled space for participants to engage in hands-on technical challenges. Finally, access to simulated realistic media environments can enhance greatly the realism of the exercise scenario.

text: Analysis and evaluation

text: The final phase relies on technology to gather and process data to measure the exercise’s success. This involves using data collection tools, such as survey software or specialised web portals, to gather participant feedback. During a technical exercise, logging and monitoring tools can capture exercise activity and actions. It is important to note that, although these tools are used for data collection during the execution, their deployment and configuration must be completed earlier, during the preparation phase.

text: The collected data can then be used in conjunction with data visualisation and reporting tools to generate comprehensive after-action reports (AARs) that detail the team’s performance, highlight key takeaways and inform future improvements.

text: 1.3.3 Budget

text: Securing an adequate budget is fundamental to the success of a comprehensive exercise, covering all aspects from planning and execution to evaluation and reporting. Gaining buy-in from senior leadership is essential to enable the allocation of the necessary resources.

text: A strategic approach involves developing a tiered budget proposal that outlines minimum, ideal and optimal scenarios. This allows you to clearly justify costs by delineating between the foundational elements required for a functional exercise, the value-added capabilities that can be introduced with minimal investment, and the strategic enhancements that will deliver a significant difference in impact and fidelity. This proactive financial planning demonstrates foresight and strengthens the case for the requested funding.

text: 1.3.4 Timeline

text: Crafting and executing a successful cybersecurity exercise requires a well-defined time frame. The duration of the planning and execution life cycle depends heavily on factors like the exercise type, complexity, number of stakeholders and their collective experience. Securing an adequate time frame for thorough preparation, coordination and resource allocation is key to a successful

text: PRO-TIP

text: exercise. Planning well in advance allows for the following. For any cybersecurity exercise planned, start preparing a minimum of six ▪ Strategic alignment. Ensures that the months in advance of the intended exercise is strategically integrated into key execution date.

text: broader exercise calendars, from your own organisation’s capacity-building programme to those of peer organisations, national/sectoral authorities and European initiatives. ▪ Thorough design. Allows ample time for detailed risk assessments, scenario development and overall exercise design. ▪ Resource allocation. Facilitates the proper allocation of personnel, budget and technology. ▪ Adaptability. Provides flexibility to adjust the plan based on evolving threats or unforeseen organisational changes.

text: Estimate your planning time frame

text: We include this formula as a high-level reference to calculate the ideal preparation time (TP), measured in months:

text: TP (months) = Tmin + (TE × C × S) / E

text: • Tmin is a constant minimum preparation time, which we consider to be six months; • TE is the duration of the exercise in days (of eight working hours), with a minimum value of 0.5 (half day or less); • C is the complexity of the exercise (e.g. a scale from 1 to 5, where 1 is a simple seminar and 5 is an operational exercise); • S is the number of primary stakeholder groups involved (e.g. 1 to 5, where 1 is internal stakeholders only, and 5 includes multiple external partners); • E is the planning team’s collective experience (a value from 1 to 5, where 1 is novice and 5 is expert).

text: EXAMPLES

text: 1. Two-day national operational exercise (TE=2) with high complexity (C=5) and multiple external stakeholder groups (S=5) planned by an intermediate team (E=3) would require:

text: TP = Tmin + ( TE × C × S ) / E = TP = 6 + ( 2 × 5 × 5 ) / 3 ⋍ 23 months

text: 2. A single-day national exercise that is estimated to take six hours (TE = six hours / eight working hours) or 0.75 days with medium to high complexity (C = 4, operational with technical components) and three main stakeholder groups (Security Operations Centre (SOC) team, IT infrastructure, management) (S = 3) planned by a team that has limited experience (E = 2) would require::

text: TP = Tmin + ( TE × C × S ) / E = 6 + ( 0.75 × 4 × 3 ) / 2 ⋍ 10.5 months 1.4 Assess your cybersecurity posture

text: Before planning your cybersecurity exercise, you need to understand your organisation’s current security capabilities and weaknesses – what we call your ‘cybersecurity posture’. This assessment helps ensure that your exercise targets real needs rather than assumed ones. For first-time planners this may seem daunting, but we’ll break it down into manageable steps.

text: Starting with a cybersecurity posture assessment is crucial as it provides a baseline understanding, identifies risks and vulnerabilities, aligns stakeholders and quickly identifies areas for improvement. This ensures targeted, relevant and impactful efforts, enhancing cybersecurity resilience and preparedness. Planners can use their existing frameworks or adapt the approach below to their organisation’s needs.

text: A three-step approach to assessing cybersecurity posture

text: 1. General Assessment

text: ▪ Purpose. Provides a high-level overview of the organisation’s ability to identify, respond to and recover from cybersecurity incidents. ▪ Methodology. Use surveys, interviews and documentation reviews. ▪ Outcome. Determine overall cybersecurity posture, strengths and weaknesses.

text: 2. Vulnerability Assessment

text: PRO-TIP

text: ▪ Purpose. Identifies specific vulnerabilities within systems, applications and • Allow 2-4 weeks for this assessment processes. • You will need access to cybersecurity- ▪ Methodology. Perform manual reviews related documentation and key staff and prioritise findings according to for interviews criticality. ▪ Outcome. Compile a report detailing • Results will directly inform your exercise objectives (Important to vulnerabilities and their severity, and connect it to the exercise planning) prioritise them based on risk level. 3. Gap Analysis and improvement areas

text: ▪ Purpose. Identifies gaps between current cybersecurity posture and desired standards, recommending areas for improvement. ▪ Methodology. Conduct compliance reviews, benchmarking, gap identification and root cause analysis, and develop improvement recommendations. ▪ Outcome. Compile a gap analysis report and identify actions for exercise objectives.

text: 1.5 Assess the feasibility of an exercise PRO-TIP

text: Having understood the cybersecurity posture, the next logical step is to evaluate whether it is feasible to • Build flexibility into your timeline to conduct the exercise. This feasibility check acts a accommodate adjustments and reality filter, helping to avoid committing to an exercise ensure sufficient time for planning and execution. that cannot be successfully delivered. • Foster engagement through regular First, you must ensure that your exercise objectives updates and active involvement in align with your strategic goals, risk management the planning process. priorities and legal/compliance requirements. It is • Conduct assessments and testing of essential to confirm the relevance of these objectives systems and infrastructure well in in addressing current cyber threats and operational advance to ensure that they are needs identified in prior risk assessments, all while ready for the exercise. ensuring alignment with applicable laws and industry standards.

text: Following this, you need to assess the level of stakeholder engagement and commitment. This includes executive leadership, technical teams and external partners. It is important to identify any potential barriers to their participation and secure their buy-in.

text: The majority of these barriers are normally linked to the availability of resources; this is why a thorough resource assessment is necessary to evaluate the availability of personnel, budget and external support. This step also covers technical feasibility, ensuring that all required technology, systems and infrastructure are available and compatible for the exercise. You must also consider the proposed timeline and scheduling to confirm that there is enough time for planning, coordination and execution without negatively impacting other operational priorities.

text: Finally, you should review lessons identified from previous exercises. This helps you to incorporate best practices and identify opportunities for continuous improvement.

text: By systematically evaluating each of these areas, you can develop a solid plan that is both realistic and effective.

text: 1.6 Deliverables check: initiation phase

text: Once you have a clear focus and approach to conducting an exercise, collect all relevant information in a single document, the exercise plan, which will serve as the focal point for all decisions moving forward. The exercise plan is critical and must be frequently revised as planning progresses (more information is included in Annex B ‘Key deliverables’).

text: SECTION 2

text: Design

text: 2. Design 2.1 Define the objectives PRO-TIP

text: After establishing your exercise purpose (the ‘why’ from the initiation phase), you must define clear, measurable

text: Smart Objectives

text: objectives that specify what the exercise will achieve. • Specific. Target a precise capability Setting clear and measurable objectives is crucial for the or process. success of any cybersecurity exercise. Objectives should • Measurable. Include clear success align with the organisation’s strategic goals and reflect its criteria. key performance indicators, ensuring that the exercise is • Achievable. Realistic within your relevant and capable of driving meaningful improvements. resources and time frame. Well-defined objectives ensure focus and clarity, whereas poorly defined ones can lead to inefficiency and missed • Relevant. Directly linked to learning opportunities. identified risks or requirements. • Time bound. Accomplished within Objectives are often defined using the SMART framework, the exercise duration. meaning they are specific, measurable, achievable, relevant and time bound. These objectives may include enhancing incident response capabilities, testing resilience against specific threats or improving coordination among stakeholders.

text: For the scope of this methodology, ENISA has derived a set of objective themes to serve as inspiration and guidance. These themes are derived from applicable EU policies such as the NIS2 Directive, the Cybersecurity Act and the EU Cyber Blueprint. They are as follows.

text: • Strategic. High-level objectives that align with the organisation’s overall strategy and long-term vision. • Operational. Specific tasks and activities that need to be performed during the exercise. • Human factors. Human elements of cybersecurity, including awareness, training and behaviour. • Process improvement. Identify and improve existing processes and procedures. • Business continuity. Ensure the organisation can continue operations during and after a cybersecurity incident. • Compliance and legal. Ensure adherence to legal and regulatory requirements.

text: A table with more detail on objective themes is included in Annex C ‘From objectives to capabilities’. Finally, add detail to your chosen themes by addressing the following three important questions.

text: • What do you want to achieve? Define the desired outcome as precisely as possible, including the systems, tools and methodologies involved. • Who is targeted? Identify the specific individuals, roles or teams responsible for achieving the objective. • What is the measure of success? Define the expected outcomes and how you will measure whether the objective was met.

text: SAMPLE OBJECTIVES

text: 2.2 Define the scope PRO-TIP

text: Establishing a clear scope is the critical first step in defining an exercise. The scope sets When to revisit the scope specific boundaries, ensuring that the exercise • New critical vulnerabilities emerge. remains focused and preventing mission drift. • Organisational structure changes. This approach guarantees resource efficiency and helps achieve the predetermined • Resources significantly increase or objectives. decrease. • Initial planning reveals unforeseen Building on the analysis from the initiation dependencies. phase, you can define the scope across key • Stakeholder feedback indicates critical dimensions: the systems and infrastructure to gaps. be tested (e.g. production environments, cloud services and third-party systems); the organisational boundaries to be included (e.g. specific departments, geographical locations and external partners); the threat scenarios to be simulated (e.g. types of attacks, threat actor profiles and attack vectors); and the time and operational constraints (e.g. exercise duration and any blackout periods).

text: To effectively define the scope, it is recommended to follow a structured approach, as follows.

text: Even with a structured approach, exercises can fail due to common pitfalls in scope definition. To ensure your exercise’s success, it is important to be aware of and proactively avoid these common challenges. The table below outlines common scope pitfalls, their potential impact and practical solutions for mitigation.

text: Pitfall Impact Solution

text: Remember: a focused, well-defined scope that thoroughly tests a few critical areas provides more value than an overly ambitious scope that superficially touches many areas.

text: 2.3 Choose the right players

text: Selecting the right participants is crucial for exercise success. Players must represent the actual people who would respond to a real incident, possess the necessary authority to make decisions and have the availability to fully participate. The table below presents potential exercise players associated with the main tasks of the relevant ECSF roles.

text: Team ECSF Profile Tasks linked with Player role

text: Other teams relevant to the broader context of a cybersecurity exercise are the IT team, the communications team, the human resources team and the executive management. A complete mapping of the ECSF roles and other potential exercise players outside the ECSF profiles that are relevant to the broader context of a cybersecurity exercise are included in Annex D.

text: 2.4 Start communicating about the exercise

text: Effective communication is the backbone of successful exercise planning. Starting your communication plan early in the design phase ensures that all stakeholders remain informed, engaged and prepared throughout the exercise life cycle.

text: PRO-TIP

text: The communication plan must:

text: • Build awareness and buy-in before the exercise; Communicate early, • Maintain engagement during preparation; communicate often, • Ensure coordination during execution; communicate clearly • Capture feedback after completion.

text: A template for the communication plan is included in the support toolkit. In order to start the communication plan, you need to identify the required activities for the design phase, as shown in the table below.

text: Purpose Key components Practical steps

text: 2.5 Deliverables check: design phase

text: Once you have clearly defined the scope of the exercise, the teams and player profiles you need to involve and the capabilities that you plan to evaluate, the exercise plan should be completed and the evaluation plan foundations should be defined (more information is included in Annex B ‘Key deliverables’).

text: SECTION 3

text: Preparation

text: 3. Preparation 3.1 Define the scenario

text: Cybersecurity exercises must be built on realistic and compelling scenarios. The scenario acts as the narrative backbone of the exercise, setting the stage for all activities and decision-making. Developing a successful scenario requires a systematic approach that aligns with the exercise’s objectives and reflects the organisation’s unique threat landscape.

text: 3.1.1 Main scenario elements

text: The main elements to define within a scenario are the threat actor(s), the state of the world and the storyline.

text: Select threats and threat actors

text: When defining your exercise scenario, it is critical to choose threats and threat actors that are realistic and relevant to your organisation. To do this, you should start by assessing your organisation’s specific threat landscape. Some recommendations are as follows.

text: • Look at sector-specific threats. It is good practice to examine the most prevalent threats targeting your sector. This ensures that your exercise is based on realistic and common attack patterns that you are most likely to face. • Choose a relevant threat actor. Based on the type of threat you have selected, you can then choose a plausible threat actor. For example, a ransomware attack may link to a cybercriminal group, while a denial-of-service attack could be associated with a hacktivist, and a more sophisticated, highly targeted attack may correspond to a state nexus group. This helps to make the scenario more realistic and aids in the development of a compelling narrative for the exercise.

text: The annual ENISA Threat Landscape report ( ) is a valuable resource. It provides a comprehensive, high-level overview of the most significant cyber threats and trends affecting the EU, offering a solid foundation for your scenario development.

text: State of the world: what happened before

text: The state of the world element sets the context and provides a narrative for the exercise by detailing what has happened in the days or weeks leading up to the scenario’s start. This background information is crucial for enhancing realism and helping participants understand the situation.

text: This section should outline any significant events that are relevant to the exercise, such as:

text: • previous attacks that may demonstrate the threat actor’s capabilities or intent; • pre-existing conditions, such as a system that has been exhibiting erratic behaviour, which may materialise as a full-blown incident during the exercise (e.g. data exfiltration); • the broader geopolitical or organisational context that could influence the scenario.

text: Providing this information in advance helps participants make more informed decisions and ensures that they have a common understanding of the environment and the potential threats they are facing.

text: Storyline: what will happen during the exercise

text: The storyline is the narrative that outlines what will happen during the exercise. It serves as the script, guiding the events that unfold in real time and providing context for the participants’ actions.

text: To ensure that the exercise is effective, you must craft a realistic storyline. Your

text: PRO-TIP

text: narrative should mimic real-world conditions with a clear timeline of events.

text: Aim for a balanced scenario

text: The events can be delivered to participants • While it should be compelling, the through various injects, such as emails, storyline should not be overly instant messages or simulated news predictable or excessively dramatic. reports. • Avoid information overload, as this While it should be compelling, the storyline can confuse participants and detract from the exercise's primary should not be overly predictable or objectives. excessively dramatic. Avoid information overload, as this can confuse participants • Instead, focus on a narrative that is and detract from the exercise’s primary plausible and directly linked to the threats and vulnerabilities identified objectives. Instead, focus on a narrative during the scoping phase. that is plausible and directly linked to the threats and vulnerabilities identified during the scoping phase.

text: 3.1.2 From storyline to injects

text: Once the main scenario elements have been clearly defined, planners must translate the overarching storyline into a structured sequence of executable elements. This translation follows a hierarchical framework that ensures logical progression and maintains control throughout execution of the exercise.

text: Understanding the scenario hierarchy

text: A cybersecurity exercise scenario operates on three distinct but interconnected levels, each serving a specific purpose in the exercise architecture, as follows:

text: • Events form the highest level, representing major campaign themes or attack patterns that span significant portions of the exercise; • Incidents are specific security breaches or attacks that occur within events, each with defined start and end times; • Injects are the individual pieces of information, prompts or simulated actions, within incidents, delivered to players at precise moments to drive the scenario forwards.

text: This hierarchical structure enables planners to maintain both strategic oversight and tactical control. Events provide the overarching narrative context, incidents create realistic operational challenges with appropriate duration and complexity, and injects serve as the actual mechanism for scenario delivery and player engagement.

text: Timing and coordination

text: The temporal relationship between these elements is critical. Events typically run for hours or even the duration of the exercise, providing continuity and context. Within each event, multiple incidents may run sequentially or concurrently, simulating the realistic complexity of cyberattacks. Injects are precisely timed triggers within incidents, delivered through appropriate channels (email, phone call, system alert) to elicit specific responses from players.

text: The diagram below illustrates how these elements interact within a typical exercise timeline.

text: 3.1.3 Master scenario event list

text: The elements described in the previous subsection are documented in the master scenario event list (MSEL), which serves as the exercise conductor’s score. The MSEL is the timeline that guides the exercise control team and the exercise execution automation tools during the execution phase, ensuring that the scenario elements are delivered at the right time to the right people, through the right channels. The MSEL can vary significantly depending on the exercise type, with tailored injects to suit discussion-based or operation-based exercises.

text: A MSEL template is available in the support toolkit. The table below presents the detail of each technical dimension to define for each exercise scenario.

text: PRO-TIP

text: Build a balanced MSEL

text: • Do not overload participants with too many injects or inject events too rapidly, as this can paralyse response efforts. • Build critical decision points into the scenario to test risk assessment and decision-making under pressure. Do not make decisions obvious or binary, without real consequences or complexity.

text: 3.2 Define the evaluation strategy

text: Without proper evaluation, even the best-designed exercise becomes just a training event with no lasting impact. Evaluation transforms your exercise from a one-time activity into a catalyst for real improvement by systematically capturing what worked, what did not and, most importantly, why.

text: In the context of cybersecurity exercises, evaluation means measuring whether the objectives set were achieved, identifying gaps in capabilities or processes and gathering evidence to justify future investments in security improvements.

text: This section provides a structured approach to designing your evaluation strategy before the PRO-TIP exercise begins. By planning your evaluation strategy now (during the preparation phase), you For large exercises, establish a dedicated ensure that meaningful data are captured during evaluation team with a lead and evaluators assigned distinct responsibilities. Position execution and can be analysed effectively evaluators strategically to gather pertinent afterwards. This section guides you through data, adjusting staffing levels based on site defining evaluation criteria (3.2.1), selecting needs. Exercise planners can also assist in appropriate data collection methods and tools data collection and provide information to the (3.2.2) and preparing stakeholders for their evaluation team. evaluation roles (3.3).

text: 3.2.1 Define evaluation criteria

text: Evaluation criteria are essential for assessing the effectiveness of cybersecurity exercises. They provide a structured standard for measuring performance, identifying strengths and weaknesses, and guiding improvements. These criteria serve as benchmarks to ensure that the exercise achieves its objectives and offers valuable insights into the organisation’s cybersecurity posture.

text: The evaluation criteria can be structured as follows:

text: • Indicators (what you measure). These are aspects to capture during the exercise, PRO-TIP which link back to the defined objectives. • Metrics (how you measure). These are qualitative or quantitative measures of the A good practice is to specify the indicators used to evaluate performance. For each indicators as part of the expected actions of an inject indicator, you should define one or more metrics that from the player. It is a great provide a clear way to measure its success. way to keep the MSEL • Data collection (where the data come from). connected with the evaluation The different methods and tools for collecting data strategy. are further described in Section 3.2.2.

text: The table below shows how the two first elements work together in the evaluation of a phishing-related objective.

text: Objective Indicator Metrics

text: Some examples of indicators to keep an eye on during cybersecurity exercises are:

text: • Performance – response time, detection accuracy and recovery effectiveness, • Compliance – adherence to regulations and standards (e.g. GDPR, NIS2 Directive), • Communication and coordination – effectiveness of internal and external communication, • Participant engagement – level of stakeholder engagement and participation, • Incident handling – ability to identify, respond to and recover from simulated incidents.

text: 3.2.2 Select data collection methods and tools

text: Exercise planners must select the right evaluation methods and tools depending on the exercise type and objectives, and the specific indicators being measured. This selection and overall evaluation assessment should be reflected in the evaluation plan.

text: The Kirkpatrick model ( ) helps you evaluate at different depths, from immediate reactions to long-term organisational impact. The model consists of the following four levels.

text: • Reaction. This evaluates participants’ engagement with and the perceived value of the exercise. • Learning. This assesses the increase in knowledge and skills acquired by participants. • Behaviour. This examines whether participants apply what they learned to their daily operations. • Results. This level evaluates the overall impact on organisational goals, such as improved performance and enhanced security posture.

text: To implement the Kirkpatrick model effectively, exercise planners should use appropriate data collection tools tailored to each level. The table below provides an overview of these methods and tools for evaluating a cybersecurity exercise.

text: Level Before During After

text: Before collecting data using various methods and tools, it is essential to define the types of

text: PRO-TIP

text: data to be collected and how each type will be processed. The data typically fall into two

text: Guidelines for data collection tools

text: categories, depending on the type of tool that is • 1-on-1 interviews. Balance open-ended and used and the type of metrics being measured. closed questions.

text: • Qualitative data. Rich, descriptive • Knowledge checks. Ensure that each question has a clear, single correct answer. information that can include text, images and videos. These data capture the depth of • Survey questions. Design surveys with specific, measurable questions for quantifiable human experiences, opinions and emotions. results. • Quantitative data. Numerical data that can be measured and quantified. These data • Direct observations. Use a standardised checklist to assess participants' application of provide the ability to test hypotheses, learned skills. measure variables and establish statistical • Analytics and reporting. Implement relationships. automated data collection methods to gather objective performance metrics (e.g. response Certain tools are better suited to collecting either time, accuracy rates) and provide information qualitative or quantitative data, while some can to the evaluation team. collect both. In order to complete the evaluation strategy, we need to specify how each indicator will be captured.

text: Following on from our previous example, the table below includes the data collection elements required to capture the defined metrics.

text: Objective Indicator Metrics Data collection tool

text: 3.3 Prepare the stakeholders

text: Effective exercise execution depends on participants understanding their roles, the scenario context and logistical requirements before they arrive. This information should be compiled by the exercise planners in a practical guide targeting the exercise players. It will ensure that all participants start with consistent baseline information.

text: Preparation during this phase focuses on two critical activities: developing complete and accurate briefing materials, and establishing effective delivery methods that guarantee that participants receive and understand essential information.

text: 3.3.1 Develop the players’ guide

text: The players’ guide serves as a reference for all exercise players. It must be completed during the preparation phase to allow adequate review time before the execution of the exercise. The following important information should be included in the players’ guide:

text: • Exercise overview – the purpose, objectives and scope of the exercise, including background information players will need in order to understand the specific exercise context (e.g. the state of the world), • Roles and responsibilities – a clear description of what each participant/team is expected to do, • Rules of engagement – boundaries and guidelines (e.g. ‘use normal communication channels’, ‘do not contact real external entities’), • Technical requirements – systems access, credentials and connectivity information, • Schedule and logistics – exercise timeline, location details, breaks and key contacts.

text: 3.3.2 Deliver the information to the players

text: Selecting appropriate communication methods that ensure that the players have received and understood the information is crucial. These activities should be incorporated into the communication plan developed during the design phase (see Section 2.4), specifying timelines, responsible parties and communication channels for each method. Depending on the complexity, size and nature of the exercise, planners can choose from several delivery approaches, as follows.

text: • Written documentation. Distribute the players’ guide and request that players acknowledge they have received and understood the materials. Consider using a simple form or email confirmation to track responses. This creates a record of distribution and helps identify who may need follow-up support. Planners may want to set a deadline for acknowledgement (e.g. one week before the exercise) to allow time for clarification. • Briefing and question-and-answer sessions. These sessions allow planners to provide more detailed explanations about the exercise, and players to ask questions and clarify uncertainties in real time. Briefings can be conducted in person or virtually, and may be particularly valuable for complex exercises or when players are unfamiliar with the exercise format. Consider recording sessions for players who cannot attend or for later reference. • Dedicated training sessions. For exercises requiring specific technical skills or involving complex scenarios, planners may organise hands-on training sessions. These sessions can help players familiarise themselves with tools, platforms or procedures they will use during the exercise. Training sessions are especially valuable for operation-based exercises in which players need to practise technical responses.

text: Planners may consider combining multiple methods to accommodate different learning styles and schedules. For example, distributing written materials first, followed by a briefing session, allows players to prepare questions in advance. An important aspect to consider is the timely distribution of the required information to the players in order to allow for proper preparation and address any questions raised or clarifications requested by the players after they have reviewed the material.

text: 3.4 Deliverables check: Preparation phase

text: Before moving to the execution phase, planners should stop to reflect on all the final checks to be done. A full checklist has been added to the support toolkit to facilitate this phase. This list can and should be tailored to your own needs and reality. Once you have finalised all necessary preparations for the exercise, the exercise plan, the evaluation plan and the MSEL should be ready

text: SECTION 4

text: Execution

text: 4. Execution

text: The execution phase transforms months of planning into action. This is where your scenario comes to life, PRO-TIP participants test their capabilities under pressure and evaluators gather critical data for improvement. Success Note: the depth of execution during execution depends on three distinct stages: pre- activities varies by exercise type. Discussion-based exercises may exercise activities that ensure readiness, the exercise require simplified briefings and execution itself, when the scenario unfolds, and postlimited data collection, while exercise activities that capture immediate feedback while operational exercises demand full memories are fresh. implementation of all components described below This chapter guides you through each stage, highlighting critical checkpoints and common pitfalls. While the support toolkit provides detailed checklists for each activity, this chapter focuses on the strategic decisions and coordination required for smooth execution.

text: 4.1 Pre-exercise activities

text: Pre-exercise activities represent the critical transition from preparation to action. These final checks, conducted in the hours or days before execution, prevent common failures that can derail even wellplanned exercises. Think of this phase as your final systems check before launch – every element must be verified; every participant must be ready and every technical component must be operational.

text: 4.1.1 Logistics check

text: The primary purpose of this activity is to ensure that the physical environment, equipment and basic infrastructure are operational and ready for immediate use.

text: Key actions include the following.

text: PRO-TIP

text: • Venue verification. Confirm that the venue set-up (e.g. seating, power, internet) is fully Dry run versus communication check in complete. operational-based exercises • Equipment readiness. Verify that all • A communication-check is a test done necessary exercise equipment (e.g. to ensure that the players can received computers, monitors, specialised tools) is injects with the method that will be used in place and functional. during the exercise. only one inject is delivered to all players prior to the • Communication channel verification. exercise. Send pre-exercise messages to all registered players before the event begins • A dry-run is a test the planners through the relevant injection channels. organise to refine and validate the MSEL content, simulating the players This is to verify that players can be reached experience: all injects are delivered to a and identify any issues ahead of time. single location visible only to the planners.

text: 4.1.2 Scenario readiness

text: Scenario readiness focuses on confirming the robustness of the simulation’s content and ensuring that the exercise control team can manage its flow effectively.

text: Key actions include the following.

text: • MSEL dry runs. Conduct dry runs of the MSEL to detect any gaps, errors or issues in the injects and timings. • Injection material check. Verify that all scenario-related materials and the required ‘state of the world’ initial conditions are correctly set up.

text: 4.1.3 Planners' and observers’ readiness

text: During execution, planners can adopt different roles depending on the nature of the exercise, and are considered part of the exercise control team. It is important to ensure that the team is fully organised, briefed and ready to manage the simulation without confusion.

text: Key actions include the following.

text: Clear roles and responsibilities

text: Reconfirm the roles for all exercise control PRO-TIP staff (e.g. monitoring, facilitators, expert observers). Each person must understand The following checks are important to ensure not just their own role, but how it interfaces smooth exercise control coordination during the execution: with others. • Can the lead facilitator quickly reach all • Facilitator roles. Facilitators serve as observers? the primary interface between the • Can technical staff alert facilitators to scenario and the players. They must system issues? be prepared to guide participant • Can the team collectively decide to adjust actions without leading them to the scenario pace without disrupting the predetermined outcomes, inject exercise flow? scenario elements at precisely the right moments and manage the exercise flow while maintaining scenario authenticity. Conduct a final walk-through of their specific responsibilities: when to intervene, when to let players struggle and how to handle requests that fall outside the exercise scope. • Observer roles. Observers must understand their dual mandate: capture everything while influencing nothing. Brief them on their specific observation points, what behaviours and decisions to document and, critically, when not to intervene – even if players are making mistakes. Their neutrality ensures that the data collected for the AAR remain unbiased and reflect true performance rather than coached responses.

text: Exercise control coordination

text: Establish and test the exercise control internal communication and coordination channels and dynamics for real-time management. The final hours before execution should include a complete team briefing in which everyone confirms their understanding of the exercise flow, their individual responsibilities and the communication protocols. This is also the moment to address any lingering uncertainties – better to clarify now than improvise during execution.

text: 4.1.4 Players' readiness

text: This pre-exercise check ensures that the participation of all players is fully confirmed, and that they understand the rules and possess the necessary information to perform their roles. Key actions include the following.

text: • Confirm participation. Ensure that all exercise players are confirmed and accounted for. • Players’ briefing. Ensure that the players have received and are familiar with key exercise information.

text: 4.2 Exercise execution

text: 4.2.1 Scenario execution

text: The scenario execution phase focuses on delivering scenario elements (injects) from the MSEL to the players. The method of delivery and the expected player response differ significantly depending on the type of exercise being conducted, but the following are some common activities to be performed to ensure proper scenario execution.

text: • Guidance and support. Provide necessary support and guidance to participants to ensure that they stay within the rules of engagement and work towards the exercise objectives.

text: • MSEL delivery. Systematically deliver scenario injects according to the predetermined timeline of the MSEL. • Dynamic adjustment. Be prepared to adjust the scenario in real time based on unexpected participant actions or responses to maintain a realistic and challenging environment. This includes slowing down or accelerating the pace of injects.

text: Discussion-based exercises

text: In discussion-based exercises, facilitators drive the scenario through direct interaction. For this type of exercise, the core activities are analysis, collaboration and decision-making, rather than performing live technical steps. Note the following points.

text: • The facilitator guides players through the scenario narrative, provides necessary context details and manages the flow of the MSEL. • Injects are typically formulated as questions (e.g. multiple choice, open ended, structured discussion points), and are designed to trigger analytical debate, strategic decision-making or a coordinated response among playing teams. The responses (discussions, answers or proposed actions) are captured for future analysis.

text: Operation-based exercises

text: In operation-based exercises, the focus is on practical, hands-on application of procedures, technical skills and coordination within a simulated environment. They require more complex delivery mechanisms and technical coordination. Note the following points.

text: • The facilitators ensure that the injects are delivered accurately to the correct audience (e.g. incident responders, system administrators) and through the appropriate means (e.g. simulated email, ticketing system, live network event). • Injects trigger concrete, measurable actions from the players, such as performing a forensic analysis, communicating with relevant stakeholders or executing a specific technical procedure. Participants are encouraged to follow necessary organisational procedures and protocols. The resulting actions, communications and decisions are captured and logged during the exercise to reflect the result in the AAR.

text: Technical environment management

text: During operation-based exercises, maintaining the technical infrastructure is critical for exercise success. This involves the following two parallel responsibilities.

text: • Inject delivery systems. Deploy injects through realistic technical THE BLUE-ROOM channels appropriate to each player’s role, for example: ENISA’s exercise solution ▪ simulated emails based on the • The Blue-Room supports cyber exercise scenario; projects through all phases, including execution. ▪ news items, articles and social media posts on simulated news • Its implementation is based on modular and social media sites; components adapted to the specific needs ▪ network anomalies and other of each exercise phase. technical logs available for • A key feature is the use of a standardised analysis; YAML file containing the exercise content ▪ phone calls or video conferences for crisis management.

text: • Environment integrity. Continuously monitor and maintain the exercise platform through the following means. ▪ System monitoring. Track the health of all simulation components (network connectivity, application availability, data flows) to detect and resolve issues before they impact players (e.g. late or missing inject delivery). ▪ Realism preservation. Verify that all technical elements remain consistent with the scenario – ensuring fake events look authentic, simulated malware behaves as expected and system responses match real-world behaviour. ▪ Rapid intervention. Maintain a technical support team ready to address any platform issues without disrupting the exercise flow or breaking scenario immersion.

text: The key is balancing technical complexity with exercise objectives – the environment should challenge players realistically without introducing artificial obstacles stemming from technical failures.

text: 4.2.2 Real-time monitoring and support

text: During exercise execution, the exercise control team and observers continuously monitor and document participant activities. This real-time data collection is essential for meaningful evaluation and improvement.

text: Key monitoring activities are as follows.

text: • Performance observation. Document participant actions, decisions and communications against established procedures and expected responses. • Event logging. Record all critical events, player responses and both planned scenario injects and ad hoc exercise control injections with precise timestamps. This comprehensive logging allows accurate reconstruction of the exercise timeline, including any spontaneous adjustments made by the exercise control team. • Live feedback capture. Gather immediate participant insights during scheduled breaks or designated feedback points while experiences remain fresh.

text: 4.3 Post-exercise activities

text: The post-exercise phase is crucial for ensuring that the investment in the simulation translates into tangible organisational improvements. This phase involves systematic data gathering, participant reflection and structured analysis.

text: Data collection

text: Make sure that all the information collected using the methods defined in Section 3.2.2 ‘Select data collection methods and tools’ is properly stored and available for analysis.

text: Key data to collect and store include the following.

text: • Technical records. Collect all technical logs, network traffic data, communications records (emails, chat transcripts, voice logs) and detailed notes taken by the players and the planners’ team during the simulation. • Participant feedback. Distribute structured surveys and feedback forms to participants, observers and facilitators to gather quantifiable input on the exercise’s effectiveness, scenario realism and potential areas for improvement.

text: Structured debriefing

text: Structured debriefing serves several key purposes in the evaluation of cybersecurity exercises, as follows.

text: • Reflection. Allow participants to reflect on their actions, decisions and outcomes PRO-TIP during the exercise. • Insight. Provide valuable insights into the Traditional ways to organise feedback effectiveness of the exercise, including collection strengths and weaknesses. • Hotwash. Conduct a feedback session • Improvement. Identify areas for immediately after the exercise where improvement and guide future participants can discuss their experiences, enhancements. challenges and initial thoughts on the exercise while they are fresh in their • Engagement. Foster engagement and minds. collaboration among participants, encouraging open communication and • Coldwash. Conduct a feedback session shared learning. some days/weeks after the exercise when participants will have had the time to reflect and process with some distance Schedule a debriefing session with all their experience during the exercise. participants to discuss the exercise and provide a complete overview of what happened. Collect The combination of the sessions will give you feedback from participants, focusing on their a complete feedback picture that will allow you to improve future iterations. experiences, observations and suggestions for improvement.

text: 4.4 Deliverables check: execution phase

text: Before finalising the execution phase, planners should ensure that all data have been collected as planned to produce the AAR. A full checklist has been added to the support toolkit to facilitate this phase. This list can and should be tailored to your own needs and reality.

text: SECTION 5

text: Evaluation

text: 5. Evaluation 5.1 Analysis and assessment

text: The analysis and assessment phase transforms raw exercise data into actionable findings. This phase answers three critical questions: Did we meet our objectives? Where did we fall short? What caused these gaps? Without rigorous analysis, even the best-executed exercise becomes just another training event with no lasting impact.

text: As noted in Section 3.2.2 ‘Select data collection methods and tools’, these data typically fall into two categories: qualitative and quantitative. Since using a variety of evaluation tools can generate a large amount of raw data, evaluators must apply different techniques based on the data type. The following sections detail these techniques for extracting valuable insights from the collected data.

text: 5.1.1 Techniques to analyse qualitative data

text: Qualitative data from exercises – interviews, observations and debriefs – contain rich insights that require systematic analysis. The following three techniques work together to extract meaningful findings.

text: Step 1 - Thematic analysis (pattern discovery)

text: What it does Identifies recurring patterns across all qualitative data

text: • Read through all observation notes, transcripts and feedback; • Tag recurring topics (e.g. ‘communication delays’, ‘unclear How to apply it procedures’); • Group similar tags into themes; • Count frequency to prioritise issues.

text: Example output ‘Communication breakdown’ appeared in 73 % of observer notes

text: Step 2 - Content analysis (quantifying themes)

text: What it does Converts qualitative observations into measurable data

text: • Count specific mentions of each theme; How to apply it • Track context (when, where, who mentioned it); • Create frequency tables.

text: ‘Escalation procedures’ mentioned 47 times, primarily during incident

text: Example output response phase.

text: Step 3 - Narrative analysis (understanding experience)

text: What it does Captures the human story behind the data

text: • Examine how participants describe their experience; How to apply it • Look for emotional indicators and decision-making patterns; • Identify turning points in the exercise flow.

text: Players consistently described feeling ‘overwhelmed’ at the two-hour

text: Example output

text: mark when multiple incidents converged.

text: These three techniques build on each other: thematic analysis reveals what happened, content analysis shows how often it happened and narrative analysis explains why it happened. Together, they transform qualitative observations (see figure above).

text: 5.1.2 Techniques to analyse quantitative data

text: PRO-TIP

text: Quantitative data from your exercise – response times, success rates and compliance scores – tell a

text: Selecting the right analysis

text: numerical story about performance. However, raw

text: technique

text: numbers alone do not provide insights. You need Before diving into statistics, ask appropriate analytical techniques to transform data yourself these questions into actionable findings. • What questions am I trying to The table below presents three statistical answer? approaches, progressing from basic to advanced. • What type of data do I have Choose techniques based on your evaluation (counts, times, percentages)? questions and available data. The table includes • How much data have I collected? descriptions of these methods and provides • What level of statistical expertise example insights. is available?

text: Technique Purpose When to use Example application

text: Using these techniques to process the quantitative datasets PRO-TIP stemming from the evaluation tools ensures a comprehensive Common pitfalls to avoid understanding of performance, • Overanalysing small datasets (fewer than 30 data points) identifies areas for improvement • Confusing correlation with causation and informs strategic decisions to enhance cybersecurity resilience. • Ignoring practical significance for statistical significance • Using complex analyses when simple ones would suffice • Remember: the goal is not to use the most sophisticated technique, but to extract meaningful insights that improve future exercises and cybersecurity readiness.

text: 5.2 Reporting

text: The AAR helps move from evaluation findings to actionable improvements. This involves meticulously documenting outcomes, insights and recommendations to ensure clarity, accuracy and relevance for all stakeholders.

text: The AAR uses the traffic light protocol (TLP) to control information distribution, ensuring sensitive findings reach only appropriate audiences.

text: • Red: the AAR is not for disclosure and is restricted to participants only. • Amber: the AAR is for limited disclosure, restricted to participants’ organisations. • Green: the AAR is for limited disclosure, restricted to the community and not to be shared through public channels. • Clear: the AAR’s disclosure is not limited and it may be distributed with no restrictions, subject to standard copyright rules.

text: An AAR is a structured document outlining the critical aspects of a cybersecurity exercise. It identifies strengths and weaknesses and informs the audience about required improvements to be implemented. The structure varies based on the TLP type and organisational goals. Typically, an AAR includes the following parts:

text: • Executive summary. This section provides a brief overview of the organisation, as well as a summary for senior management, highlighting key findings and strategic recommendations. • Exercise overview. This part documents essential information, including the exercise’s name and date, its scope, core capabilities, objectives, the scenario employed, participating organisations and points of contact. • Methodology. Here, the format of the exercise (i.e. the type of exercise, the evaluation criteria, the data analysis methodology) is described, along with a list of tools, software and technologies utilised during the exercise. • Findings and lessons identified. This part documents the most critical lessons identified from the cybersecurity exercise, including key findings and takeaways. • Moving forward. Recommendations for future iterations are provided here to address the gaps identified during the exercise. This includes specific, actionable suggestions to rectify the weaknesses uncovered.

text: Internal AARs (TLP red and amber) should include detailed evaluation sections with performance metrics and achievement ratings, while external versions (TLP green and clear) should provide summarised findings to protect sensitive information. Regardless of TLP classification, the AAR’s length and detail level will reflect the exercise’s complexity and scope. A sample AAR template is included in the support toolkit.

text: 5.3 Deliverables check: evaluation phase

text: At this stage of the process, the evaluation phase is finalised, resulting in a complete and actionoriented AAR.

text: SECTION 6

text: Moving Forward

text: 6. Moving Forward 6.1 Disseminate the exercise results

text: Effective dissemination of exercise results transforms a one-time event into lasting organisational improvement. Without proper dissemination, valuable insights remain confined to a small group, limiting the exercise’s impact and return on investment.

text: Findings and insights from the AAR should inform future actions and strategies; organisations should use these findings to develop action plans to mitigate vulnerabilities, refine policies, enhance training and allocate resources efficiently. Therefore, dissemination serves three critical purposes:

text: • Accountability demonstrates to stakeholders that resources were well spent and objectives were met; • Learning shares lessons across the organisation to prevent future incidents; • Action creates momentum for implementing recommended improvements.

text: Successful dissemination requires tailoring your approach to each audience’s needs, interests and preferred communication channels. Some key audience to reach and the specific objectives for disseminating results with them are as follows.

text: • Exercise players. Understand their performance and areas for improvement. • Exercise planners. Learn from results to enhance their planning skills. • Exercise observers. Identify gaps and provide constructive feedback. • Rest of the organisation. Increase awareness of cybersecurity risks and mitigation strategies. • Press. Report outcomes and educate the public on cybersecurity awareness. • General public. Stay informed about cybersecurity threats. • Management board. Convince investors of the exercise’s value and the importance of investing in cybersecurity.

text: The following table presents appropriate dissemination tools for each stakeholder group, helping planners select the most effective communication methods. These tools should be incorporated into the communication plan started during the design phase.

text: Dissemination Audience Audience type Description tool

text: 6.2 Act on the findings

text: The final step in the exercise life cycle is transforming the raw data from the AAR into concrete, measurable improvements. This process requires action on the following two types of primary, interconnected post-exercise findings that are critical for enhancing both organisational resilience and the quality of future exercises.

text: • Findings linked to the exercise objectives. These findings identify weaknesses, gaps and failures in the organisation’s capabilities, processes or technologies tested during the scenario. Corrective actions here aim to fix the root cause of the security problem. • Findings linked to the exercise execution experience. These findings relate to the quality and efficiency of the exercise itself, such as clarity of roles, timeliness of injects or communication issues between players and the exercise control team. Actions here aim to improve future iterations of the exercise.

text: Both types of findings directly influence the organisation’s capacity-building programme. Action may involve introducing new training activities to address skill gaps or modifying existing activities to enhance participant effectiveness and learning outcomes.

text: THE IMPACT ON THE CAPACITY BUILDING PROGRAM

text: A common and critical action point resulting from both streams of findings is the dynamic update of the organisation's capacity-building programme. • Objective-linked findings: If the findings reveal a skills or capability gap, new training events or capacity-building activities must be immediately included in the programme. • Experience-linked findings: These lessons should lead to changing the approach to how exercises are planned, conducted and evaluated across the entire portfolio of capacity-building activities. Additionally, once corrective actions (including new training) have been implemented, a replay of the exercise is a best practice for testing the effectiveness of these fixes. This replay should also be included in the capacity-building programme planning.

text: To systematically address both types of findings, organisations should follow a structured approach.

text: Steps to create an effective action plan

text: Following the identification of findings across the two streams (exercise objectives and exercise experience), the next crucial stage is to develop and execute an action plan. This plan incorporates all necessary corrective actions and improvements, ensuring that they are efficiently managed and ultimately successful in enhancing organisational resilience and the quality of the capacity-building programme.

text: Step 1: Identify and prioritise improvements

text: This initial stage involves systematically reviewing all findings from the AAR and feedback sessions, and then prioritising them based on impact and urgency. ▪ Review findings. Consolidate all identified weaknesses, gaps and areas for improvement from the AAR and feedback sessions. ▪ Prioritise actions. Evaluate each finding based on its impact, severity and ease of implementation. Prioritise actions considering factors such as criticality, quick wins and strategic alignment. This will result in an ordered list of improvements to address.

text: Step 2: Determine scope and ownership

text: Once prioritised, each improvement needs a clear scope and a responsible party to drive its resolution. ▪ Define scope of action. Classify each improvement according to its primary purpose. ◦ Organisational changes. Actions focused on fixing root causes, such as updating procedures, implementing new technologies or adjusting capacity. ◦ Capacity-building programme adaptations. Actions focused on improving skills and readiness, such as planning new training events or improving the quality and efficiency of future exercises. ▪ Assign ownership. For every action item, clearly designate an owner who will be responsible and accountable for its progress and successful completion (for complex initiatives, consider using a ‘RACI’ (responsible, accountable, consulted and informed) matrix to define roles).

text: Step 3: Develop the action plan

text: This step converts prioritised improvements into a concrete implementation plan with clear timelines and responsibilities. ▪ Outline specific tasks. Break down each improvement into manageable, specific tasks required for implementation. ▪ Agree on deadlines. Set clear and realistic deadlines for the completion of each task. ▪ Create the plan. Document all tasks, owners and deadlines to form a verifiable roadmap for implementation.

text: Step 4: Follow-up and verification

text: This is the ongoing step to ensure that planned actions are actually implemented and that their effectiveness is verified, preventing actions from being forgotten. ▪ Regular follow-ups. Conduct periodic reviews to monitor the progress of all action items against their established deadlines and ensure that owners are consistently driving implementation. ▪ Measure effectiveness. Evaluate whether the implemented actions have achieved their intended improvements (e.g. through a subsequent exercise replay). ▪ Adapt and evolve. Adjust the approach based on observed results and evolving circumstances, ensuring that the organisation’s security posture and exercise programme are continuously improved.

text: This step-by-step process systematically evaluates feedback, analyses the scope for improvements and determines the appropriate level of escalation. By following this approach, organisations ensure that their cybersecurity exercises and portfolios remain effective and aligned with strategic objectives, and are continuously improved.

text: 6.3 Deliverables check: moving forward phase

text: At this stage of the process, all main deliverables should be finalised and we are ready to start taking action in line with the findings and recommendations included in the AAR.

text: Conclusions

text: The ENISA Cybersecurity Exercise Methodology represents a significant step forward in empowering organisations across Europe to build up and strengthen their cybersecurity resilience through systematic, well-structured exercises. By providing a comprehensive framework that guides planners from initial concept through to actionable improvements, this methodology transforms the complex task of exercise organisation into a manageable, repeatable process.

text: Throughout this document, we have outlined a clear pathway: from understanding why an exercise matters, through careful design and preparation, to effective execution and meaningful evaluation. Each phase builds upon the previous one, creating a cohesive approach that ensures that exercises deliver tangible value; that is, they are not just one-time events, but catalysts for lasting organisational improvement.

text: The journey continues

text: This publication marks a beginning, not an end point. The cybersecurity landscape evolves continuously, and so must our approaches to preparedness. We recognise that the true strength of this methodology lies not just in the framework presented here, but in the collective wisdom and practical experience of the cybersecurity exercise community across Europe and beyond.

text: We invite you – whether you are an experienced exercise planner or organising your first event – to contribute to the evolution of this methodology. Share your lessons learnt, your innovative approaches, your challenges overcome. Help us populate the support toolkit with real-world examples, practical tools and proven materials that will benefit the entire community.

text: Embracing innovation while preserving excellence

text: As we look to the future, we acknowledge that emerging technologies, particularly AI, will play an increasingly important role in exercise planning and execution. AI-powered tools promise to automate routine tasks, accelerate scenario development, enhance data analysis and streamline administrative processes. These innovations will undoubtedly make exercise planning more efficient and accessible to organisations of all sizes.

text: However, we remain firmly convinced that the human element – the expertise, judgement, creativity and experience of skilled planners – will always be central to delivering truly effective cybersecurity exercises. Technology can enhance our capabilities, but it cannot replace the nuanced understanding of organisational culture, the ability to adapt to unexpected developments or the wisdom to interpret results within their proper context. The most valuable exercises will always be those that combine technological efficiency with human insight, ensuring that every activity meets the highest standards of quality and relevance.

text: ‘In cybersecurity, preparedness is not achieved through perfection, but through the continuous commitment to learn, adapt and improve.’

text: ANNEX A: Glossary

text: After-Action Report (AAR): A comprehensive document that captures exercise outcomes, findings, lessons identified, and recommendations for improvement. Artifact: digital or physical evidence collected during an exercise for analysis and evaluation purposes. Blue team: defensive security team responsible for protecting systems and responding to simulated attacks during an exercise. Briefing: a structured session in which participants receive essential information about the exercise before its execution. Capability: a measurable skill, process or resource that enables an organisation to achieve specific cybersecurity objectives. Capability target: the desired level of performance or maturity for a specific capability being tested during an exercise. Cold Wash: A feedback session some days / weeks after the exercise, by when participants had the time to reflect and process with some distance the experience during the exercise. Communication plan: a structured document outlining how information will be shared with stakeholders throughout the exercise life cycle. Compliance: adherence to relevant laws, regulations, standards and internal policies related to cybersecurity. Core capability: a fundamental skill or process directly addressing the playing teams’ actions and responses during an exercise. Cyber range: a controlled virtual environment that simulates IT infrastructure for conducting technical cybersecurity exercises. Debriefing: a structured discussion held after exercise execution to gather immediate feedback and observations from participants. Discussion-based exercise: an exercise type focused on strategic discussions, decision-making and policy evaluation without operational deployment. Drill: a focused exercise designed to test specific procedures or skills in response to particular scenarios. Enabling capability: supporting processes, policies or tools that underpin core team operations during an exercise. European Cybersecurity Skills Framework: a standardised framework defining 12 professional role profiles in cybersecurity across the EU.

text: Evaluation criteria: standards and benchmarks used to measure exercise performance and achievement of objectives. Evaluation plan: a comprehensive document detailing how the exercise will be assessed, including methods, tools and success criteria. Event: the highest level of scenario structure, representing major campaign themes or attack patterns spanning significant portions of an exercise. Exercise control team: the group responsible for managing exercise execution, delivering injects and maintaining scenario integrity. Exercise plan: a comprehensive blueprint outlining all aspects of the exercise, including objectives, scope, logistics and timeline. Facilitator: an individual who guides exercise flow, delivers scenario elements and manages participant engagement without leading outcomes. Finding: an identified gap, weakness, strength or observation discovered during exercise evaluation. Hotwash: an immediate, informal debriefing session conducted directly after exercise execution to capture initial reactions. Incident: a specific security breach or attack occurring within an event, with defined start and end times. Indicator: an observable metric or measure used to evaluate performance against specific capability targets. Inject: an individual piece of information, prompt or simulated action delivered to players at a specific moment to advance the scenario. Kirkpatrick model: a four-level evaluation framework measuring reaction, learning, behaviour and results. Lessons identified: key insights, strengths, weaknesses and improvement opportunities discovered through exercise evaluation. Lessons learned: a change in personal or organisational behaviour that results from implementing an identified lesson to improve future performance by integrating new knowledge into practice. Master scenario event list: a detailed timeline documenting all events, incidents and injects that drive exercise execution. Metric: a quantitative or qualitative measure used to evaluate performance indicators. Objective: a specific, measurable goal that defines what the exercise aims to achieve. Observer: an individual who monitors and documents participant activities during an exercise without intervening. Operation-based exercise: an exercise type that tests operational procedures and technical capabilities through hands-on simulation.

text: Planner: an individual responsible for designing, organising and managing the exercise throughout its life cycle. Playbook: a detailed framework that outlines organisation-specific procedures for handling computer security events and incidents. It includes predefined courses of action that provide guidance on detecting, analysing and responding to potential cybersecurity threats. Player: an individual actively participating in the exercise by responding to scenario elements as they would in reality. Players’ guide: a reference document providing participants with essential exercise information including roles, rules and logistics. Red team: security team that simulates adversary actions by conducting controlled attacks during an exercise. Scenario: the narrative framework that defines the simulated situation, including threat actors, timeline and sequence of events. Scope: the defined boundaries of an exercise, including systems, participants, threat scenarios and time frames to be tested. SMART objectives: objectives that are specific, measurable, achievable, relevant and time bound. Stakeholder: any individual, team or organisation with interest in or influence over the exercise. State of the world: background context describing relevant events and conditions leading up to the exercise scenario. Storyline: the narrative sequence detailing what will happen during the exercise execution. Tabletop exercise: a discussion-based exercise in which participants analyse and respond to simulated scenarios through collaborative dialogue. Threat actor: the simulated adversary or attacker represented in the exercise scenario. Threat intelligence: information about potential or current cyber threats used to inform scenario development and organisational defence. Timeline: the schedule of activities and milestones throughout the exercise planning and execution life cycle. Traffic light protocol: a standardised system for classifying information sensitivity (clear, green, amber, red) to control distribution.

text: ANNEX B: Key deliverables

text: Exercise Plan

text: The exercise plan outlines the details of the cybersecurity exercise, serving as a blueprint for its execution. The exercise plan ensures that all participants understand the exercise’s purpose, expected outcomes and operational procedures, creating a cohesive strategy for success. It includes:

text: • Practical details – the execution date and related timelines, and the difficulty level; • Logistics and resources – details on locations, required equipment and budget allocation; • Purpose and objectives – clearly defined and measurable purpose and objectives; • Project plan – a description of phases and milestones; • Roles and responsibilities – identification of participants, facilitators and evaluators, along with their specific roles; • Scope and scenario – the extent of the exercise, including systems, processes and personnel involved.

text: Evaluation Plan

text: The exercise evaluation plan includes all the necessary information and practical insights for planners to proceed with the evaluation of an exercise. It includes:

text: • Participant roles and responsibilities – including those of the evaluators, the people evaluated, recipients of the reports and the evaluation team; • Capability targets – for a large or operation-based exercise, the capability targets to be tested during the exercise; • Exercise evaluation tools and methodology – including for data collection, analysis and assessment, and reporting; • Evaluation timeline – including a visual timeline covering before, during and after the exercise, and a dissemination plan.

text: Communications Plan

text: Effective communication with internal and external stakeholders is crucial for the success of cybersecurity exercises. It ensures that all parties are informed, engaged and aligned with the exercise objectives. The communication plan includes practical chronological steps for maintaining robust communication throughout planning, preparation, execution and post-exercise activities. It emphasises reaching the right stakeholders using their preferred channels and securing buy-in for continuous improvement. The table below presents the details of the communication plan.

text: Master Scenario Event List

text: The MSEL outlines the sequence of events and injects that drive the exercise, ensuring a structured and realistic simulation of cyber incidents. The MSEL can vary significantly depending on the exercise type, with tailored events and injects to suit discussion-based or operation-based exercises. It includes:

text: • Events – a list of the events planned during the exercise; • Incidents – a list and practical details of all incidents related to the events planned during the exercise; • Injects – individual pieces of information, prompts or simulated actions delivered to players at a specific moment to advance the scenario.

text: After-Action Report

text: The AAR documents the outcomes of the exercise. The AAR ensures that the exercise’s insights are captured, leading to continuous improvement and refinement of the organisation’s cybersecurity preparedness. It includes:

text: • Findings and observations – analysis of participant performance; • Lessons identified – key takeaways to enhance future exercises; • Recommendations – actionable suggestions for improvement; • Performance metrics – evaluation of objectives met, supported by data.

text: ANNEX C: From objectives to capabilities

text: C.1 Objective themes

text: Further to the information included in the document on defining objectives, here is a table of objective themes to serve as inspiration for defining specific objectives.

text: C.2 Capabilities

text: For more complex exercises, objectives are not enough to capture and evaluate the specific activities expected from the different teams participating in the exercise.

text: Capabilities serve as the critical bridge between high-level organisational objectives and the concrete actions of teams and individuals. While an objective defines what the entire organisation aims to achieve (e.g. enhance incident response time), a capability breaks this down into measurable actions for specific teams or individuals. One single objective can be tested through multiple capabilities, each assigned to different teams that must carry out their specific responsibilities during the exercise.

text: There are two types of capabilities, as follows.

text: • Core capabilities. These directly address the participants and focus on evaluating their actions, reactions and knowledge during the exercise. They assess how effectively participants respond to a scenario. • Enabling capabilities. These focus on testing the underlying processes, policies and tools that support the core teams. They ensure that the foundational elements of the response are robust.

text: To facilitate precise evaluation, each capability can be linked to maturity targets that can be assessed through the exercise.

text: SAMPLE MATURITY TARGETS

text: Finally, to measure these targets, indicators are used. These are specific, observable metrics that guide the evaluation team on what to capture during the exercise to verify the achievement of a capability. Indicators provide the necessary link between a capability and the evaluation tools used to measure its success.

text: The figure below presents a summary of the journey from objectives to capabilities, indicators and metrics.

text: ANNEX D: ECSF roles in the scope of exercises

text: The table below presents ECSF roles mapping with various exercise activities carried out by different participants of an exercise. For each exercise team, the mission is presented, the different ECSF roles that could fit on the team are mapped, and responsibilities are specified depending on a planner or player role.

text: Cybersecurity incident response team

text: Cybersecurity engineering team Cybersecurity capacity building team Legal team

text: Risk management team

text: Other relevant profiles to include in cybersecurity exercises are presented in the table below.

text: -N -EN -028 -25 -01 TP ABOUT ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its Member States, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: ENISA

text: European Union Agency for Cybersecurity

text: Athens Office

text: Agamemnonos 14 Chalandri 15231, Attiki, Greece

text: Brussels Office

text: Rue de la Loi 107 1049 Brussels, Belgium

text: enisa.europa.eu