Read with the right scope
An adaptable exercise method for business continuity and cyber response. An exercise does not certify resilience. Sector-specific testing, safety and reporting requirements must be checked separately.
Status: Implementation guide · official sources checked 1 November 2026
Choose one service and a clear objective
Begin with a service people rely on, such as making payments, accessing patient appointments or responding to clients. Choose the question to test: can the organisation make decisions and sustain a safe minimum service if a critical system or supplier becomes unavailable? Keep the first exercise small enough that the results can lead to action.
NCSC's free Exercise in a Box provides structured scenarios and supporting materials. Its incident-management guidance connects response with continuity and recovery planning. These resources support practice; they do not replace the obligations or recovery capabilities relevant to your organisation.
Prepare participants and boundaries
Invite the people who would actually decide and respond, including operational leadership, technology, communications and relevant suppliers where appropriate. Appoint a facilitator and someone to record observations. Agree whether the exercise is a discussion, a technical recovery test, or another controlled format; these produce different kinds of evidence.
- State the objective, service, scenario, duration and information available at the start.
- Identify the decisions participants are authorised to simulate and any activity that is out of bounds.
- Mark exercise material clearly so it cannot be mistaken for a real incident.
- Agree how to stop the exercise if a genuine incident or safety concern arises.
Test assumptions with realistic developments
NCSC's exercise-creation guidance recommends developing plausible updates that advance the scenario and recording what participants learn. Introduce a limited number of developments: the supplier cannot provide a restoration estimate, the nominated decision maker is absent, or a communications channel is also unavailable. Ask participants to show where they would obtain the information or authority they need.
A discussion that somebody could restore a backup is different from a successful restoration test. Record that distinction. Likewise, a contact list is useful only if the necessary people and alternatives can actually be reached under the scenario's conditions.
Close the loop
Hold a short debrief while decisions are fresh. Separate gaps in the plan, capability shortfalls and uncertainty that needs investigation. Record what worked as well as what failed. Give each improvement an owner, deadline and completion criterion, then schedule the appropriate follow-up test.
Retain the exercise objective, attendance, scenario, observations, decisions and action log. Report the implications for affected services and risks. The valuable output is a better supported recovery capability and a clearer understanding of limits, rather than a claim that one exercise proved the organisation is resilient.
Put the guide to work
Start with the evidence.
- A stated service, objective, scenario, participants and exercise boundaries.
- A timeline of scenario developments, decisions and information participants could actually locate.
- Separate results for discussion exercises and technical recovery or restoration tests.
- A debrief and action record with a defined follow-up test for each important capability gap.
Your first three steps
- Select one service and a disruption scenario narrow enough to exercise safely.
- Ask the actual responders to locate authority, contacts and recovery information during the scenario.
- Debrief the failed steps and assign a specific follow-up exercise or technical test.
Common gaps to look for
- Discussion that a backup could be restored is reported as a successful restoration.
- The exercise assumes the normal contact or communication channel remains available.
- Lessons are recorded without a repeat test of the failed step.
Review when: Repeat relevant parts after service or supplier changes, an unsuccessful recovery test or an incident exposing an untested assumption.
Suggested working method. Apply the source requirements and scope explained in this guide.
Part of the risk guidance hub. See how the GRC framework connects the disciplines.
Connect this to your review
Link the risk, control, obligation and next action in the review workspace. Record what is known, what needs checking and which decision follows. The workspace organises your records; it does not inspect or independently verify evidence.
Sources & verification
- NCSC — Exercise in a Box ↗Source checked 1 November 2026 · Primary source
- NCSC — Effective steps to cyber exercise creation ↗Source checked 1 November 2026 · Primary source
- NCSC — 10 Steps: Incident management ↗Source checked 1 November 2026 · Primary source
The source list records when each reference was checked. AI-assisted research and drafting; no independent human legal review is claimed. Check for later changes and advice appropriate to your circumstances.