Awareness, Training, and Exercises
Three distinct activities
Awareness builds general understanding of what to do and why. Training builds specific skills for people with defined roles. Exercises validate plans, people, and dependencies under realistic conditions. Candidates must not conflate them: an awareness email is not training, and training is not an exercise.
Know the exercise types in increasing complexity: plan review/walkthrough, tabletop, drill, functional exercise, and full-scale exercise. Each has objectives, scope, a scenario, participants, and an evaluation component. Exercises should be driven by a documented exercise program with a multi-year cycle that tests all plans and includes suppliers and external agencies where appropriate.
Evaluation matters more than execution. Know the after-action report (AAR) and improvement plan (IP) with owners and due dates. Findings should feed corrective action tracking, not sit in a binder. Also understand facilitator and evaluator roles, safety and stop-exercise authority, and the principle of no-fault learning so participants report problems honestly.
Traps
- Running exercises without objectives, producing activity but no learning.
- Skipping the AAR or failing to assign corrective-action owners.
- Testing only the easy scenario, or only the same scenario each year.
- Punishing participants for finding plan weaknesses, which suppresses reporting.
- Forgetting to include suppliers, vendors, and external responders in at least some exercises.
Rule of thumb
Every exercise should answer: what did we intend to test, what actually happened, what will we change, and who owns the change by when?
Worked example
A tabletop tests a ransomware scenario. Objectives include testing escalation triggers and spokesperson activation. The AAR finds the call tree missed two on-call engineers and the holding statement was outdated. The improvement plan assigns owners and due dates, and a functional exercise is scheduled to retest the corrected call tree.