What will change after your cyber exercise?

Choose a question your organisation needs to answer

Before inviting colleagues to a cyber exercise, decide which uncertainty you want to explore. Our suggestion is a concrete operational question: who can authorise an interruption to a business service, or how the team would communicate while its usual tools were unavailable. Keep the scope small enough for participants to discuss the decisions properly.

The NCSC describes Exercise in a Box as structured questions for a small group of key staff. Its scenarios are designed to prompt discussion, rather than produce a simple right answer. Use the relevant exercise pack as the basis for the session; this briefing is preparation advice, not a replacement exercise pack.

Give someone responsibility for the session

The NCSC calls for a facilitator to prepare and run the exercise and report its findings. It also says to download the pack and become familiar with the materials beforehand. Make that preparation an assigned task, rather than expecting the person who booked the meeting to improvise.

Our recommendation is to invite the people who actually own the decisions in scope. Tell them the purpose and explain that the discussion is an exercise. Agree how to pause if a real operational problem needs attention. Do not disrupt a live system or send surprise attack messages as part of this discussion-based session.

In a fictional UK wholesaler, the IT manager can explain recovery options but cannot decide which customer commitments take priority. The operations lead therefore joins the discussion. The facilitator records where a decision depends on a person who is absent, instead of allowing the group to invent that person’s approval.

Record uncertainty while it is visible

The NCSC pack includes scribe sheets for notes. Its guidance recommends reviewing discussion outcomes and agreeing follow-up actions. Use the notes to preserve the unanswered question and the consequence for the scenario, not just a list of people who attended.

Our suggested action record includes the observed gap, the person who will address it and the evidence that would demonstrate progress. For example, if nobody can locate the approved out-of-hours escalation route, ask its owner to confirm and circulate the route through the normal internal process. Keep sensitive operational details in an approved location.

Return to the unresolved decision

Book a short follow-up before closing the session. Ask each action owner to bring evidence of the agreed change, and give unresolved items a clear next step. Where the action was to clarify who can make a decision, check that the responsible people now understand the arrangement.

A useful follow-up can revisit the original question with the updated procedure. Our advice is to record what the group can now establish and what still needs work. A discussion exercise does not prove that technical recovery will succeed, and this process is not a certification claim. The outcome is a clearer decision and an accountable improvement to practise again.