Cybersecurity incident response plan exercises are conducted periodically and according to defined triggers, such as system changes and external events

Proper advanced planning can help an organization establish, document, and staff an incident management capability. Exercises that challenge the viability, accuracy, and completeness of an incident response plan should be part of the planning process. Exercises should be performed under conditions and at a frequency established by the organization. Scenario-based exercises covering multiple scenario types and including external crises (e.g., flood or pandemic) may be helpful in uncovering unexpected cybersecurity impacts that do not stem from cybersecurity incidents. The results of exercises should be documented, along with any relevant information about the organization’s level of preparedness to address incidents. When planning for exercises, organizations should consider coordination with appropriate stakeholders (including third parties or vendors) for the different kinds of information, IT, and OT assets that may be within the scope for exercises such as virtualized assets, regulated assets, cloud assets, and mobile assets. A significant reliance on vendors during steady state operations may indicate an increased need for vendor support during incident response. Additionally, exercises provide an opportunity to identify and communicate the types of actions that should be avoided during response. Finally, organizations may consider exercising exceptions to normal policies and procedures by including exceptions as part of the exercise scenario script.

Related Practices · Input From: Implementing RESPONSE-4i provides input that may be useful for implementing this practice. · Progression: This practice is part of multiple practice progressions. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in the first progression include: RESPONSE-3a, RESPONSE-3d, RESPONSE-3f, RESPONSE-3g, RESPONSE-3h, RESPONSE-3i. · The practices in the second progression include: RESPONSE-3g, RESPONSE-3k.