The ENISA Cybersecurity Exercise Methodology

TLP-CLEAR

The ENISA Cybersecurity Exercise Methodology

End-to-end guide on how to plan, run and evaluate an exercise FEBRUARY 2026

The ENISA Cybersecurity Exercise Methodology Version: 1.0

About ENISA

The European Union Agency for Cybersecurity, ENISA, is dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost the resilience of the Union’s infrastructure and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

AUTHORS

Alexandros Zacharis, ENISA Anna Sarri, ENISA Christian Van Heurck, ENISA Fanouris Fanourakis, ENISA Gema Fernández, ENISA Nikolaos Christoforatos, ENISA Radu Arcus, ENISA

ACKNOWLEDGEMENTS

Deloitte Belgium

LEGAL NOTICE

This publication represents the views and interpretations of ENISA unless otherwise stated. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to Regulation (EU) 2019/881. ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must mention ENISA as its source. Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. ENISA maintains its intellectual property rights in relation to this publication.

COPYRIGHT NOTICE

© European Union Agency for Cybersecurity (ENISA), 2026 Unless otherwise noted, the reuse of this document is authorised under the Creative Commons. Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided appropriate credit is given and any changes are indicated. For any use or reproduction of photos or other materials that are not the copyright of ENISA, permission must be sought directly from the copyright holders.

ISBN 978-92-9204-735-1, DOI 0.2824/4949728

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Executive Summary

In today’s digital landscape, organisations face increasing cyber threats. Cybersecurity exercises are essential for preparing, testing and enhancing team and system capabilities to respond to these threats. A well-structured cybersecurity exercise methodology ensures a comprehensive approach to simulation and training, building resilience and agility in mitigating cyber risks.

What is the ENISA Cybersecurity Exercise Methodology?

The methodology offers an end-to-end theoretical framework for planning, running and evaluating cybersecurity exercises. It ensures the right profiles and stakeholders are involved at the right time. The methodology provides theoretical material based on lessons identified, industry best practices and cybersecurity expertise, and is designed to be used alongside a support toolkit, including a set of templates and guiding material to empower planners to organise effective exercises.

Who is the methodology for?

The methodology is designed for any cybersecurity professional, organisation or government who wishes to: • Learn about organising and planning a cybersecurity exercise; • Assess their current cyberattack response capabilities; • Convince management of the importance of organising cybersecurity exercises; • Test skills, response to and resilience against cyber threats, and compliance with legal and regulatory requirements. Developed and used for EU-level crisis management exercises, the methodology’s current focus is ideal for planners organising national or sector-level exercises.

What will the methodology do?

The methodology provides a structured, straightforward approach to planning, running and evaluating exercises, together with a support toolkit to provide practical guidance.

Go/no-go checklists

Go/no-go points between each phase of a cybersecurity exercise life cycle are crucial to ensure all necessary preparations and conditions are met before proceeding. These checkpoints reduce the risk of unforeseen issues, enhance overall effectiveness, allow for timely adjustments and ensure resource allocation aligns with objectives.

Alignment with standards

The methodology is flexible and built to align with established standards like ISO 22398:2013 ( ) and ISO 22361:2022 ( ).

Support and community use

ENISA offers resources, regular workshops and a community of cybersecurity experts to support planners. Contact ENISA for workshop schedules and community access.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Introduction What’s in it for you?

Testing your organisation’s capabilities and its response to and resilience against a cyber crisis is crucial to ensure the right skills, processes and policies are in place. ENISA’s documentation makes this process easy and clear with a structured, end-to-end approach:

• Just fill it in. The methodology and support toolkit covers all aspects of a cybersecurity exercise. Simply follow the structure and fill in the points relevant to you. This significantly reduces the time you will need for planning compared with starting from scratch, and the comprehensive checklists help eliminate the most common planning oversights. The documentation is designed to be easily understood and communicated across different levels of cybersecurity maturity. • Improve and stay compliant. Identify lessons learned, create an action plan for improvement and ensure your organisation’s processes align with relevant regulations and standards. For ENISA’s stakeholders, this includes key regulations and directives such as the Network and 3 4 Information Security Directive (known as NIS2) ( ), the EU Cybersecurity Act ( ), the Cyber 5 6 Resilience Act ( ), the Digital Operational Resilience Act ( ) and the General Data Protection 7 8 Regulation (GDPR) ( ), and relevant frameworks such as the EU Cyber Blueprint ( ). • Show the value early. From the start, you will be able to identify at an early stage reasons why your organisation would benefit from running an exercise. The documentation helps you efficiently identify lessons learned and create an action plan to address them. • You are not alone. ENISA offers regular workshops and working sessions to assist planners. You can also access a community of cybersecurity experts for advice and shared experiences.

How it works: core principles

The ENISA Cybersecurity Exercise Methodology guides organisations in developing effective cybersecurity exercises. The principles presented below serve as the foundation for the entire process.

• Structured planning. Ensure a systematic, user-friendly, comprehensive approach to designing and implementing exercises. The methodology is designed to make the planning process clear and straightforward, covering all dimensions, including compliance with European regulations and standards. • Capacity building. Systematically assess skills, processes and technologies, identifying gaps and areas for improvement, by setting clear, measurable objectives for effective evaluation and analysis. The methodology is designed to help you efficiently identify lessons learned and create actionable plans, helping your organisation continuously enhance its cybersecurity posture.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

• Flexibility. The methodology is adaptable to organisations’ specific needs and maturity level, supporting various exercise types, complexities and sizes. It allows you to easily showcase the benefits of cybersecurity exercises to management and justify the investment. • Resources ecosystem. This theoretical guide for planning, running and evaluating exercises is aligned with, and works together with, the European Cybersecurity Skills Framework and a support toolkit, which includes templates for main exercise documentation and practical checklists to guide you through the process and provide inspiration and insights for your exercise. • Community collaboration. You are not alone in the process. The methodology has been designed following feedback from the exercise planner experts’ community and will keep evolving over time to reflect the reality of this community. Regular workshops are organised, where discussion and knowledge exchange are encouraged throughout the exercise expert community.

Phases

The methodology is divided into six key phases to guide organisations in creating effective cybersecurity exercises, ensuring they are realistic, impactful and aligned with organisational goals.

In parallel, the support toolkit provides step-by-step documentation to plan, run and report on a cybersecurity exercise, ensuring organisations can develop, implement and refine effective exercises for improved preparedness for and resilience against cyber threats.

Key deliverables

This methodology helps prepare key deliverables for a successful cybersecurity exercise throughout the exercise-planning life cycle.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

A complete set of deliverable templates is available in the support toolkit.

The European Cybersecurity Skills Framework

ENISA uses the European Cybersecurity Skills Framework (ECSF) ( ) to map stakeholders, defining 12 typical cybersecurity professional role profiles. These profiles outline the main missions, tasks and skills needed in a professional cybersecurity context. Using the ECSF ensures common terminology and shared understanding of cybersecurity roles across the EU, enables the identification of critical skill sets required for the cybersecurity workforce, and promotes harmonisation in cybersecurity education, training and workforce development programmes. This mapping will be used throughout this document to align typical cybersecurity exercise roles with the ECSF.

SECTION 1

Initiation

The ENISA Cybersecurity Exercise Methodology

1. Initiation 1.1 Why do you want to organise an exercise? PRO-TIP

The decision to proceed with a cybersecurity exercise needs to start by understanding the underlying purpose of a cybersecurity exercise for oneself, whether it is at the individual, organisational or Reasons to organise an governmental level. This is fundamental to achieving meaningful exercise outcomes.

Typically referred to as the goal, the ‘why’ provides the foundational mitigation: proactive

reason for the exercise, ensuring stakeholder buy-in, motivation and

alignment with broader strategic goals. It helps to frame the objectives cybersecurity posture. with the right focus. The central question to address is.

The ‘why’ is the purpose and mission of the person, organisation or refinement of response public administration organising an exercise. It is not an objective. procedures, communication

While the ‘why’ outlines the core mission, the objectives define ‘how’

you will fulfil that mission.

Concise and understandable messages that resonate with a broad

audience will motivate stakeholders to actively engage and enhanced collaboration and collaborate, serving as a call to action for the exercise. coordination among internal

Five Whys: supporting technique

The five ‘whys’ method involves repeatedly asking ‘why’ to drill down • Continuous improvement: to the core purpose. The following is an example of a sequence. regular exercises allowing for

1. Why will I participate in Cyber Europe? To be a part of a pan-

European large-scale exercise. procedures based on lessons 2. Why? To test my country’s response to a potential cybersecurity identified and emerging

3. Why? To make sure the right people have the right skills. • Compliance and regulatory 4. Why? To ensure they we can detect, respond to, operate and requirements: compliance

recover from that cybersecurity threat.

5. Why? To make Europe safer from cybersecurity threats.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

1.2 Choose the right exercise type

Organisations can employ various types of exercise to test their preparedness for and resilience against cybersecurity threats. These exercises evaluate different aspects of cybersecurity readiness and response capabilities. Planners must choose the appropriate exercise type based on the defined objectives and capabilities. Two examples are given below.

• Discussion-based exercises: ▪ Focus on collaborative discussions and decision-making; ▪ Enhance awareness, understanding and communication of cybersecurity risks, policies, procedures and roles; ▪ Explore response strategies to simulated scenarios, emphasising communication and planning without physical deployment.

Example: Discussion-based exercises facilitate interactive discussions to evaluate preparedness, response strategies and decision-making processes.

• Operation-based exercises: ▪ Test and validate operational procedures, technical capabilities and response actions in a simulated environment; ▪ Assess the effectiveness of incident response plans, procedures and technical controls; ▪ Are scenario-driven exercises that allow planners to test actual response processes and operational readiness in a simulated but realistic environment.

Example: Operation-based exercises provide an immersive platform to test the practical application of response plans and technical capabilities in simulated scenarios.

When selecting the right type of cybersecurity exercise, planners must ensure that the exercise aligns with their objectives, capabilities and risk profile (see table below).

Decision Discussion-based Operation-based Criteria

The ENISA Cybersecurity Exercise Methodology

Exercise planners can select from various types of exercise within the discussion-based category. The table below helps planners choose the most suitable exercise by describing each type, considering specifics like duration, target audience and planning effort required (a minimum of six months for discussion-based exercises).

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Organisations can thoroughly assess their readiness by choosing the most appropriate type of exercise based on specific objectives and capabilities. By considering criteria such as objectives, audience and resources, planners can tailor exercises to their needs.

1.3 Define the required resources

Organising a cybersecurity exercise requires careful resource allocation in terms of people, technology, budget and time. Effective resource allocation ensures that the exercise is well supported, realistic and impactful, leading to improved cybersecurity preparedness and resilience.

1.3.1 Exercise stakeholders

The exercise-planning process should involve a diverse group of stakeholders from various organisational functions and external partners, whose involvement typically varies depending on the type of exercise.

Engaging stakeholders can be difficult, especially when it comes to obtaining senior management buy-in and coordinating schedules and priorities. Exercises contribute to overcoming resistance to change, addressing siloed attitudes and fostering a culture of cybersecurity awareness and collaboration; this is why establishing a clear stakeholder mapping early in the initiation phase is crucial to maximise engagement among relevant stakeholders and therefore key to a successful exercise.

To streamline the mapping process for a cybersecurity exercise, the ECSF ( ) provides a structured reference for relevant professional profiles and their main responsibilities. ENISA uses these 12 profiles to define the missions, tasks and skills needed in a professional context. Using the ECSF ensures common terminology and a shared understanding across the EU, which in turn helps identify critical skill sets and promotes harmonisation in education, training and workforce development programmes. For the purpose of the exercises discussed here, stakeholders ( ) are divided into participating and non-participating audiences, both of which have vital roles.

Participating Audience

Participating audience members have an active involvement in the exercise life cycle, with specific tasks across the different phases of organising the cybersecurity exercise. They are divided into teams, with specific skills required within each, as presented below.

The ENISA Cybersecurity Exercise Methodology

Team of planners

Responsible for the whole organisation of the exercise. They are the main target audience of this methodology.

Team of players

Actively engaged in reacting and responding to the simulated actions of the exercise scenario execution.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Team of expert observers

Provide insights and feedback before, during and after the exercise in line with their expertise, which contributes to the realism of the scenario and the identification of improvement opportunities.

Non-participating audience

Non-participating audience members do not have an active role in the planning, execution and evaluation of the exercise, but provide important inputs and are the key outcomes consumers of the exercise. They can be categorised as follows.

▪ Key decision-makers/stakeholders. Their main role is to provide a clear vision and oversee the exercise activities. They provide strategic direction, ensure resource allocation and make critical decisions to ensure the exercise’s success, such as initiating or approving the exercise activities or ensuring alignment with organisational goals. ▪ External visitors. They are individuals or entities that do not participate directly in the exercise activities, but are key stakeholders for the organisation. Their perspectives, feedback or observations may still be valuable for assessing the exercise’s effectiveness and informing the decision-making processes. They contribute greatly to the dissemination process. Some examples are the press, other teams within the organisation’s constituency and key partners. ▪ General public. They are not directly involved in the planning the exercise but may be impacted by its outcomes and would like to be informed about them.

1.3.2 Technology and tools

Effective exercise organisation requires providing the necessary technology and tools to simulate realistic scenarios and support the exercise activities. While deploying these tools, we can encounter potential technical limitations, such as issues with infrastructure, data access and network connectivity, which can impact the whole exercise life cycle.

Design and preparation

Technology is at this stage crucial for managing the exercise from a logistical standpoint and crafting the scenario. This includes using project management software to track tasks and timelines, and collaboration platforms for a unified workspace to develop objectives, write injects and design the exercise narrative. These tools ensure the entire planning team coordinates with one another.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Execution

Technology is used in this phase to deliver the simulated scenario to the participants. The tools will depend on the selected exercise type, as follows.

• Discussion based. For a seminar-type exercise, basic presentation and collaboration platforms, together with videoconferencing tools, are used to facilitate discussion and present key information. For a tabletop exercise, interactive polling tools or dedicated web applications are deployed to enable real-time collection of participant answers and decisions. • Operation based. Specialised email injection and simulation platforms may be needed to deliver the scenario information to players. Moreover, cyber ranges and virtualised network environments provide a safe, controlled space for participants to engage in hands-on technical challenges. Finally, access to simulated realistic media environments can enhance greatly the realism of the exercise scenario.

Analysis and evaluation

The final phase relies on technology to gather and process data to measure the exercise’s success. This involves using data collection tools, such as survey software or specialised web portals, to gather participant feedback. During a technical exercise, logging and monitoring tools can capture exercise activity and actions. It is important to note that, although these tools are used for data collection during the execution, their deployment and configuration must be completed earlier, during the preparation phase.

The collected data can then be used in conjunction with data visualisation and reporting tools to generate comprehensive after-action reports (AARs) that detail the team’s performance, highlight key takeaways and inform future improvements.

1.3.3 Budget

Securing an adequate budget is fundamental to the success of a comprehensive exercise, covering all aspects from planning and execution to evaluation and reporting. Gaining buy-in from senior leadership is essential to enable the allocation of the necessary resources.

A strategic approach involves developing a tiered budget proposal that outlines minimum, ideal and optimal scenarios. This allows you to clearly justify costs by delineating between the foundational elements required for a functional exercise, the value-added capabilities that can be introduced with minimal investment, and the strategic enhancements that will deliver a significant difference in impact and fidelity. This proactive financial planning demonstrates foresight and strengthens the case for the requested funding.

1.3.4 Timeline

Crafting and executing a successful cybersecurity exercise requires a well-defined time frame. The duration of the planning and execution life cycle depends heavily on factors like the exercise type, complexity, number of stakeholders and their collective experience. Securing an adequate time frame for thorough preparation, coordination and resource allocation is key to a successful

PRO-TIP

exercise. Planning well in advance allows for the following. For any cybersecurity exercise planned, start preparing a minimum of six ▪ Strategic alignment. Ensures that the months in advance of the intended exercise is strategically integrated into key execution date.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

broader exercise calendars, from your own organisation’s capacity-building programme to those of peer organisations, national/sectoral authorities and European initiatives. ▪ Thorough design. Allows ample time for detailed risk assessments, scenario development and overall exercise design. ▪ Resource allocation. Facilitates the proper allocation of personnel, budget and technology. ▪ Adaptability. Provides flexibility to adjust the plan based on evolving threats or unforeseen organisational changes.

Estimate your planning time frame

We include this formula as a high-level reference to calculate the ideal preparation time (TP), measured in months:

TP (months) = Tmin + (TE × C × S) / E

• Tmin is a constant minimum preparation time, which we consider to be six months; • TE is the duration of the exercise in days (of eight working hours), with a minimum value of 0.5 (half day or less); • C is the complexity of the exercise (e.g. a scale from 1 to 5, where 1 is a simple seminar and 5 is an operational exercise); • S is the number of primary stakeholder groups involved (e.g. 1 to 5, where 1 is internal stakeholders only, and 5 includes multiple external partners); • E is the planning team’s collective experience (a value from 1 to 5, where 1 is novice and 5 is expert).

EXAMPLES

1. Two-day national operational exercise (TE=2) with high complexity (C=5) and multiple external stakeholder groups (S=5) planned by an intermediate team (E=3) would require:

TP = Tmin + ( TE × C × S ) / E = TP = 6 + ( 2 × 5 × 5 ) / 3 ⋍ 23 months

2. A single-day national exercise that is estimated to take six hours (TE = six hours / eight working hours) or 0.75 days with medium to high complexity (C = 4, operational with technical components) and three main stakeholder groups (Security Operations Centre (SOC) team, IT infrastructure, management) (S = 3) planned by a team that has limited experience (E = 2) would require::

TP = Tmin + ( TE × C × S ) / E = 6 + ( 0.75 × 4 × 3 ) / 2 ⋍ 10.5 months 1.4 Assess your cybersecurity posture

Before planning your cybersecurity exercise, you need to understand your organisation’s current security capabilities and weaknesses – what we call your ‘cybersecurity posture’. This assessment helps ensure that your exercise targets real needs rather than assumed ones. For first-time planners this may seem daunting, but we’ll break it down into manageable steps.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Starting with a cybersecurity posture assessment is crucial as it provides a baseline understanding, identifies risks and vulnerabilities, aligns stakeholders and quickly identifies areas for improvement. This ensures targeted, relevant and impactful efforts, enhancing cybersecurity resilience and preparedness. Planners can use their existing frameworks or adapt the approach below to their organisation’s needs.

A three-step approach to assessing cybersecurity posture

1. General Assessment

▪ Purpose. Provides a high-level overview of the organisation’s ability to identify, respond to and recover from cybersecurity incidents. ▪ Methodology. Use surveys, interviews and documentation reviews. ▪ Outcome. Determine overall cybersecurity posture, strengths and weaknesses.

2. Vulnerability Assessment

PRO-TIP

▪ Purpose. Identifies specific vulnerabilities within systems, applications and • Allow 2-4 weeks for this assessment processes. • You will need access to cybersecurity- ▪ Methodology. Perform manual reviews related documentation and key staff and prioritise findings according to for interviews criticality. ▪ Outcome. Compile a report detailing • Results will directly inform your exercise objectives (Important to vulnerabilities and their severity, and connect it to the exercise planning) prioritise them based on risk level. 3. Gap Analysis and improvement areas

▪ Purpose. Identifies gaps between current cybersecurity posture and desired standards, recommending areas for improvement. ▪ Methodology. Conduct compliance reviews, benchmarking, gap identification and root cause analysis, and develop improvement recommendations. ▪ Outcome. Compile a gap analysis report and identify actions for exercise objectives.

1.5 Assess the feasibility of an exercise PRO-TIP

Having understood the cybersecurity posture, the next logical step is to evaluate whether it is feasible to • Build flexibility into your timeline to conduct the exercise. This feasibility check acts a accommodate adjustments and reality filter, helping to avoid committing to an exercise ensure sufficient time for planning and execution. that cannot be successfully delivered. • Foster engagement through regular First, you must ensure that your exercise objectives updates and active involvement in align with your strategic goals, risk management the planning process. priorities and legal/compliance requirements. It is • Conduct assessments and testing of essential to confirm the relevance of these objectives systems and infrastructure well in in addressing current cyber threats and operational advance to ensure that they are needs identified in prior risk assessments, all while ready for the exercise. ensuring alignment with applicable laws and industry standards.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Following this, you need to assess the level of stakeholder engagement and commitment. This includes executive leadership, technical teams and external partners. It is important to identify any potential barriers to their participation and secure their buy-in.

The majority of these barriers are normally linked to the availability of resources; this is why a thorough resource assessment is necessary to evaluate the availability of personnel, budget and external support. This step also covers technical feasibility, ensuring that all required technology, systems and infrastructure are available and compatible for the exercise. You must also consider the proposed timeline and scheduling to confirm that there is enough time for planning, coordination and execution without negatively impacting other operational priorities.

Finally, you should review lessons identified from previous exercises. This helps you to incorporate best practices and identify opportunities for continuous improvement.

By systematically evaluating each of these areas, you can develop a solid plan that is both realistic and effective.

1.6 Deliverables check: initiation phase

Once you have a clear focus and approach to conducting an exercise, collect all relevant information in a single document, the exercise plan, which will serve as the focal point for all decisions moving forward. The exercise plan is critical and must be frequently revised as planning progresses (more information is included in Annex B ‘Key deliverables’).

SECTION 2

Design

The ENISA Cybersecurity Exercise Methodology Version: 1.0

2. Design 2.1 Define the objectives PRO-TIP

After establishing your exercise purpose (the ‘why’ from the initiation phase), you must define clear, measurable

Smart Objectives

objectives that specify what the exercise will achieve. • Specific. Target a precise capability Setting clear and measurable objectives is crucial for the or process. success of any cybersecurity exercise. Objectives should • Measurable. Include clear success align with the organisation’s strategic goals and reflect its criteria. key performance indicators, ensuring that the exercise is • Achievable. Realistic within your relevant and capable of driving meaningful improvements. resources and time frame. Well-defined objectives ensure focus and clarity, whereas poorly defined ones can lead to inefficiency and missed • Relevant. Directly linked to learning opportunities. identified risks or requirements. • Time bound. Accomplished within Objectives are often defined using the SMART framework, the exercise duration. meaning they are specific, measurable, achievable, relevant and time bound. These objectives may include enhancing incident response capabilities, testing resilience against specific threats or improving coordination among stakeholders.

For the scope of this methodology, ENISA has derived a set of objective themes to serve as inspiration and guidance. These themes are derived from applicable EU policies such as the NIS2 Directive, the Cybersecurity Act and the EU Cyber Blueprint. They are as follows.

• Strategic. High-level objectives that align with the organisation’s overall strategy and long-term vision. • Operational. Specific tasks and activities that need to be performed during the exercise. • Human factors. Human elements of cybersecurity, including awareness, training and behaviour. • Process improvement. Identify and improve existing processes and procedures. • Business continuity. Ensure the organisation can continue operations during and after a cybersecurity incident. • Compliance and legal. Ensure adherence to legal and regulatory requirements.

A table with more detail on objective themes is included in Annex C ‘From objectives to capabilities’. Finally, add detail to your chosen themes by addressing the following three important questions.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

• What do you want to achieve? Define the desired outcome as precisely as possible, including the systems, tools and methodologies involved. • Who is targeted? Identify the specific individuals, roles or teams responsible for achieving the objective. • What is the measure of success? Define the expected outcomes and how you will measure whether the objective was met.

SAMPLE OBJECTIVES

2.2 Define the scope PRO-TIP

Establishing a clear scope is the critical first step in defining an exercise. The scope sets When to revisit the scope specific boundaries, ensuring that the exercise • New critical vulnerabilities emerge. remains focused and preventing mission drift. • Organisational structure changes. This approach guarantees resource efficiency and helps achieve the predetermined • Resources significantly increase or objectives. decrease. • Initial planning reveals unforeseen Building on the analysis from the initiation dependencies. phase, you can define the scope across key • Stakeholder feedback indicates critical dimensions: the systems and infrastructure to gaps. be tested (e.g. production environments, cloud services and third-party systems); the organisational boundaries to be included (e.g. specific departments, geographical locations and external partners); the threat scenarios to be simulated (e.g. types of attacks, threat actor profiles and attack vectors); and the time and operational constraints (e.g. exercise duration and any blackout periods).

To effectively define the scope, it is recommended to follow a structured approach, as follows.

The ENISA Cybersecurity Exercise Methodology

Even with a structured approach, exercises can fail due to common pitfalls in scope definition. To ensure your exercise’s success, it is important to be aware of and proactively avoid these common challenges. The table below outlines common scope pitfalls, their potential impact and practical solutions for mitigation.

Pitfall Impact Solution

Remember: a focused, well-defined scope that thoroughly tests a few critical areas provides more value than an overly ambitious scope that superficially touches many areas.

The ENISA Cybersecurity Exercise Methodology

2.3 Choose the right players

Selecting the right participants is crucial for exercise success. Players must represent the actual people who would respond to a real incident, possess the necessary authority to make decisions and have the availability to fully participate. The table below presents potential exercise players associated with the main tasks of the relevant ECSF roles.

Team ECSF Profile Tasks linked with Player role

Other teams relevant to the broader context of a cybersecurity exercise are the IT team, the communications team, the human resources team and the executive management. A complete mapping of the ECSF roles and other potential exercise players outside the ECSF profiles that are relevant to the broader context of a cybersecurity exercise are included in Annex D.

The ENISA Cybersecurity Exercise Methodology

2.4 Start communicating about the exercise

Effective communication is the backbone of successful exercise planning. Starting your communication plan early in the design phase ensures that all stakeholders remain informed, engaged and prepared throughout the exercise life cycle.

PRO-TIP

The communication plan must:

• Build awareness and buy-in before the exercise; Communicate early, • Maintain engagement during preparation; communicate often, • Ensure coordination during execution; communicate clearly • Capture feedback after completion.

A template for the communication plan is included in the support toolkit. In order to start the communication plan, you need to identify the required activities for the design phase, as shown in the table below.

Purpose Key components Practical steps

The ENISA Cybersecurity Exercise Methodology Version: 1.0

2.5 Deliverables check: design phase

Once you have clearly defined the scope of the exercise, the teams and player profiles you need to involve and the capabilities that you plan to evaluate, the exercise plan should be completed and the evaluation plan foundations should be defined (more information is included in Annex B ‘Key deliverables’).

SECTION 3

Preparation

The ENISA Cybersecurity Exercise Methodology Version: 1.0

3. Preparation 3.1 Define the scenario

Cybersecurity exercises must be built on realistic and compelling scenarios. The scenario acts as the narrative backbone of the exercise, setting the stage for all activities and decision-making. Developing a successful scenario requires a systematic approach that aligns with the exercise’s objectives and reflects the organisation’s unique threat landscape.

3.1.1 Main scenario elements

The main elements to define within a scenario are the threat actor(s), the state of the world and the storyline.

Select threats and threat actors

When defining your exercise scenario, it is critical to choose threats and threat actors that are realistic and relevant to your organisation. To do this, you should start by assessing your organisation’s specific threat landscape. Some recommendations are as follows.

• Look at sector-specific threats. It is good practice to examine the most prevalent threats targeting your sector. This ensures that your exercise is based on realistic and common attack patterns that you are most likely to face. • Choose a relevant threat actor. Based on the type of threat you have selected, you can then choose a plausible threat actor. For example, a ransomware attack may link to a cybercriminal group, while a denial-of-service attack could be associated with a hacktivist, and a more sophisticated, highly targeted attack may correspond to a state nexus group. This helps to make the scenario more realistic and aids in the development of a compelling narrative for the exercise.

The annual ENISA Threat Landscape report ( ) is a valuable resource. It provides a comprehensive, high-level overview of the most significant cyber threats and trends affecting the EU, offering a solid foundation for your scenario development.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

State of the world: what happened before

The state of the world element sets the context and provides a narrative for the exercise by detailing what has happened in the days or weeks leading up to the scenario’s start. This background information is crucial for enhancing realism and helping participants understand the situation.

This section should outline any significant events that are relevant to the exercise, such as:

• previous attacks that may demonstrate the threat actor’s capabilities or intent; • pre-existing conditions, such as a system that has been exhibiting erratic behaviour, which may materialise as a full-blown incident during the exercise (e.g. data exfiltration); • the broader geopolitical or organisational context that could influence the scenario.

Providing this information in advance helps participants make more informed decisions and ensures that they have a common understanding of the environment and the potential threats they are facing.

Storyline: what will happen during the exercise

The storyline is the narrative that outlines what will happen during the exercise. It serves as the script, guiding the events that unfold in real time and providing context for the participants’ actions.

To ensure that the exercise is effective, you must craft a realistic storyline. Your

PRO-TIP

narrative should mimic real-world conditions with a clear timeline of events.

Aim for a balanced scenario

The events can be delivered to participants • While it should be compelling, the through various injects, such as emails, storyline should not be overly instant messages or simulated news predictable or excessively dramatic. reports. • Avoid information overload, as this While it should be compelling, the storyline can confuse participants and detract from the exercise's primary should not be overly predictable or objectives. excessively dramatic. Avoid information overload, as this can confuse participants • Instead, focus on a narrative that is and detract from the exercise’s primary plausible and directly linked to the threats and vulnerabilities identified objectives. Instead, focus on a narrative during the scoping phase. that is plausible and directly linked to the threats and vulnerabilities identified during the scoping phase.

3.1.2 From storyline to injects

Once the main scenario elements have been clearly defined, planners must translate the overarching storyline into a structured sequence of executable elements. This translation follows a hierarchical framework that ensures logical progression and maintains control throughout execution of the exercise.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Understanding the scenario hierarchy

A cybersecurity exercise scenario operates on three distinct but interconnected levels, each serving a specific purpose in the exercise architecture, as follows:

• Events form the highest level, representing major campaign themes or attack patterns that span significant portions of the exercise; • Incidents are specific security breaches or attacks that occur within events, each with defined start and end times; • Injects are the individual pieces of information, prompts or simulated actions, within incidents, delivered to players at precise moments to drive the scenario forwards.

This hierarchical structure enables planners to maintain both strategic oversight and tactical control. Events provide the overarching narrative context, incidents create realistic operational challenges with appropriate duration and complexity, and injects serve as the actual mechanism for scenario delivery and player engagement.

Timing and coordination

The temporal relationship between these elements is critical. Events typically run for hours or even the duration of the exercise, providing continuity and context. Within each event, multiple incidents may run sequentially or concurrently, simulating the realistic complexity of cyberattacks. Injects are precisely timed triggers within incidents, delivered through appropriate channels (email, phone call, system alert) to elicit specific responses from players.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

The diagram below illustrates how these elements interact within a typical exercise timeline.

3.1.3 Master scenario event list

The elements described in the previous subsection are documented in the master scenario event list (MSEL), which serves as the exercise conductor’s score. The MSEL is the timeline that guides the exercise control team and the exercise execution automation tools during the execution phase, ensuring that the scenario elements are delivered at the right time to the right people, through the right channels. The MSEL can vary significantly depending on the exercise type, with tailored injects to suit discussion-based or operation-based exercises.

A MSEL template is available in the support toolkit. The table below presents the detail of each technical dimension to define for each exercise scenario.

PRO-TIP

Build a balanced MSEL

• Do not overload participants with too many injects or inject events too rapidly, as this can paralyse response efforts. • Build critical decision points into the scenario to test risk assessment and decision-making under pressure. Do not make decisions obvious or binary, without real consequences or complexity.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

3.2 Define the evaluation strategy

Without proper evaluation, even the best-designed exercise becomes just a training event with no lasting impact. Evaluation transforms your exercise from a one-time activity into a catalyst for real improvement by systematically capturing what worked, what did not and, most importantly, why.

In the context of cybersecurity exercises, evaluation means measuring whether the objectives set were achieved, identifying gaps in capabilities or processes and gathering evidence to justify future investments in security improvements.

This section provides a structured approach to designing your evaluation strategy before the PRO-TIP exercise begins. By planning your evaluation strategy now (during the preparation phase), you For large exercises, establish a dedicated ensure that meaningful data are captured during evaluation team with a lead and evaluators assigned distinct responsibilities. Position execution and can be analysed effectively evaluators strategically to gather pertinent afterwards. This section guides you through data, adjusting staffing levels based on site defining evaluation criteria (3.2.1), selecting needs. Exercise planners can also assist in appropriate data collection methods and tools data collection and provide information to the (3.2.2) and preparing stakeholders for their evaluation team. evaluation roles (3.3).

The ENISA Cybersecurity Exercise Methodology Version: 1.0

3.2.1 Define evaluation criteria

Evaluation criteria are essential for assessing the effectiveness of cybersecurity exercises. They provide a structured standard for measuring performance, identifying strengths and weaknesses, and guiding improvements. These criteria serve as benchmarks to ensure that the exercise achieves its objectives and offers valuable insights into the organisation’s cybersecurity posture.

The evaluation criteria can be structured as follows:

• Indicators (what you measure). These are aspects to capture during the exercise, PRO-TIP which link back to the defined objectives. • Metrics (how you measure). These are qualitative or quantitative measures of the A good practice is to specify the indicators used to evaluate performance. For each indicators as part of the expected actions of an inject indicator, you should define one or more metrics that from the player. It is a great provide a clear way to measure its success. way to keep the MSEL • Data collection (where the data come from). connected with the evaluation The different methods and tools for collecting data strategy. are further described in Section 3.2.2.

The table below shows how the two first elements work together in the evaluation of a phishing-related objective.

Objective Indicator Metrics

Some examples of indicators to keep an eye on during cybersecurity exercises are:

• Performance – response time, detection accuracy and recovery effectiveness, • Compliance – adherence to regulations and standards (e.g. GDPR, NIS2 Directive), • Communication and coordination – effectiveness of internal and external communication, • Participant engagement – level of stakeholder engagement and participation, • Incident handling – ability to identify, respond to and recover from simulated incidents.

3.2.2 Select data collection methods and tools

Exercise planners must select the right evaluation methods and tools depending on the exercise type and objectives, and the specific indicators being measured. This selection and overall evaluation assessment should be reflected in the evaluation plan.

The ENISA Cybersecurity Exercise Methodology

The Kirkpatrick model ( ) helps you evaluate at different depths, from immediate reactions to long-term organisational impact. The model consists of the following four levels.

• Reaction. This evaluates participants’ engagement with and the perceived value of the exercise. • Learning. This assesses the increase in knowledge and skills acquired by participants. • Behaviour. This examines whether participants apply what they learned to their daily operations. • Results. This level evaluates the overall impact on organisational goals, such as improved performance and enhanced security posture.

To implement the Kirkpatrick model effectively, exercise planners should use appropriate data collection tools tailored to each level. The table below provides an overview of these methods and tools for evaluating a cybersecurity exercise.

Level Before During After

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Before collecting data using various methods and tools, it is essential to define the types of

PRO-TIP

data to be collected and how each type will be processed. The data typically fall into two

Guidelines for data collection tools

categories, depending on the type of tool that is • 1-on-1 interviews. Balance open-ended and used and the type of metrics being measured. closed questions.

• Qualitative data. Rich, descriptive • Knowledge checks. Ensure that each question has a clear, single correct answer. information that can include text, images and videos. These data capture the depth of • Survey questions. Design surveys with specific, measurable questions for quantifiable human experiences, opinions and emotions. results. • Quantitative data. Numerical data that can be measured and quantified. These data • Direct observations. Use a standardised checklist to assess participants' application of provide the ability to test hypotheses, learned skills. measure variables and establish statistical • Analytics and reporting. Implement relationships. automated data collection methods to gather objective performance metrics (e.g. response Certain tools are better suited to collecting either time, accuracy rates) and provide information qualitative or quantitative data, while some can to the evaluation team. collect both. In order to complete the evaluation strategy, we need to specify how each indicator will be captured.

Following on from our previous example, the table below includes the data collection elements required to capture the defined metrics.

Objective Indicator Metrics Data collection tool

3.3 Prepare the stakeholders

Effective exercise execution depends on participants understanding their roles, the scenario context and logistical requirements before they arrive. This information should be compiled by the exercise planners in a practical guide targeting the exercise players. It will ensure that all participants start with consistent baseline information.

Preparation during this phase focuses on two critical activities: developing complete and accurate briefing materials, and establishing effective delivery methods that guarantee that participants receive and understand essential information.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

3.3.1 Develop the players’ guide

The players’ guide serves as a reference for all exercise players. It must be completed during the preparation phase to allow adequate review time before the execution of the exercise. The following important information should be included in the players’ guide:

• Exercise overview – the purpose, objectives and scope of the exercise, including background information players will need in order to understand the specific exercise context (e.g. the state of the world), • Roles and responsibilities – a clear description of what each participant/team is expected to do, • Rules of engagement – boundaries and guidelines (e.g. ‘use normal communication channels’, ‘do not contact real external entities’), • Technical requirements – systems access, credentials and connectivity information, • Schedule and logistics – exercise timeline, location details, breaks and key contacts.

3.3.2 Deliver the information to the players

Selecting appropriate communication methods that ensure that the players have received and understood the information is crucial. These activities should be incorporated into the communication plan developed during the design phase (see Section 2.4), specifying timelines, responsible parties and communication channels for each method. Depending on the complexity, size and nature of the exercise, planners can choose from several delivery approaches, as follows.

• Written documentation. Distribute the players’ guide and request that players acknowledge they have received and understood the materials. Consider using a simple form or email confirmation to track responses. This creates a record of distribution and helps identify who may need follow-up support. Planners may want to set a deadline for acknowledgement (e.g. one week before the exercise) to allow time for clarification. • Briefing and question-and-answer sessions. These sessions allow planners to provide more detailed explanations about the exercise, and players to ask questions and clarify uncertainties in real time. Briefings can be conducted in person or virtually, and may be particularly valuable for complex exercises or when players are unfamiliar with the exercise format. Consider recording sessions for players who cannot attend or for later reference. • Dedicated training sessions. For exercises requiring specific technical skills or involving complex scenarios, planners may organise hands-on training sessions. These sessions can help players familiarise themselves with tools, platforms or procedures they will use during the exercise. Training sessions are especially valuable for operation-based exercises in which players need to practise technical responses.

Planners may consider combining multiple methods to accommodate different learning styles and schedules. For example, distributing written materials first, followed by a briefing session, allows players to prepare questions in advance. An important aspect to consider is the timely distribution of the required information to the players in order to allow for proper preparation and address any questions raised or clarifications requested by the players after they have reviewed the material.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

3.4 Deliverables check: Preparation phase

Before moving to the execution phase, planners should stop to reflect on all the final checks to be done. A full checklist has been added to the support toolkit to facilitate this phase. This list can and should be tailored to your own needs and reality. Once you have finalised all necessary preparations for the exercise, the exercise plan, the evaluation plan and the MSEL should be ready

SECTION 4

Execution

The ENISA Cybersecurity Exercise Methodology Version: 1.0

4. Execution

The execution phase transforms months of planning into action. This is where your scenario comes to life, PRO-TIP participants test their capabilities under pressure and evaluators gather critical data for improvement. Success Note: the depth of execution during execution depends on three distinct stages: pre- activities varies by exercise type. Discussion-based exercises may exercise activities that ensure readiness, the exercise require simplified briefings and execution itself, when the scenario unfolds, and postlimited data collection, while exercise activities that capture immediate feedback while operational exercises demand full memories are fresh. implementation of all components described below This chapter guides you through each stage, highlighting critical checkpoints and common pitfalls. While the support toolkit provides detailed checklists for each activity, this chapter focuses on the strategic decisions and coordination required for smooth execution.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

4.1 Pre-exercise activities

Pre-exercise activities represent the critical transition from preparation to action. These final checks, conducted in the hours or days before execution, prevent common failures that can derail even wellplanned exercises. Think of this phase as your final systems check before launch – every element must be verified; every participant must be ready and every technical component must be operational.

4.1.1 Logistics check

The primary purpose of this activity is to ensure that the physical environment, equipment and basic infrastructure are operational and ready for immediate use.

Key actions include the following.

PRO-TIP

• Venue verification. Confirm that the venue set-up (e.g. seating, power, internet) is fully Dry run versus communication check in complete. operational-based exercises • Equipment readiness. Verify that all • A communication-check is a test done necessary exercise equipment (e.g. to ensure that the players can received computers, monitors, specialised tools) is injects with the method that will be used in place and functional. during the exercise. only one inject is delivered to all players prior to the • Communication channel verification. exercise. Send pre-exercise messages to all registered players before the event begins • A dry-run is a test the planners through the relevant injection channels. organise to refine and validate the MSEL content, simulating the players This is to verify that players can be reached experience: all injects are delivered to a and identify any issues ahead of time. single location visible only to the planners.

4.1.2 Scenario readiness

Scenario readiness focuses on confirming the robustness of the simulation’s content and ensuring that the exercise control team can manage its flow effectively.

Key actions include the following.

• MSEL dry runs. Conduct dry runs of the MSEL to detect any gaps, errors or issues in the injects and timings. • Injection material check. Verify that all scenario-related materials and the required ‘state of the world’ initial conditions are correctly set up.

4.1.3 Planners' and observers’ readiness

During execution, planners can adopt different roles depending on the nature of the exercise, and are considered part of the exercise control team. It is important to ensure that the team is fully organised, briefed and ready to manage the simulation without confusion.

Key actions include the following.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Clear roles and responsibilities

Reconfirm the roles for all exercise control PRO-TIP staff (e.g. monitoring, facilitators, expert observers). Each person must understand The following checks are important to ensure not just their own role, but how it interfaces smooth exercise control coordination during the execution: with others. • Can the lead facilitator quickly reach all • Facilitator roles. Facilitators serve as observers? the primary interface between the • Can technical staff alert facilitators to scenario and the players. They must system issues? be prepared to guide participant • Can the team collectively decide to adjust actions without leading them to the scenario pace without disrupting the predetermined outcomes, inject exercise flow? scenario elements at precisely the right moments and manage the exercise flow while maintaining scenario authenticity. Conduct a final walk-through of their specific responsibilities: when to intervene, when to let players struggle and how to handle requests that fall outside the exercise scope. • Observer roles. Observers must understand their dual mandate: capture everything while influencing nothing. Brief them on their specific observation points, what behaviours and decisions to document and, critically, when not to intervene – even if players are making mistakes. Their neutrality ensures that the data collected for the AAR remain unbiased and reflect true performance rather than coached responses.

Exercise control coordination

Establish and test the exercise control internal communication and coordination channels and dynamics for real-time management. The final hours before execution should include a complete team briefing in which everyone confirms their understanding of the exercise flow, their individual responsibilities and the communication protocols. This is also the moment to address any lingering uncertainties – better to clarify now than improvise during execution.

4.1.4 Players' readiness

This pre-exercise check ensures that the participation of all players is fully confirmed, and that they understand the rules and possess the necessary information to perform their roles. Key actions include the following.

• Confirm participation. Ensure that all exercise players are confirmed and accounted for. • Players’ briefing. Ensure that the players have received and are familiar with key exercise information.

4.2 Exercise execution

4.2.1 Scenario execution

The scenario execution phase focuses on delivering scenario elements (injects) from the MSEL to the players. The method of delivery and the expected player response differ significantly depending on the type of exercise being conducted, but the following are some common activities to be performed to ensure proper scenario execution.

• Guidance and support. Provide necessary support and guidance to participants to ensure that they stay within the rules of engagement and work towards the exercise objectives.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

• MSEL delivery. Systematically deliver scenario injects according to the predetermined timeline of the MSEL. • Dynamic adjustment. Be prepared to adjust the scenario in real time based on unexpected participant actions or responses to maintain a realistic and challenging environment. This includes slowing down or accelerating the pace of injects.

Discussion-based exercises

In discussion-based exercises, facilitators drive the scenario through direct interaction. For this type of exercise, the core activities are analysis, collaboration and decision-making, rather than performing live technical steps. Note the following points.

• The facilitator guides players through the scenario narrative, provides necessary context details and manages the flow of the MSEL. • Injects are typically formulated as questions (e.g. multiple choice, open ended, structured discussion points), and are designed to trigger analytical debate, strategic decision-making or a coordinated response among playing teams. The responses (discussions, answers or proposed actions) are captured for future analysis.

Operation-based exercises

In operation-based exercises, the focus is on practical, hands-on application of procedures, technical skills and coordination within a simulated environment. They require more complex delivery mechanisms and technical coordination. Note the following points.

• The facilitators ensure that the injects are delivered accurately to the correct audience (e.g. incident responders, system administrators) and through the appropriate means (e.g. simulated email, ticketing system, live network event). • Injects trigger concrete, measurable actions from the players, such as performing a forensic analysis, communicating with relevant stakeholders or executing a specific technical procedure. Participants are encouraged to follow necessary organisational procedures and protocols. The resulting actions, communications and decisions are captured and logged during the exercise to reflect the result in the AAR.

Technical environment management

During operation-based exercises, maintaining the technical infrastructure is critical for exercise success. This involves the following two parallel responsibilities.

• Inject delivery systems. Deploy injects through realistic technical THE BLUE-ROOM channels appropriate to each player’s role, for example: ENISA’s exercise solution ▪ simulated emails based on the • The Blue-Room supports cyber exercise scenario; projects through all phases, including execution. ▪ news items, articles and social media posts on simulated news • Its implementation is based on modular and social media sites; components adapted to the specific needs ▪ network anomalies and other of each exercise phase. technical logs available for • A key feature is the use of a standardised analysis; YAML file containing the exercise content ▪ phone calls or video conferences for crisis management.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

• Environment integrity. Continuously monitor and maintain the exercise platform through the following means. ▪ System monitoring. Track the health of all simulation components (network connectivity, application availability, data flows) to detect and resolve issues before they impact players (e.g. late or missing inject delivery). ▪ Realism preservation. Verify that all technical elements remain consistent with the scenario – ensuring fake events look authentic, simulated malware behaves as expected and system responses match real-world behaviour. ▪ Rapid intervention. Maintain a technical support team ready to address any platform issues without disrupting the exercise flow or breaking scenario immersion.

The key is balancing technical complexity with exercise objectives – the environment should challenge players realistically without introducing artificial obstacles stemming from technical failures.

4.2.2 Real-time monitoring and support

During exercise execution, the exercise control team and observers continuously monitor and document participant activities. This real-time data collection is essential for meaningful evaluation and improvement.

Key monitoring activities are as follows.

• Performance observation. Document participant actions, decisions and communications against established procedures and expected responses. • Event logging. Record all critical events, player responses and both planned scenario injects and ad hoc exercise control injections with precise timestamps. This comprehensive logging allows accurate reconstruction of the exercise timeline, including any spontaneous adjustments made by the exercise control team. • Live feedback capture. Gather immediate participant insights during scheduled breaks or designated feedback points while experiences remain fresh.

4.3 Post-exercise activities

The post-exercise phase is crucial for ensuring that the investment in the simulation translates into tangible organisational improvements. This phase involves systematic data gathering, participant reflection and structured analysis.

Data collection

Make sure that all the information collected using the methods defined in Section 3.2.2 ‘Select data collection methods and tools’ is properly stored and available for analysis.

Key data to collect and store include the following.

• Technical records. Collect all technical logs, network traffic data, communications records (emails, chat transcripts, voice logs) and detailed notes taken by the players and the planners’ team during the simulation. • Participant feedback. Distribute structured surveys and feedback forms to participants, observers and facilitators to gather quantifiable input on the exercise’s effectiveness, scenario realism and potential areas for improvement.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Structured debriefing

Structured debriefing serves several key purposes in the evaluation of cybersecurity exercises, as follows.

• Reflection. Allow participants to reflect on their actions, decisions and outcomes PRO-TIP during the exercise. • Insight. Provide valuable insights into the Traditional ways to organise feedback effectiveness of the exercise, including collection strengths and weaknesses. • Hotwash. Conduct a feedback session • Improvement. Identify areas for immediately after the exercise where improvement and guide future participants can discuss their experiences, enhancements. challenges and initial thoughts on the exercise while they are fresh in their • Engagement. Foster engagement and minds. collaboration among participants, encouraging open communication and • Coldwash. Conduct a feedback session shared learning. some days/weeks after the exercise when participants will have had the time to reflect and process with some distance Schedule a debriefing session with all their experience during the exercise. participants to discuss the exercise and provide a complete overview of what happened. Collect The combination of the sessions will give you feedback from participants, focusing on their a complete feedback picture that will allow you to improve future iterations. experiences, observations and suggestions for improvement.

4.4 Deliverables check: execution phase

Before finalising the execution phase, planners should ensure that all data have been collected as planned to produce the AAR. A full checklist has been added to the support toolkit to facilitate this phase. This list can and should be tailored to your own needs and reality.

SECTION 5

Evaluation

The ENISA Cybersecurity Exercise Methodology Version: 1.0

5. Evaluation 5.1 Analysis and assessment

The analysis and assessment phase transforms raw exercise data into actionable findings. This phase answers three critical questions: Did we meet our objectives? Where did we fall short? What caused these gaps? Without rigorous analysis, even the best-executed exercise becomes just another training event with no lasting impact.

As noted in Section 3.2.2 ‘Select data collection methods and tools’, these data typically fall into two categories: qualitative and quantitative. Since using a variety of evaluation tools can generate a large amount of raw data, evaluators must apply different techniques based on the data type. The following sections detail these techniques for extracting valuable insights from the collected data.

5.1.1 Techniques to analyse qualitative data

Qualitative data from exercises – interviews, observations and debriefs – contain rich insights that require systematic analysis. The following three techniques work together to extract meaningful findings.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Step 1 - Thematic analysis (pattern discovery)

What it does Identifies recurring patterns across all qualitative data

• Read through all observation notes, transcripts and feedback; • Tag recurring topics (e.g. ‘communication delays’, ‘unclear How to apply it procedures’); • Group similar tags into themes; • Count frequency to prioritise issues.

Example output ‘Communication breakdown’ appeared in 73 % of observer notes

Step 2 - Content analysis (quantifying themes)

What it does Converts qualitative observations into measurable data

• Count specific mentions of each theme; How to apply it • Track context (when, where, who mentioned it); • Create frequency tables.

‘Escalation procedures’ mentioned 47 times, primarily during incident

Example output response phase.

Step 3 - Narrative analysis (understanding experience)

What it does Captures the human story behind the data

• Examine how participants describe their experience; How to apply it • Look for emotional indicators and decision-making patterns; • Identify turning points in the exercise flow.

Players consistently described feeling ‘overwhelmed’ at the two-hour

Example output

mark when multiple incidents converged.

These three techniques build on each other: thematic analysis reveals what happened, content analysis shows how often it happened and narrative analysis explains why it happened. Together, they transform qualitative observations (see figure above).

The ENISA Cybersecurity Exercise Methodology

5.1.2 Techniques to analyse quantitative data

PRO-TIP

Quantitative data from your exercise – response times, success rates and compliance scores – tell a

Selecting the right analysis

numerical story about performance. However, raw

technique

numbers alone do not provide insights. You need Before diving into statistics, ask appropriate analytical techniques to transform data yourself these questions into actionable findings. • What questions am I trying to The table below presents three statistical answer? approaches, progressing from basic to advanced. • What type of data do I have Choose techniques based on your evaluation (counts, times, percentages)? questions and available data. The table includes • How much data have I collected? descriptions of these methods and provides • What level of statistical expertise example insights. is available?

Technique Purpose When to use Example application

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Using these techniques to process the quantitative datasets PRO-TIP stemming from the evaluation tools ensures a comprehensive Common pitfalls to avoid understanding of performance, • Overanalysing small datasets (fewer than 30 data points) identifies areas for improvement • Confusing correlation with causation and informs strategic decisions to enhance cybersecurity resilience. • Ignoring practical significance for statistical significance • Using complex analyses when simple ones would suffice • Remember: the goal is not to use the most sophisticated technique, but to extract meaningful insights that improve future exercises and cybersecurity readiness.

5.2 Reporting

The AAR helps move from evaluation findings to actionable improvements. This involves meticulously documenting outcomes, insights and recommendations to ensure clarity, accuracy and relevance for all stakeholders.

The AAR uses the traffic light protocol (TLP) to control information distribution, ensuring sensitive findings reach only appropriate audiences.

• Red: the AAR is not for disclosure and is restricted to participants only. • Amber: the AAR is for limited disclosure, restricted to participants’ organisations. • Green: the AAR is for limited disclosure, restricted to the community and not to be shared through public channels. • Clear: the AAR’s disclosure is not limited and it may be distributed with no restrictions, subject to standard copyright rules.

An AAR is a structured document outlining the critical aspects of a cybersecurity exercise. It identifies strengths and weaknesses and informs the audience about required improvements to be implemented. The structure varies based on the TLP type and organisational goals. Typically, an AAR includes the following parts:

• Executive summary. This section provides a brief overview of the organisation, as well as a summary for senior management, highlighting key findings and strategic recommendations. • Exercise overview. This part documents essential information, including the exercise’s name and date, its scope, core capabilities, objectives, the scenario employed, participating organisations and points of contact. • Methodology. Here, the format of the exercise (i.e. the type of exercise, the evaluation criteria, the data analysis methodology) is described, along with a list of tools, software and technologies utilised during the exercise. • Findings and lessons identified. This part documents the most critical lessons identified from the cybersecurity exercise, including key findings and takeaways. • Moving forward. Recommendations for future iterations are provided here to address the gaps identified during the exercise. This includes specific, actionable suggestions to rectify the weaknesses uncovered.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Internal AARs (TLP red and amber) should include detailed evaluation sections with performance metrics and achievement ratings, while external versions (TLP green and clear) should provide summarised findings to protect sensitive information. Regardless of TLP classification, the AAR’s length and detail level will reflect the exercise’s complexity and scope. A sample AAR template is included in the support toolkit.

5.3 Deliverables check: evaluation phase

At this stage of the process, the evaluation phase is finalised, resulting in a complete and actionoriented AAR.

SECTION 6

Moving Forward

The ENISA Cybersecurity Exercise Methodology Version: 1.0

6. Moving Forward 6.1 Disseminate the exercise results

Effective dissemination of exercise results transforms a one-time event into lasting organisational improvement. Without proper dissemination, valuable insights remain confined to a small group, limiting the exercise’s impact and return on investment.

Findings and insights from the AAR should inform future actions and strategies; organisations should use these findings to develop action plans to mitigate vulnerabilities, refine policies, enhance training and allocate resources efficiently. Therefore, dissemination serves three critical purposes:

• Accountability demonstrates to stakeholders that resources were well spent and objectives were met; • Learning shares lessons across the organisation to prevent future incidents; • Action creates momentum for implementing recommended improvements.

Successful dissemination requires tailoring your approach to each audience’s needs, interests and preferred communication channels. Some key audience to reach and the specific objectives for disseminating results with them are as follows.

• Exercise players. Understand their performance and areas for improvement. • Exercise planners. Learn from results to enhance their planning skills. • Exercise observers. Identify gaps and provide constructive feedback. • Rest of the organisation. Increase awareness of cybersecurity risks and mitigation strategies. • Press. Report outcomes and educate the public on cybersecurity awareness. • General public. Stay informed about cybersecurity threats. • Management board. Convince investors of the exercise’s value and the importance of investing in cybersecurity.

The following table presents appropriate dissemination tools for each stakeholder group, helping planners select the most effective communication methods. These tools should be incorporated into the communication plan started during the design phase.

The ENISA Cybersecurity Exercise Methodology

Dissemination Audience Audience type Description tool

The ENISA Cybersecurity Exercise Methodology Version: 1.0

6.2 Act on the findings

The final step in the exercise life cycle is transforming the raw data from the AAR into concrete, measurable improvements. This process requires action on the following two types of primary, interconnected post-exercise findings that are critical for enhancing both organisational resilience and the quality of future exercises.

• Findings linked to the exercise objectives. These findings identify weaknesses, gaps and failures in the organisation’s capabilities, processes or technologies tested during the scenario. Corrective actions here aim to fix the root cause of the security problem. • Findings linked to the exercise execution experience. These findings relate to the quality and efficiency of the exercise itself, such as clarity of roles, timeliness of injects or communication issues between players and the exercise control team. Actions here aim to improve future iterations of the exercise.

Both types of findings directly influence the organisation’s capacity-building programme. Action may involve introducing new training activities to address skill gaps or modifying existing activities to enhance participant effectiveness and learning outcomes.

THE IMPACT ON THE CAPACITY BUILDING PROGRAM

A common and critical action point resulting from both streams of findings is the dynamic update of the organisation's capacity-building programme. • Objective-linked findings: If the findings reveal a skills or capability gap, new training events or capacity-building activities must be immediately included in the programme. • Experience-linked findings: These lessons should lead to changing the approach to how exercises are planned, conducted and evaluated across the entire portfolio of capacity-building activities. Additionally, once corrective actions (including new training) have been implemented, a replay of the exercise is a best practice for testing the effectiveness of these fixes. This replay should also be included in the capacity-building programme planning.

To systematically address both types of findings, organisations should follow a structured approach.

Steps to create an effective action plan

Following the identification of findings across the two streams (exercise objectives and exercise experience), the next crucial stage is to develop and execute an action plan. This plan incorporates all necessary corrective actions and improvements, ensuring that they are efficiently managed and ultimately successful in enhancing organisational resilience and the quality of the capacity-building programme.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Step 1: Identify and prioritise improvements

This initial stage involves systematically reviewing all findings from the AAR and feedback sessions, and then prioritising them based on impact and urgency. ▪ Review findings. Consolidate all identified weaknesses, gaps and areas for improvement from the AAR and feedback sessions. ▪ Prioritise actions. Evaluate each finding based on its impact, severity and ease of implementation. Prioritise actions considering factors such as criticality, quick wins and strategic alignment. This will result in an ordered list of improvements to address.

Step 2: Determine scope and ownership

Once prioritised, each improvement needs a clear scope and a responsible party to drive its resolution. ▪ Define scope of action. Classify each improvement according to its primary purpose. ◦ Organisational changes. Actions focused on fixing root causes, such as updating procedures, implementing new technologies or adjusting capacity. ◦ Capacity-building programme adaptations. Actions focused on improving skills and readiness, such as planning new training events or improving the quality and efficiency of future exercises. ▪ Assign ownership. For every action item, clearly designate an owner who will be responsible and accountable for its progress and successful completion (for complex initiatives, consider using a ‘RACI’ (responsible, accountable, consulted and informed) matrix to define roles).

Step 3: Develop the action plan

This step converts prioritised improvements into a concrete implementation plan with clear timelines and responsibilities. ▪ Outline specific tasks. Break down each improvement into manageable, specific tasks required for implementation. ▪ Agree on deadlines. Set clear and realistic deadlines for the completion of each task. ▪ Create the plan. Document all tasks, owners and deadlines to form a verifiable roadmap for implementation.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Step 4: Follow-up and verification

This is the ongoing step to ensure that planned actions are actually implemented and that their effectiveness is verified, preventing actions from being forgotten. ▪ Regular follow-ups. Conduct periodic reviews to monitor the progress of all action items against their established deadlines and ensure that owners are consistently driving implementation. ▪ Measure effectiveness. Evaluate whether the implemented actions have achieved their intended improvements (e.g. through a subsequent exercise replay). ▪ Adapt and evolve. Adjust the approach based on observed results and evolving circumstances, ensuring that the organisation’s security posture and exercise programme are continuously improved.

This step-by-step process systematically evaluates feedback, analyses the scope for improvements and determines the appropriate level of escalation. By following this approach, organisations ensure that their cybersecurity exercises and portfolios remain effective and aligned with strategic objectives, and are continuously improved.

6.3 Deliverables check: moving forward phase

At this stage of the process, all main deliverables should be finalised and we are ready to start taking action in line with the findings and recommendations included in the AAR.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Conclusions

The ENISA Cybersecurity Exercise Methodology represents a significant step forward in empowering organisations across Europe to build up and strengthen their cybersecurity resilience through systematic, well-structured exercises. By providing a comprehensive framework that guides planners from initial concept through to actionable improvements, this methodology transforms the complex task of exercise organisation into a manageable, repeatable process.

Throughout this document, we have outlined a clear pathway: from understanding why an exercise matters, through careful design and preparation, to effective execution and meaningful evaluation. Each phase builds upon the previous one, creating a cohesive approach that ensures that exercises deliver tangible value; that is, they are not just one-time events, but catalysts for lasting organisational improvement.

The journey continues

This publication marks a beginning, not an end point. The cybersecurity landscape evolves continuously, and so must our approaches to preparedness. We recognise that the true strength of this methodology lies not just in the framework presented here, but in the collective wisdom and practical experience of the cybersecurity exercise community across Europe and beyond.

We invite you – whether you are an experienced exercise planner or organising your first event – to contribute to the evolution of this methodology. Share your lessons learnt, your innovative approaches, your challenges overcome. Help us populate the support toolkit with real-world examples, practical tools and proven materials that will benefit the entire community.

Embracing innovation while preserving excellence

As we look to the future, we acknowledge that emerging technologies, particularly AI, will play an increasingly important role in exercise planning and execution. AI-powered tools promise to automate routine tasks, accelerate scenario development, enhance data analysis and streamline administrative processes. These innovations will undoubtedly make exercise planning more efficient and accessible to organisations of all sizes.

However, we remain firmly convinced that the human element – the expertise, judgement, creativity and experience of skilled planners – will always be central to delivering truly effective cybersecurity exercises. Technology can enhance our capabilities, but it cannot replace the nuanced understanding of organisational culture, the ability to adapt to unexpected developments or the wisdom to interpret results within their proper context. The most valuable exercises will always be those that combine technological efficiency with human insight, ensuring that every activity meets the highest standards of quality and relevance.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

‘In cybersecurity, preparedness is not achieved through perfection, but through the continuous commitment to learn, adapt and improve.’

The ENISA Cybersecurity Exercise Methodology Version: 1.0

ANNEX A: Glossary

After-Action Report (AAR): A comprehensive document that captures exercise outcomes, findings, lessons identified, and recommendations for improvement. Artifact: digital or physical evidence collected during an exercise for analysis and evaluation purposes. Blue team: defensive security team responsible for protecting systems and responding to simulated attacks during an exercise. Briefing: a structured session in which participants receive essential information about the exercise before its execution. Capability: a measurable skill, process or resource that enables an organisation to achieve specific cybersecurity objectives. Capability target: the desired level of performance or maturity for a specific capability being tested during an exercise. Cold Wash: A feedback session some days / weeks after the exercise, by when participants had the time to reflect and process with some distance the experience during the exercise. Communication plan: a structured document outlining how information will be shared with stakeholders throughout the exercise life cycle. Compliance: adherence to relevant laws, regulations, standards and internal policies related to cybersecurity. Core capability: a fundamental skill or process directly addressing the playing teams’ actions and responses during an exercise. Cyber range: a controlled virtual environment that simulates IT infrastructure for conducting technical cybersecurity exercises. Debriefing: a structured discussion held after exercise execution to gather immediate feedback and observations from participants. Discussion-based exercise: an exercise type focused on strategic discussions, decision-making and policy evaluation without operational deployment. Drill: a focused exercise designed to test specific procedures or skills in response to particular scenarios. Enabling capability: supporting processes, policies or tools that underpin core team operations during an exercise. European Cybersecurity Skills Framework: a standardised framework defining 12 professional role profiles in cybersecurity across the EU.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Evaluation criteria: standards and benchmarks used to measure exercise performance and achievement of objectives. Evaluation plan: a comprehensive document detailing how the exercise will be assessed, including methods, tools and success criteria. Event: the highest level of scenario structure, representing major campaign themes or attack patterns spanning significant portions of an exercise. Exercise control team: the group responsible for managing exercise execution, delivering injects and maintaining scenario integrity. Exercise plan: a comprehensive blueprint outlining all aspects of the exercise, including objectives, scope, logistics and timeline. Facilitator: an individual who guides exercise flow, delivers scenario elements and manages participant engagement without leading outcomes. Finding: an identified gap, weakness, strength or observation discovered during exercise evaluation. Hotwash: an immediate, informal debriefing session conducted directly after exercise execution to capture initial reactions. Incident: a specific security breach or attack occurring within an event, with defined start and end times. Indicator: an observable metric or measure used to evaluate performance against specific capability targets. Inject: an individual piece of information, prompt or simulated action delivered to players at a specific moment to advance the scenario. Kirkpatrick model: a four-level evaluation framework measuring reaction, learning, behaviour and results. Lessons identified: key insights, strengths, weaknesses and improvement opportunities discovered through exercise evaluation. Lessons learned: a change in personal or organisational behaviour that results from implementing an identified lesson to improve future performance by integrating new knowledge into practice. Master scenario event list: a detailed timeline documenting all events, incidents and injects that drive exercise execution. Metric: a quantitative or qualitative measure used to evaluate performance indicators. Objective: a specific, measurable goal that defines what the exercise aims to achieve. Observer: an individual who monitors and documents participant activities during an exercise without intervening. Operation-based exercise: an exercise type that tests operational procedures and technical capabilities through hands-on simulation.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Planner: an individual responsible for designing, organising and managing the exercise throughout its life cycle. Playbook: a detailed framework that outlines organisation-specific procedures for handling computer security events and incidents. It includes predefined courses of action that provide guidance on detecting, analysing and responding to potential cybersecurity threats. Player: an individual actively participating in the exercise by responding to scenario elements as they would in reality. Players’ guide: a reference document providing participants with essential exercise information including roles, rules and logistics. Red team: security team that simulates adversary actions by conducting controlled attacks during an exercise. Scenario: the narrative framework that defines the simulated situation, including threat actors, timeline and sequence of events. Scope: the defined boundaries of an exercise, including systems, participants, threat scenarios and time frames to be tested. SMART objectives: objectives that are specific, measurable, achievable, relevant and time bound. Stakeholder: any individual, team or organisation with interest in or influence over the exercise. State of the world: background context describing relevant events and conditions leading up to the exercise scenario. Storyline: the narrative sequence detailing what will happen during the exercise execution. Tabletop exercise: a discussion-based exercise in which participants analyse and respond to simulated scenarios through collaborative dialogue. Threat actor: the simulated adversary or attacker represented in the exercise scenario. Threat intelligence: information about potential or current cyber threats used to inform scenario development and organisational defence. Timeline: the schedule of activities and milestones throughout the exercise planning and execution life cycle. Traffic light protocol: a standardised system for classifying information sensitivity (clear, green, amber, red) to control distribution.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

ANNEX B: Key deliverables

Exercise Plan

The exercise plan outlines the details of the cybersecurity exercise, serving as a blueprint for its execution. The exercise plan ensures that all participants understand the exercise’s purpose, expected outcomes and operational procedures, creating a cohesive strategy for success. It includes:

• Practical details – the execution date and related timelines, and the difficulty level; • Logistics and resources – details on locations, required equipment and budget allocation; • Purpose and objectives – clearly defined and measurable purpose and objectives; • Project plan – a description of phases and milestones; • Roles and responsibilities – identification of participants, facilitators and evaluators, along with their specific roles; • Scope and scenario – the extent of the exercise, including systems, processes and personnel involved.

Evaluation Plan

The exercise evaluation plan includes all the necessary information and practical insights for planners to proceed with the evaluation of an exercise. It includes:

• Participant roles and responsibilities – including those of the evaluators, the people evaluated, recipients of the reports and the evaluation team; • Capability targets – for a large or operation-based exercise, the capability targets to be tested during the exercise; • Exercise evaluation tools and methodology – including for data collection, analysis and assessment, and reporting; • Evaluation timeline – including a visual timeline covering before, during and after the exercise, and a dissemination plan.

Communications Plan

Effective communication with internal and external stakeholders is crucial for the success of cybersecurity exercises. It ensures that all parties are informed, engaged and aligned with the exercise objectives. The communication plan includes practical chronological steps for maintaining robust communication throughout planning, preparation, execution and post-exercise activities. It emphasises reaching the right stakeholders using their preferred channels and securing buy-in for continuous improvement. The table below presents the details of the communication plan.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

Master Scenario Event List

The MSEL outlines the sequence of events and injects that drive the exercise, ensuring a structured and realistic simulation of cyber incidents. The MSEL can vary significantly depending on the exercise type, with tailored events and injects to suit discussion-based or operation-based exercises. It includes:

• Events – a list of the events planned during the exercise; • Incidents – a list and practical details of all incidents related to the events planned during the exercise; • Injects – individual pieces of information, prompts or simulated actions delivered to players at a specific moment to advance the scenario.

After-Action Report

The AAR documents the outcomes of the exercise. The AAR ensures that the exercise’s insights are captured, leading to continuous improvement and refinement of the organisation’s cybersecurity preparedness. It includes:

• Findings and observations – analysis of participant performance; • Lessons identified – key takeaways to enhance future exercises; • Recommendations – actionable suggestions for improvement; • Performance metrics – evaluation of objectives met, supported by data.

The ENISA Cybersecurity Exercise Methodology

ANNEX C: From objectives to capabilities

C.1 Objective themes

Further to the information included in the document on defining objectives, here is a table of objective themes to serve as inspiration for defining specific objectives.

The ENISA Cybersecurity Exercise Methodology

C.2 Capabilities

For more complex exercises, objectives are not enough to capture and evaluate the specific activities expected from the different teams participating in the exercise.

Capabilities serve as the critical bridge between high-level organisational objectives and the concrete actions of teams and individuals. While an objective defines what the entire organisation aims to achieve (e.g. enhance incident response time), a capability breaks this down into measurable actions for specific teams or individuals. One single objective can be tested through multiple capabilities, each assigned to different teams that must carry out their specific responsibilities during the exercise.

There are two types of capabilities, as follows.

• Core capabilities. These directly address the participants and focus on evaluating their actions, reactions and knowledge during the exercise. They assess how effectively participants respond to a scenario. • Enabling capabilities. These focus on testing the underlying processes, policies and tools that support the core teams. They ensure that the foundational elements of the response are robust.

To facilitate precise evaluation, each capability can be linked to maturity targets that can be assessed through the exercise.

The ENISA Cybersecurity Exercise Methodology Version: 1.0

SAMPLE MATURITY TARGETS

Finally, to measure these targets, indicators are used. These are specific, observable metrics that guide the evaluation team on what to capture during the exercise to verify the achievement of a capability. Indicators provide the necessary link between a capability and the evaluation tools used to measure its success.

The figure below presents a summary of the journey from objectives to capabilities, indicators and metrics.

The ENISA Cybersecurity Exercise Methodology

ANNEX D: ECSF roles in the scope of exercises

The table below presents ECSF roles mapping with various exercise activities carried out by different participants of an exercise. For each exercise team, the mission is presented, the different ECSF roles that could fit on the team are mapped, and responsibilities are specified depending on a planner or player role.

Cybersecurity incident response team

The ENISA Cybersecurity Exercise Methodology

Cybersecurity engineering team Cybersecurity capacity building team Legal team

The ENISA Cybersecurity Exercise Methodology

Risk management team

Other relevant profiles to include in cybersecurity exercises are presented in the table below.

The ENISA Cybersecurity Exercise Methodology

The ENISA Cybersecurity Exercise Methodology

-N -EN -028 -25 -01 TP ABOUT ENISA

The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its Member States, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

ENISA

European Union Agency for Cybersecurity

Athens Office

Agamemnonos 14 Chalandri 15231, Attiki, Greece

Brussels Office

Rue de la Loi 107 1049 Brussels, Belgium

enisa.europa.eu