What is a trusted agent in exercise planning?

In exercise planning, a trusted agent is a member of the planning team who knows the scenario and its injects in advance and keeps them confidential from the players. FEMA’s HSEEP doctrine puts it plainly: planning team members are typically not exercise players, they are trusted agents.

What it means in practice

The role exists because the people who design an exercise need inside knowledge, and the people who play it must not have it. A scenario that names the wrong backup vendor, or a system you retired last year, breaks the illusion almost at once. Someone from inside the organization has to check it.

In a mid-size organization the trusted agents are often the IT or security lead, the privacy or compliance lead, and an executive sponsor who approves the objectives. Players often know the general topic (“ransomware”). What stays hidden is the detail: the order of events, the injects and the twists.

The awkward part is that the person who knows your environment best is often the person you most want to hear from as a player. There are three ways through it. Pick a deputy as the trusted agent and let the lead play. Let the lead be the trusted agent and sit out. Or have the lead play and give the facilitator only publicly knowable detail. HSEEP acknowledges that with limited resources planning team members may act as both planners and players, but they must be careful not to divulge sensitive exercise information.

Trusted agents also help with the surrounding material. They check that nothing in the pack contains real customer data, and they sometimes help with facilitation as subject matter experts on the day.

Where it shows up in an incident

Trusted agent is an exercise term. It matters in the planning weeks and during the session, not in a live incident. The owner is the lead planner or facilitator, who decides who gets to know what.

Common mistakes:

A trusted agent quietly tips off a colleague who is a player (“check your backups this week”).
Too many trusted agents. Each extra person is another chance the surprise is gone.
No briefing on the ground rules: don’t touch production systems, don’t use real names or data in injects, and don’t answer players’ questions on the day unless the facilitator asks.
An executive sponsor who knows the script and then comments on the players’ answers in the room.

In a tabletop exercise

These are planning-stage checks, and the facilitator can ask them of the trusted agents a week before the session:

“Does every inject use systems, vendors and job titles that exist here? Where are we wrong?”
“Who will know the scenario in advance, is any of them also a player, and what will each say if a colleague asks what’s coming?”

What it means in practice

Where it shows up in an incident

In a tabletop exercise

Sources