For ISMS leads and compliance

Tabletop exercises for ISMS managers
who need evidence in the next audit.

The auditor asks about ISO 27001 A.5.24 to 5.30: when did you last test your incident and emergency management, with whom, and what did you change afterwards? A single exercise answers only half of that. You need an exercise programme for your critical scenarios, an action list that someone works through, and minutes for every exercise. SecDrills writes those minutes during the exercise.

Request a demo

What SecDrills delivers for your ISMS

Evidence with date and roles

The report contains the participant list with roles, all answers, the discussion outcomes and timestamps. You present it to the auditor as it comes out of the exercise.

Mapping to the frameworks

Every exercise is mapped to NIS2, ISO 27001, DORA and TISAX. You see straight away which requirement you evidence with it and do not have to derive the mapping yourself.

The same structure every time

All exercises follow the same process and deliver the same report. That makes them comparable in the management review, and you do not design a separate workshop for every exercise.

An annual plan with four exercises

A single exercise shows the state on one day. Auditors and supervisors want to see that you exercise according to plan: which scenarios, in which format, with whom and when, derived from your risk assessment. ISO 22301 (clause 8.5) expects an exercise programme that validates your business continuity arrangements over time. Four exercises a year that cover different audiences and controls work well in practice:

Example of an annual exercise plan with four exercises
Quarter	Format	Scenario	Participants	Evidences, among others
Q1	Tabletop exercise	Ransomware attack on central systems	IT operations, IR/SOC team, information security	ISO 27001 A.5.24–A.5.26 · NIS2 Art. 21(2)(b)
Q2	Crisis team exercise	Escalated cyber incident with reporting obligation and external communication	Crisis team with management, communications, legal/data protection	ISO 27001 A.5.24, A.5.29 · NIS2 Art. 21(2)(c)
Q3	Tabletop exercise	Supply chain scenario: outage or compromise of a critical service provider	Information security, IT, supplier management, affected business units	ISO 27001 A.5.24–A.5.27 · NIS2 Art. 21(2)(d)
Q4	Plan walkthrough + functional exercise	Recovery of critical IT after a total outage	IT operations, BCM, system and process owners	ISO 27001 A.5.30 · NIS2 Art. 21(2)(c)

This is an example, not a requirement of any standard. Adapt scenarios and order to your risk assessment. Which exercise format suits which purpose is explained on the page about the cyber tabletop exercise.

How often should you exercise, and who takes part?

Exercise every critical scenario at least once a year and additionally after material changes to the organisation, IT or service providers. ISO 27001 names no fixed frequency. You set it on a risk basis and justify it in the ISMS. ISO 22301 expects exercises at planned intervals, and DORA requires financial entities to test their ICT business continuity plans at least yearly.

At the table sit the people who act in a real incident, and not whoever happened to have time. The deputies take part too, because incidents do not respect holiday plans.

IT, IR and SOC team

They assess the technical incident, contain it and restore the systems. Without them there is no exercise on incident management.

Crisis team and management

They decide under uncertainty, set priorities and approve measures. If nobody at the table is allowed to decide, the crisis team exercise remains a game.

Communications, legal and data protection

They check the reporting obligations and steer what is communicated internally and externally. These interfaces are where exercises typically reveal gaps.

Business units and service providers

They assess what the incident means for the core processes and, in the supply chain scenario, bring in the view of critical suppliers.

Which KPIs belong in the management review?

Those that show whether your incident and emergency management works and whether it is getting better. ISO 27001 requires in clause 9.1 that you determine what you monitor and measure. The standard does not prescribe specific exercise KPIs. Suitable examples are:

Share of critical scenarios exercised in the year
Time to escalation to the responsible function
Completion rate of actions within the deadline
Repeated findings across several exercises

Collect the same KPIs in every exercise. Only then does a trend emerge with which you show in the management review (9.3) how maturity is developing.

How to track actions through to the effectiveness check

If nobody works through the findings after the exercise, it was in vain. ISO 27001 requires that what is learned from incidents is used for improvement (A.5.27) and that the effectiveness of corrective actions is reviewed in the case of nonconformities (10.2). In practice that is four steps:

1

Document the finding

Record the observation without judgement, name the cause and map the finding to the affected plan or control (e.g. A.5.26).
2

Plan the action

Every action gets a responsible person, a deadline and a priority. Define straight away how you will recognise that it works.
3

Implement and evidence

Track the status and document the implementation. Open actions go into the management review (ISO 27001, 9.3).
4

Check effectiveness

In the follow-up exercise you check whether the gap has been closed. Only then does the corrective action count as effective under 10.2.

How to phrase findings and build an action plan is explained on the page about the after-action review.

What you need the report for

Testing under ISO 27001 A.5.24 to 5.30

You evidence for the internal audit and the management review that you have tested your incident response and continuity measures.

Evidence for NIS2 Art. 21

You show that your crisis and IR processes are exercised regularly and hold in an incident.

Audit preparation

A few workshop notes and a PowerPoint protocol rarely satisfy the auditor. With SecDrills you present exercise evidence with the same structure every time.

TISAX evidence

As an automotive supplier you show that your emergency and incident processes have been rehearsed, in a form you can present directly.

How to evidence the exercise in the audit

An emergency plan on file does not prove that it works. Auditors want to see that the procedures have actually been rehearsed and that something improved afterwards. Complete exercise evidence therefore starts with the exercise brief, runs through the exercise log and the after-action report, and ends with the action plan and the effectiveness check. The eight documents that belong to it are listed on the page about the cyber tabletop exercise.

In the report every exercise is mapped to the frameworks: NIS2 (Art. 21), ISO 27001 (A.5.24 to 5.30), DORA and TISAX. That closes a gap many ISMS have. The policies are written, but a documented crisis exercise is missing.

Already using an ITSM or GRC tool? Then action tracking stays there. The exercise itself needs a scenario, injects, roles and a log with timestamps, and that is what tabletop software provides. SecDrills runs in the browser, is hosted in the EU and needs no access to your systems. The comparison of the tools is under Tabletop software or ITSM/GRC tool.

Three steps to audit evidence

1

Choose a scenario and roles

You take a scenario from the catalogue and assign the participants their roles. You do not have to write a scenario of your own.
2

Play it through, guided

SecDrills steers the process through injects. Every decision is recorded with a timestamp.
3

Download the report

The report contains the mapping to the frameworks. You export it as PDF, Word or HTML and present it in the audit and the management review.

See the report before the auditor arrives

In the demo we play through a scenario with you, and afterwards you hold the report in your hands. Externally facilitated, a single exercise usually costs €5,000 to €15,000. The Professional package costs €4,900 net a year, for up to 10 participants and with evidence packs for ISO 27001 and NIS2. We get back to you within two working days.