How often should you run a cyber crisis exercise?

Why is once a year not enough?

People change roles, suppliers change, systems move to new platforms and attackers change methods. An exercise run in March describes an organisation that partly no longer exists by December. And people forget: a decision rehearsed once a year is rehearsed for the first time each year.

Reflex Security's homepage frames the contrast as one exercise a year against unlimited exercises. That is a vendor's framing, but the underlying point is widely shared: frequency is limited by preparation effort, and preparation effort is what software is trying to remove.

What does each cadence buy you?

• Annual full simulation: the whole crisis team, a realistic scenario, a formal after-action report. Expensive, and the anchor of the programme.
• Quarterly decision exercises: one or two decisions, 30 to 60 minutes, a subset of the team. Cheap enough to rotate scenarios and test fixes.
• Continuous microsimulations: individual drills of a few minutes. iluminr describes 3–5 minute microsimulations and continuous capability testing. Good for keeping roles and thresholds fresh, too short to test coordination.

How do you keep executives engaged at a higher cadence?

Make each session shorter than they expect, start on time, and show them what changed since the last one. Executives tolerate exercises that produce decisions and visible fixes; they avoid exercises that produce reports nobody reads.

How should the cadence connect to findings?

Each exercise should test at least one fix from the previous one. If the last report found that nobody knew who could authorise taking the customer portal offline, the next exercise should reach that moment again and check that the answer is now clear and fast. Without that loop, frequency only produces more reports.

What gets in the way of a higher cadence?

Three things, usually: preparation time, facilitation and attendance. A scenario that takes weeks to write cannot be run monthly; a facilitator who must be booked through a procurement cycle cannot either; and executives will not attend monthly sessions that run for half a day. Each of the shorter formats above removes one of these barriers. Platforms that generate scenarios quickly, facilitate the session themselves or offer very short formats are effectively selling cadence.

What does NIST say about programme cadence?

NIST SP 800-84 treats tests, training and exercises as a programme, with a schedule and a cycle of planning, conduct, evaluation and improvement, rather than one-off events. It does not prescribe a frequency; that comes from your own risk, your regulators and how fast your organisation changes. A firm that reorganises often, adds suppliers quickly or operates under a supervisor that asks for evidence of testing will need a faster rhythm than one whose systems and people rarely change.

A starting schedule

1. Q1: full cross-functional simulation on your highest-impact scenario.
2. Q2: 45-minute decision exercise on disclosure and communications.
3. Q3: 45-minute decision exercise on containment and recovery order.
4. Q4: re-run of the Q1 opening to measure what changed.
5. In between: short individual drills on thresholds and escalation contacts.