Why are exercises needed?
Exercises allow stakeholders to test and validate plans, training, capabilities, and communication in a low-risk environment. The desired outcome is the identification of capability gaps and areas for improvement in all aspects of the overarching cybersecurity program. An exercise is the culmination of all the resiliency efforts up to that point through the application of the established plans, policies, procedures, processes, and training. They are a cost-effective way to familiarize personnel with their roles and responsibilities during an incident, and foster meaningful communication and collaboration within and across organizations. While exercises help identify resource and capacity shortfalls, they also help identify solutions. Exercises are a good way to establish relationships and information sharing avenues with the other stakeholders, as well as raise awareness within the community.