For IT leads, security leads and CISOs

Are we prepared for an attack?
After the exercise you have an answer you can prove.

Management asks you this question, all the more since NIS2 made the management body accountable. In the audit it comes up again, this time with a request for evidence. With SecDrills your team plays through an attack scenario as a tabletop exercise in the browser. Afterwards you have a report with roles, decisions and timestamps that you present to management and the auditor.

Request a demo

What SecDrills takes off your hands

A report you can present

The after-action report follows the ENISA methodology and is ready after the exercise as PDF, Word or HTML. You do not have to piece anything together from notes.

Numbers for management

The report rates every topic with a score and shows the status as a traffic light (RAG status). For the next meeting with management you have numbers in hand.

Little effort for your team

You pick a scenario and send a link. You do not need an external facilitator, SecDrills guides the process. A short exercise takes 30 minutes.

Four occasions for an exercise

The quarterly exercise for NIS2 Art. 21

Every quarter you check whether your procedures hold in an incident. Every exercise is documented, and at the end of the year four pieces of evidence are on file.

Bringing management to the table

NIS2 Art. 20 requires the members of the management body to follow training. In the exercise, management experiences which decisions will land on their desk in a real incident.

Onboarding new team members

The exercise becomes part of security onboarding. New team members exercise straight away in the role they take on in a real incident.

Thinking of service providers

What happens when your IT service provider fails or delivers a tampered update? In the supply chain scenario you see how your team and your third parties respond together.

What NIS2 and DORA require of you

NIS2 (Directive (EU) 2022/2555) obliges essential and important entities to appropriate risk management (Art. 21). That includes policies to assess the effectiveness of cybersecurity measures, incident handling and business continuity. Art. 20 makes the management bodies accountable: they must approve the measures, oversee their implementation and follow training, and they can be held liable for infringements. The national transposition laws of the member states set out the details, the registration procedures and the penalties.

DORA (Regulation (EU) 2022/2554) requires financial entities to run a programme for testing digital operational resilience and to document processes for responding to and recovering from ICT incidents. Exercises are a proven way to evidence these capabilities regularly.

Both frameworks require the same thing at heart: test regularly, document and improve. With SecDrills you complete the first two steps in one session. For the third, the report delivers the actions.

From scenario to audit evidence

1

Pick a scenario and assign roles

The scenarios follow the ENISA Threat Landscape. You assign the roles, for example CISO, IT operations, legal and communications. SecDrills maps the role profiles to the ECSF.
2

Exercise for 30 minutes to three hours

SecDrills feeds in the situation through injects, that is new updates that escalate the incident. Your team discusses and decides. Every decision is recorded with a timestamp.
3

Download the after-action report

The report contains scores per topic, the RAG status and the mapping to the frameworks. You present it in the audit or take it into the meeting with management.

An externally facilitated exercise usually costs €5,000 to €15,000, and afterwards you have exactly one. In the annual package from €1,490 net you exercise as often as you like. Only from the second exercise on do you see whether your team is getting better, and that is what management wants to know.

Play through a scenario with us

In the demo we exercise a scenario with you and show you the finished report. Then you know whether it satisfies your management and your auditor. Nothing is installed, SecDrills needs no access to your systems, and hosting is in the EU. We get back to you within two working days.