Five public standards, doing five specific jobs.
None of this hour is our own opinion. Each standard below decides something concrete: how the exercise is run, what the report looks like, how an update is sorted, or which deadlines a scenario is allowed to quote. This page is here so you can check any of it yourself.
- Standards
- 5
- Scenarios written
- 17
- Timed updates
- 148
The standard
What it decides here
NIST SP 800-84
The standard for running exercises. It defines the tabletop format — a discussion, not a live test — that this product follows.
HSEEP
Homeland Security Exercise and Evaluation Program. Where the shape of the hour comes from: timed updates, a debrief while the room is still together, an after-action report.
CISA CTEP
The US cyber agency's own free tabletop packs. They set the bar for what a scenario has to contain to be worth an hour of your team's time.
NIST SP 800-61r3
The current guide to handling an incident. It supplies the five response phases every update is classified against, and the reason the report is structured the way it is.
UK / EU GDPR
The law behind the notification deadlines in the scenarios. Article numbers are quoted so you can check any of them yourself.
Every update is classified twice.
Once by phase — how far into the response you are — and once by lane, meaning the kind of work it asks for. Together those two labels are what make the report readable by someone who was not in the room. They are also why a drill finds problems with communication and with who is allowed to decide, not only technical ones.
Phases
- Identify
- Working out what is actually happening, and how bad it is.
- Contain
- Stopping the spread before understanding the full picture.
- Remove the cause
- Removing the cause rather than the symptom.
- Recover
- Getting back to operating, and knowing when you are safe to.
- Lessons
- Turning what happened into something that changes practice.
These are a way of reading the hour afterwards, not the order it runs in. The room never sees a phase label on the shared screen.
Lanes
- Decide
- Authority and escalation — who can say yes, and how fast.
- Communicate
- Staff, donors, the people you serve, partners, media.
- Comply
- Regulator, funder and legal clocks.
- Technical
- Systems, accounts, devices, backups.
- Protect
- People, the data you hold about them, and your duty of care.
Every scenario has to cover at least four phases and at least three lanes. An automatic check enforces that before a scenario ships — it is not left to whoever wrote it.
Deadlines are quoted, never generated.
Where a scenario says a deadline is running, it names the law and the article it comes from — GDPR Article 33(1) for telling the regulator within 72 hours, 33(2) where a supplier has to tell you, 34(1) where the people affected have to be told. Anything a scenario makes up for the sake of the exercise, such as a clause in a grant agreement, is labelled Scenario: so it can never be mistaken for real law.
This is built into the system, not just a rule we try to follow. The part of the app that writes text has no permission to change a scenario or a deadline, so it cannot add one — and a deadline with no source named will not pass the automatic check before a scenario ships.
The library today
- Scenarios
- 17
- Timed updates
- 148
- Minutes per drill
- 60
Each one is written by hand and reviewed. When a drill starts, its version is locked — so the report always matches what that room was actually shown, even if the scenario is edited later.