How to organize a cybersecurity drill

A cybersecurity drill works best when participants know what they are practicing, but not every detail of the scenario. Start by defining one or two measurable practice goals, then build the threat scenario, participant groups and timetable around them. Confirm access needs early, test every laptop, presentation connection and network cable, and prepare a backup scenario before the day itself. The final run sheet should show who acts, who observes, when injects happen and how results are recorded.

Organize this event for free with Lizzt

The plan, step by step

Every task with its own sub-checklist, in the order you'll actually need them.

Preparations

1
Set practice goals
2 people
2
Determine the scenario and threat
3 people
3
Form participant groups
2 people
4
Send invitations
5
Process registrations
6
Keep track of the participant list
7
Collect dietary requirements
8
Collect access requirements
2 people
9
Make reservations
10
Arrange the spaces
2 people
11
Confirm participants
12
Finalize the run sheet
3 people
13
Write intros and messages
3 people
14
Create evaluation forms
2 people
15
Check contact list
16
Run a technical test
3 people
17
Set up backup scenario
2 people
18
Check presentations
19
Print name badges
20
Collect materials
2 people
21
Do the shopping
2 people
22
Chill drinks
23
Clean rooms
2 people
24
Set up tables and chairs
3 people
25
Set up registration desk
2 people
26
Set up presentations
2 people
27
Check practice systems
3 people
28
Set up whiteboards and materials
2 people
29
Set up catering
2 people
30
Distribute briefing sets
2 people

Event

31
Reception and registration
3 people
32
Serve coffee and tea
2 people
33
Give safety instructions
2 people
34
Explain the practice objectives
35
Guide teams to their workspaces
2 people
36
Distribute the first scenario inject
2 people
37
Register incident reports
2 people
38
Observe decision-making
3 people
39
Distribute additional injects
2 people
40
Refill drinks
41
Handle technical questions
2 people
42
Record interim observations
3 people
43
Serve break snacks
2 people
44
End the first rehearsal phase
45
Provide participant briefing
2 people
46
Set up the dinner buffet
3 people
47
Serve dinner
3 people
48
Clear away dishes and waste
2 people
49
Start the second scenario phase
2 people
50
Distribute escalation injects
2 people
51
Practice crisis communication
3 people
52
Record recovery decisions
2 people
53
Distribute the final injection
2 people
54
Officially close the exercise
55
Hold the first debrief
3 people
56
Hand out feedback forms
57
Collect feedback forms

Aftercare

58
Secure equipment
2 people
59
Securely archive practice dates
2 people
60
Collect participant feedback
61
Compile observations
3 people
62
Formulate improvement points
3 people
63
Assign action items
2 people
64
Prepare final report
2 people
65
Report back the results
2 people
66
Clean up the rooms
3 people
67
Wash dishes
2 people
68
Collect waste
2 people
69
Put tables and chairs back
3 people
70
Return materials
2 people
71
Clean rooms
2 people

What to bring

Grouped the way you'd shop for it, with quantities.

Furniture

Tablesqty 8
Chairsqty 36
Registration desk
Coat racksqty 2

Equipment

Laptopsqty 12
Projector
Projection screen
Presentation laptop
HDMI cablesqty 3
HDMI adaptersqty 3
Extension cordsqty 6
Power stripsqty 8
Network cablesqty 20
USB sticksqty 12
Headsetsqty 12
Wireless miceqty 12
Wireless presentersqty 2
Timer clocksqty 4
Mobile phonesqty 6
Power banksqty 6
Walkie-talkiesqty 6
Label printer
Laser pointer

Tableware

Coffee cupsqty 36
Glassesqty 48
Platesqty 36
Cutlery setsqty 36
Serving bowlsqty 8
Serving plattersqty 6

Kitchen

Coffee machinesqty 2
Kettlesqty 2
Thermos flasksqty 4
Coolersqty 3
Ice cube traysqty 2
Scissorsqty 4
Cutting boardsqty 3
Bread knivesqty 2
Serving utensilsqty 8
Pitcherqty 4
Bottle openersqty 3

Office supplies

Name badgesqty 36
Pensqty 50
Notepadsqty 36
Flipchart padsqty 4
Whiteboard markersqty 24
Markersqty 12
Sticky notesqty 12
A4 printing paperqty 500
A3 printer paperqty 100
Envelopesqty 50
Foldersqty 40
Paper clipsqty 2
Staplersqty 3
Rolls of tapeqty 6
Paper cutter
File traysqty 6

Security

Privacy filtersqty 12
Cable locksqty 12
Seal stickersqty 100
Paper shredder

Cleaning

Waste binsqty 6
Vacuum cleaner
Mop set
Microfiber clothsqty 12
Hand soap dispensersqty 3

Catering

Groceries

Tips

Set one primary outcome and no more than two secondary goals. For example, decide whether the drill measures escalation time, communication quality or recovery decisions, and define how you will record each result.
Create separate groups for participants, facilitators and observers before invitations go out. Send the scenario boundaries and expected time commitment with the invitation, but keep the actual trigger details restricted to the people running the exercise.
Collect dietary and access requirements during registration, then confirm the final participant list at least 3 business days before the drill. Late changes can affect group balance, room layout and laptop or headset allocation.
Run the technical test at least 24 hours before start time using the presentation laptop, projector, HDMI adapters, network cables, power strips and any required USB sticks. Keep a tested backup scenario ready in case the main platform or network is unavailable.
Finish the run sheet, opening messages, contact list and evaluation forms before setup begins. On the day, place name badges at the registration desk, start the timer for each exercise block and record observations while events are still fresh.

Frequently asked questions

How long does it take to organize a cybersecurity drill?: Allow 2 to 4 weeks for a small internal drill, including the scenario, participant groups, registrations and room arrangements. Reserve the final 3 business days for confirmations, materials and access checks.
When should you test the technology for a cybersecurity drill?: Run a complete technical test at least 24 hours beforehand, not just a quick check when participants arrive. Test the presentation laptop, projector, HDMI connections, network cables, power supplies and any shared devices in the actual room.
How many goals should a cybersecurity drill have?: Use 1 primary goal and up to 2 supporting goals. More than 3 measures usually makes the run sheet and evaluation forms too broad for one exercise.
What should you do if the main cyber drill scenario fails?: Prepare and test 1 backup scenario before the event. Keep the facilitator contact list and transition instructions available offline so you can switch within 10 to 15 minutes if the network, platform or presentation setup fails.

Start this plan in Lizzt

Every task and item on this page, ready in your own event. Invite people, split the work, and see who has done what.