The security awareness and training disciplines described in the preceding sections address the knowledge and skill dimensions of the security culture programme through the delivery methods whose formats most effectively build the understanding and capability that secure behaviour requires. Simulated exercises address a different and equally essential dimension: the practical application of that knowledge and capability under conditions that approximate the stress, ambiguity, and time pressure of the actual security events that the programme is preparing the organisation to face. The distinction matters because the research on skill acquisition across all domains consistently demonstrates that knowing how to respond to a threat and being able to respond to it effectively under pressure are separated by the practice gap that only repeated realistic exercise can close.
The organisation whose security incident response capability exists entirely in the documented playbooks and the training records that confirm the workforce has completed the awareness modules is not prepared for the actual incident. It is prepared to describe, in the calm conditions of the training room, how it would respond to the incident if that response were to occur in the equally calm conditions that training scenarios inhabit. The actual incident will not occur in those conditions. It will occur in the conditions of operational surprise, technical complexity, organisational stress, and communication pressure that simulated exercises are specifically designed to replicate, and the capability gap between the planned response and the executed response will be measured in incident duration, data exposure, business disruption, and reputational damage.
The ISO must govern the simulated exercise programme as the essential bridge between the security knowledge that the training programme builds and the security capability that genuine organisational resilience requires, designing and deploying the exercise types that most effectively develop the specific response capabilities that the organisation’s risk profile demands.
The Exercise Spectrum: From Discussion to Full-Scale Simulation #
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
