Cyber Exercises Should Test Decisions, Not Just the Incident Script

A response plan can look complete and still fail when a real incident forces people to make decisions under pressure.

The NCSC Cyber Security Toolkit for Boards prompts directors to consider whether incident response and recovery plans exist and are exercised, and whether the organisation can resume normal operations after an incident. It is board guidance, not a universal legal requirement. Use it to test whether the organisation’s plans work in practice. NCSC Cyber Security Toolkit for Boards | NCSC board-level cyber discussions

Exercise the choices that matter

Build a scenario around a service the organisation depends on. Test more than the technical response. Ask who can declare an incident, isolate systems, invoke continuity arrangements, notify customers or regulators where applicable, and approve recovery priorities. The exact roles and external obligations depend on the organisation and incident; confirm them with appropriate specialists.

Introduce realistic uncertainty. Information may be incomplete. A key supplier may be unavailable. A recovery option may restore one service while delaying another. The exercise should reveal where authority, evidence or communication breaks down, not reward participants for reciting a script.

Turn observations into controls

For each gap, record the decision or capability that failed, the risk it creates, the action owner, due date and evidence needed to close it. Prioritise fixes by service impact and dependency, not by how easy they are to complete. Re-test material actions in a later exercise.

Keep a concise record of scenario, participants, decisions, assumptions, escalation points and lessons. Distinguish an action completed from a capability demonstrated. A revised plan is not proof that staff can use it.

Give the board a usable view

Report the important decisions tested, material weaknesses, unresolved actions and any change in residual exposure. State clearly where confidence comes from: a successful exercise, a document review, an external assessment or an untested assumption. These are not interchangeable.

The return is practical. A well-run exercise exposes confusion before an incident does, helps leaders prioritise resilience work and makes recovery responsibilities clearer. Do not stage a polished rehearsal. Find the weak point, fix it and test again.

Sources: NCSC Cyber Security Toolkit for Boards; NCSC guidance: Board-level cyber discussions.