Testing
Testing the plan, and proving it
Every guide on this site about testing a plan, in one place. Each one answers a single question, and the answer is in its first paragraph.
A plan nobody has tested is a document. These pages cover how to test one, what to start from if you do not have one yet, and the record a test should leave. That record is what a carrier, an auditor or a board will actually read.
Incident response
Testing an incident response plan
How to test one, how often, and what counts as tested when a carrier asks.
- Read it
How do you test an incident response plan?
Four ways to test an incident response plan, from a walkthrough to a full-scale exercise, what evidence each produces, and which one to run for a carrier, an auditor or CCCS.
- Read it
What does a carrier mean by a tested incident response plan?
It means the plan was exercised with the people who would have to run it, and that a dated record exists afterwards. Underwriters, auditors and government exercise programmes each mean something different by the word.
- Read it
Does a tabletop exercise count as incident response plan testing?
Yes, on every form we have read. Carriers ask whether the plan was tested and never specify a method, so what decides the answer is the record you keep, not the format you chose.
- Read it
How often should we run a tabletop exercise?
Once a year is the floor, set by the insurance application's own arithmetic and by the one regulator that names a cadence. What moves the answer above once is change: to the plan, to the people, or to what your company owes.
Templates
Templates to start from
If there is no plan yet, start here. Each page sets out what the document needs, section by section.
- Read it
Incident response plan template: the sections, and the one that gets left out
A plain-language incident response plan template built on NIST and CCCS guidance, rendered on the page, with the testing section carriers ask about and the evidence section behind it.
- Read it
What goes in an incident response policy, and how is it different from the plan?
The policy sets who is accountable and how often the plan is tested; the plan says what to do. A short policy template, rendered on the page, and the review cadence to write into it.
- Read it
What should be on an incident response checklist?
What to do and what to record in the first hour, the first day and the first three days of a cyber incident, including the order in which to make the calls.
- Read it
What should a security incident report contain?
The fields an incident report needs for a privacy regulator and your own after-action review, with the record-keeping duty that applies whether or not you notify.
- Read it
What belongs in a ransomware recovery plan?
Recovery is only half of it. The decisions about disclosure and payment are the ones worth settling before anything happens.
Business continuity
Testing a business continuity plan
The same question for the plan that keeps the business running while systems are down.
- Read it
How do you test a business continuity plan?
What testing a business continuity plan actually means, the test types and what each proves, how to write the test plan, and why the same exercise can also answer the testing question on a cyber insurance application.
- Read it
What does a business continuity tabletop exercise look like?
A three-hour agenda for a business continuity tabletop, three scenario examples with the decision each one forces, who attends, and what the report records.
The record
The evidence a test leaves behind
What the report should contain, how an exercise is scored, and how it differs from a review after a real incident.
- Read it
What is in an after-action report, and what does an underwriter read first?
Eight sections: summary, scope and scenario, participants, a timeline of decisions, what worked, findings, prioritised recommendations, and the signed attestation. An underwriter reads three of them.
- Read it
What is an exercise evaluation guide, and does it score your tabletop?
An exercise evaluation guide is a data collection tool, not a score out of ten. What federal doctrine says it contains, what the evaluator does with it, and what a carrier takes from the result.
- Read it
Post-incident review or after-action report: which one do you owe, and to whom?
One is a meeting, the other is a document, and the confusion can cost organizations the evidence they need. What each is for, who reads each, and when you owe both.
Insurance
Where the insurer comes in
What your policy does to the first hour of an incident, and how to check the application before renewal.
- Read it
How does a cyber insurance policy change the way you respond to an incident?
What a breach coach is, what an approved panel means, what you have to do before you call anyone, and where the tested-plan question sits.
- Read it
What does a cyber insurance readiness review actually check?
The controls a carrier asks about at renewal, how to find the ones you cannot evidence before your broker does, and what an independent review adds.