Who signs the attestation?

The facilitator who ran the exercise signs it, over their own name, the certifications they hold and the date. Not your organisation, not the person who wrote your plan, and not your IT provider. Your side signs a different document entirely: the application, where an officer declares the answers true. The two signatures divide the work. The officer warrants what the company says about itself. The facilitator warrants what happened in one room on one date, and nothing beyond it.

What is the signature actually warranting?

The letter is a short list of statements of fact, each one beginning with the words “I attest”. That the exercise took place, on a stated date, between stated hours. That the participants were in the room, holding stated roles, with attendance recorded during the session rather than reconstructed afterwards. That it ran against a stated scenario and touched no live system. And that the report it sits inside is, in the letter’s own words, “a true and complete record of what took place, recorded by me during the exercise”.

Then the sentence the whole page exists for: “I am independent of the client. I hold no interest in the client and receive no compensation contingent on the content of this report.”

Every one of those is a checkable fact, and the signer carries the consequence of any of them being untrue. That is the entire mechanism. It works the way any signed professional statement works, which is why a stranger reading your renewal file can rely on it without ever having met you.

What is it not warranting?

Nothing in the letter grades anything. It does not say the plan is adequate, that the room performed well, or that anything will go smoothly in a real incident. It says the same thing whether the report behind it carries a page of findings or none.

That restraint is the value, not a limitation. A signature that vouched for quality would make the signer a party to your answer, with an interest in it reading well. A signature that vouches only for what happened keeps the signer a witness, and a witness is what the file was missing. The parent page covers what the document is in full; the short version is that it warrants an event, never an outcome.

Which sentence can an internal signer not write?

Most of the letter, truthfully signed, is available to anyone who was in the room. Your operations lead can attest the date, the attendance and the scenario, and if they took careful notes they can attest the record too.

The independence sentence is the one they cannot write, and it is the sentence doing the work. Beazley’s Canadian application draws the same line in its own way: the one place the form distinguishes who did the work is its audit question, which offers Internal, Third Party or None as the choices (Beazley Cyber Application, Canada, 2026), while its tested-plan question asks nothing about who ran the test. No box forces the test to be independent. What independence buys is different: the one line on the form that cannot be checked against a system becomes a line somebody outside your company staked their name on.