How to write cyber exercise objectives that can be scored afterwards

Why do most exercise objectives fail?

Because they are themes. "Improve coordination", "test the plan" and "raise awareness" describe why the exercise exists, but nobody can say afterwards whether they were achieved. When the after-action report is written, vague objectives produce vague findings, and vague findings produce no change.

What does a scoreable objective contain?

• A who: a named role or team, not "the organisation".
• A what: an observable action or decision, such as escalating, notifying, isolating or approving.
• A when: a time limit measured in scenario time.
• A against what: the plan, playbook or policy that says what should happen.

Written together: "Within 30 minutes of the ransomware note, the incident commander escalates to the crisis team using the escalation matrix in the incident response plan." An observer can mark that met, partly met or not met, and note why.

How many objectives should one exercise have?

Three to five. Fewer and the exercise is too narrow to justify executive time; more and observers cannot track them, and the report becomes a list. Spread them across the groups in the room: at least one for the technical lead, one for the executive decision-maker and one for communications.

How do objectives connect to the scenario?

Write the objectives first, then build injects that force each one. If an objective concerns customer notification, the scenario must reach a point where notification is a live question. CISA's Tabletop Exercise Packages follow this order, pairing objectives with scenario modules and discussion questions.

Can software score objectives for you?

Partly. Several platforms record decisions and timings automatically. iluminr, for instance, describes behavioural evidence such as decision velocity, confidence and alignment. Software can tell you how long a decision took and who made it. It cannot tell you whether the decision was right for your business; that judgement stays with the people reviewing the exercise.

What do good and weak objectives look like side by side?

• Weak: "Test communications." Strong: "The communications lead issues an approved holding statement within 60 minutes of the first media enquiry."
• Weak: "Check legal involvement." Strong: "Legal advises on notification obligations before the crisis team decides on customer notice."
• Weak: "Practise recovery." Strong: "The technical lead presents a recovery order for the top five systems, and the crisis team approves it within 45 minutes."

Each strong version names a role, an action, a time and an implied standard. Each can be observed, and each will produce a finding whether it is met or missed.

A quick check before you send the invitation

1. Can an observer mark each objective met or not met without arguing about it?
2. Does each objective point to a document that says what good looks like?
3. Is there a scenario moment that forces each objective?
4. Would the board care about the answer to at least one of them?