What is the difference between the standard report and the Extended Exercise Record?
The standard report is the eight-section document every engagement produces: summary, scope and scenario, participants and roles, a timeline of the decisions the room made, what worked, findings and gaps, prioritised recommendations, and the signed attestation. The Extended Exercise Record is an add-on that adds three things and only three. Clock times against every timeline entry. Mapping to MITRE ATT&CK and NIST CSF 2.0. And a plan-versus-behaviour gap analysis, comparing what your written plan says against what the room actually did.
What exactly is in each?
| Standard report | Extended Exercise Record | |
|---|---|---|
| Eight sections | Yes | Yes |
| Timeline of decisions | Yes, in sequence | Yes, with clock times against each entry |
| Findings and prioritised recommendations | Yes | Yes |
| Signed attestation | Yes | Yes |
| MITRE ATT&CK and NIST CSF 2.0 mapping | No | Yes |
| Your plan compared against what happened | No | Yes |
| Price | 15,000 CAD | Add 8,000 CAD |
The row people get wrong is the timeline. The standard report has one. It records what the room decided and in what order. What it does not carry is a clock time against each entry, and that is the boundary between the two documents.
Why do those three things cost extra?
Because each needs a second pair of hands.
Clock times need somebody in the room whose only job is recording them, at the moment they happen. They cannot be reconstructed afterwards from memory, which is why this is the one part you cannot add later.
Framework mapping needs analyst hours after the session, working through findings against the control sets. It runs at roughly seventy percent coverage by design, flexed to whatever your own programme uses.
The plan comparison needs your written plan read closely before the exercise, so the scenario can be built to stress the parts most likely to fail.
One thing to be straight about: framework mapping is a MyTabletops standard going forward. It is not something that has always been part of these reports, and it is not ordinary industry practice. We do it because regulated readers ask for it, not because anybody requires it.
Which one do you need?
For a cyber insurance renewal, the standard report. An underwriter reads the scope, the participants and the attestation, and skims the findings. Clock times and control mapping do not change that assessment.
For a SOC 2 or ISO 27001 evidence request, the standard report. Auditors want the artifact trail: scenario, attendance, date, findings, closure. The mapping is nice and it is not what they asked for.
The extended record earns its place when the file has a different reader. A regulator. A claims reviewer going through your response backwards a year later. A board that has asked for framework alignment specifically. Or anyone who has already had an incident and expects the next conversation to be forensic rather than commercial.
The distinction is who is reading, not how serious you are. An underwriter is satisfied by the standard report. A regulator, an auditor or a claims reviewer checks the timeline, wants the mapping, and asks what the plan said against what the room did.
How to decide
If you cannot name the person who would read the extra three things, you do not need them yet. Read the sample report first. It is the whole standard document, and most buyers find it settles the question without a conversation.
If you can name that reader, the extended record is a call rather than a download, because whether it helps depends entirely on what they will be looking for.
Is the extended version just a longer report?
No. It adds three specific things that require work the standard engagement does not include: somebody recording timings during the session, analyst hours afterwards, and a read of your written plan before the exercise runs. Length is a side effect, not the difference.
Can we decide afterwards?
Partly. The mapping and the plan comparison can be added later. The clock times cannot, because they have to be captured live by somebody whose job in the room is recording them. If you think you might want the timeline, say so before the session.