How do you build a Cyber Resilience Act tabletop exercise?

What does the exercise simulate?

The exercise follows Aurelia Devices B.V., a fictional manufacturer, through one actively exploited vulnerability in the firmware of an industrial gateway. The clock starts on a Monday at 11:00, when a threat intelligence firm reports exploit traffic through the Aurelia disclosure policy. Eight injects then move the team through 32 days of the case.

How is the exercise structured?

The method follows the Homeland Security Exercise and Evaluation Program, known as HSEEP. HSEEP sets exercise objectives before design, and records strengths, areas for improvement and corrective actions in an After-Action Report and Improvement Plan. The exercise here states four objectives and ends with both documents.

NIST SP 800-84 describes a tabletop exercise as a discussion-based session in which personnel talk through their roles and their responses to a scenario. The scenario here arrives as eight timed injects. Each inject ends with one decision. The facilitator reads the inject aloud, the team discusses, and the team records one answer.

Every decision point is a scenario question from the CRA Academy question bank. After the team records an answer, the page shows the best answer, the reason and the provision behind the answer. A missed decision also shows the consequence for the case.

What does each inject test?

Each row is one inject. The time is scenario time, counted from the first report.

Which Article 14 fields does the team draft?

Three injects ask the team to draft the Single Reporting Platform fields for the stage that is due. The early warning asks for the title, the product and the Member States where the product is available. The vulnerability notification adds the nature of the vulnerability and the exploit, the measures taken, the measures users can take and the sensitivity of the information. The final report adds the date of the corrective measure, the full description, severity, impact, the malicious actor and the security update.

The field list comes from the same matrix CVD Portal uses to prepare a live Article 14 submission.

Who should take part?

Invite everyone who acts inside the first 24 hours. The usual group is the on-call engineer, the product security lead, the holder of the Single Reporting Platform account, legal counsel, communications and the product manager. Name one facilitator who does not play a role.

Plan 90 minutes. One inject takes about 10 minutes of discussion.

What happens after the exercise?

The page builds an after-action report with a rating for each objective and an improvement plan with one action for each missed decision. Print the report or copy the text into your own record. The answers and drafts stay in your browser and are not sent to our servers.

Record the exercise date in your Article 14 notification procedure. CVD Portal holds that date with the procedure and exports the date in the procedure document.