Incident Response Exercises

Scheduled and unscheduled drills of security professionals and other stakeholders are an important way to ensure your organization has tested its incident response plans. Examples of such drills include table top exercises, simulated events, etc.

Forum of Incident Response and Security Teams – Common Tabletop Exercise Failures
This PowerPoint from Secureworks’ Security and Risk Consulting Incident Response (SRC-IR) Team discusses common tabletop exercise failures.
IRS – Incident Response Test and Exercise Guidance
This document from the IRS provides guidance for testing and exercising incident response capabilities.
MITRE – Cyber Exercise Playbook
This paper provides an overview of the cyber exercise process from inception to reporting.
National Initiative for Cybersecurity Careers and Studies – Security Incident Response Training
This is a self-paced online training course regarding incident response offered by DHS.
NIST – Tips & Tactics: Control System Cybersecurity
Quick steps you can take now to PROTECT your control system
NIST SP 800-84 Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities
This NIST Special Publication helps organizations in designing, developing, conducting, and evaluating test, training, and exercise events.
nixu – A Cybersecurity Exercise Helps You Prepare for an Incident
Handle cyber incidents like a pro with exercise scenarios

Center for Internet Security – Tabletop Exercises Six Scenarios to Help Prepare Your Cybersecurity Team
This white paper is about tabletop exercises can be used to help cybersecurity teams develop tactical strategies for securing their systems.
CMMC Level 1 Assessment Guide
This document provides assessment guidance for Level 1 of the Cybersecurity Maturity Model Certification (CMMC).
CMMC Level 2 Assessment Guide
This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2.
Invenio IT – Perform a Backup Checkup with Disaster Recovery Testing
This article discusses what disaster recovery testing is and how to conduct tests that yield useful and actionable results.
NIST SP 800-171A Assessing Security Requirements for Controlled Unclassified Information
The purpose of this publication is to provide procedures for assessing the CUI requirements in NIST Special Publication 800-171.
NIST SP 800-53: IR–3 Incident Response Testing
NIST resource that defines Incident Response testing requirements.
SANS – Top 5 ICS Incident Response Tabletops and How to Run Them
How prepared is your organization to respond to an industrial control system (ICS) cyber incident?
SANS Whitepaper – Incident Handling Annual Testing and Training
This SANS whitepaper discusses the need for annual incident handling testing and training.
State of Washington – Tabletop Exercises
This link from the State of Washington discusses examples of tabletop exercises that can be used during monthly meetings to help organizations prepare for cybersecurity events.

Resources

Legal