Discussing plans is not the same as exercising the team

Once a year, "emergency exercise" appears in the calendar. Two hours in the meeting room: management, IT, data protection. The ransomware plan is gone through page by page, and a phone number is corrected in two places. Afterwards there are minutes, and the exercise is done.

That is not a bad exercise. It is just not the one people think it is.

Five types of exercise, five goals

BSI Standard 200-4 distinguishes five types of exercise in chapter 13: plan review, staff exercise, extended staff exercise, alerting exercise and function test. The difference is not effort but goal.

The plan review, also called a "desk test", is a moderated discussion of an emergency plan without actually carrying out any steps. According to table 34, its goal is to check plan contents for realistic applicability, i.e. whether the plans are plausible, complete, correct and up to date. That is exactly what happened in the meeting room.

The staff exercise, by contrast, is the practical exercise of staff work on a given emergency scenario. Its goal is different: to practise cooperation among the members of the team and the basic elements of staff work, such as the command cycle, situation briefings, logging and visualisation. In German:

„Die Zusammenarbeit der Mitglieder des Stabs und die Grundelemente der Stabsarbeit üben, z. B. Führungszyklus, Lagebesprechungen, Protokollierung, Visualisierung etc.“

And the standard is clear about which of them are mandatory. Chapter 13.1 states that for the reactive BCMS, the staff exercise and the alerting exercise must be carried out regularly. The plan review is recommended there, not required. Anyone who only discusses plans has skipped precisely the mandatory exercise.

The names are not sacred. According to 200-4, the designations of the exercise types may be adapted to the organisation, as long as the respective content is covered. A "tabletop exercise" or an "IR simulation game" can therefore be a staff exercise if it has its content.

What a discussion does not test

• Decisions under time pressure. In the meeting room, any question can be postponed. In a real incident, someone has to decide whether systems go offline before all the information is in.
• A changing situation. A plan reads linearly. An incident does not: after an hour the ransom note arrives, after two hours the press calls.
• Reporting deadlines. Whether anyone remembers the deadlines under GDPR and NIS2 while the technology is on fire only shows when the clock is running.
• The follow-up. Minutes are not an action plan. Whatever is not assigned to someone with a date after the exercise will be open again at the next one.

How isidaten handles this

The IR simulation game takes a team through a scenario from the library, such as ransomware, CEO fraud or a data breach with a press enquiry. Injects confront the team with decisions with scored alternatives, and the clock is running. The scorecard rates five dimensions: detection, containment, communication, reporting duties and recovery. Every session is linked to an exercise in the BCM module and counts as one there. The result produces a 30/60/90-day plan whose items are handed over to BCM corrective actions and to tasks.

The test question

When did your team last make a decision under time pressure and then see its consequence, instead of reading out a plan?

If the last exercise was a walk-through, that is a good start. The mandatory exercise is still to come.

Sources

BSI Standard 200-4, Business Continuity Management (German), version 1.0 (May 2023), chapter 13 (table 34 "Exercise types according to BSI Standard 200-4") and 13.1.