Incident response guide

Incident Response Drill: What It Is and How to Run One

An incident response drill is a planned rehearsal of your incident response plan using a made-up incident. People practise their roles and decisions under time pressure, and you learn which steps, contacts and tools fail while the stakes are low. Some drills are discussion only (a tabletop); others have people carry out a real procedure such as restoring a backup.

Below: the types of drill, a 90-minute format you can run this month, what to measure and record, and the free PlayCISO tools that do the preparation. Last reviewed 3 November 2026. General guidance, not a substitute for your own plan.

Updated 3 November 2026

Types of drill

Names differ between organisations, so agree the meaning before you plan. These are working definitions for this guide.

Type	What people do	Best for
Tabletop	Talk through a scenario with a facilitator. No systems touched.	Decisions, roles, escalation and communications. See tabletop exercises.
Procedure drill	Practise one task for real: page the on-call lead, isolate a test host, restore a backup, rotate a key.	Proving a runbook step works and takes the time you assumed.
Simulation	Play a scripted incident in a safe environment, such as the Cyber War Room or the IR Playbook Lab.	Practising under pressure without building your own scenario.
Full exercise	Responders use real tools and systems against a realistic attack, usually with a red team.	Mature programmes testing detection and response together.

NIST SP 800-84 treats tests, training and exercises as a programme to plan, run and improve, which is a useful frame: start with discussion, add procedure drills, and only then consider larger exercises.

A 90-minute drill you can run this month

Before (1 week). Choose one scenario your organisation could face, name a facilitator who is not the incident lead, and invite everyone with a role in the plan. Generate a script with the tabletop runbook generator, or adapt the ransomware tabletop.
Minutes 0 to 10: rules. Say it is fictional, nobody is being graded, and decisions are made as in a real incident. Name a scribe.
Minutes 10 to 60: the scenario. The facilitator reveals an event, asks "what do you do now, and who do you tell?", then adds a twist every 10 minutes. See the facilitation lab for practice.
Minutes 60 to 80: debrief. What went well, what surprised us, where did we not know who decides.
Minutes 80 to 90: actions. Three to five corrective actions, each with an owner and a date.

If you do not yet have a plan to rehearse, read how to build an incident response playbook and the incident response hub first.

What to measure and record

Time to first decision: from the first alert in the script to someone declaring an incident.
Roles filled: did the incident lead, communications and legal contacts respond, and did people know their own role?
Plan accuracy: steps, phone numbers and tools that were wrong or missing.
Decisions that stalled: who could approve taking a system offline or notifying a regulator?
Actions closed: how many of last drill's actions were finished?

Write the results as a short report: scenario, date, participants, findings, actions. FEMA's exercise programme calls this an After-Action Report and Improvement Plan, and CISA's exercise packages include an After Action Report template. Use the post-incident review template for the structure.

Common mistakes

Treating the drill as a test people can fail. Blame ends honest answers.
Rehearsing only ransomware. Rotate scenarios: account takeover, supplier breach, data leak.
Skipping the business. Legal, communications and an executive decide the hard calls.
Writing actions with no owner or date, then never reviewing them.
Touching production systems in a surprise drill without agreement. Announce procedure drills and use test systems.

Frequently asked questions

What is an incident response drill?

An incident response drill is a planned rehearsal of your incident response plan against a made-up incident, so the people involved practise their roles and you find gaps before a real attack does. Discussion-based drills (tabletops) talk through the response; hands-on drills have people actually do steps such as isolating a host or restoring from backup. Terms vary between organisations, so state which kind you mean.

What is the difference between a drill and a tabletop exercise?

In common usage a tabletop is a facilitated discussion of a scenario around a table, with no systems touched. A drill is narrower and hands-on: it practises one specific procedure, such as paging the on-call lead, restoring a system or revoking credentials. Many teams use "drill" loosely for both. This guide uses tabletop for discussion and drill for practising a procedure.

How often should we run incident response drills?

There is no universal number. NIST SP 800-84 treats tests, training and exercises as a programme to plan and maintain, not a one-off. Pick a rhythm you can keep, such as a short drill each quarter and a larger scenario each year, and run an extra one after major changes to systems, people or the plan.

Who should take part?

Everyone with a role in the plan: the incident lead, IT and security responders, and the people who decide or communicate, such as legal, communications, the business owner and an executive sponsor. CISA’s tabletop exercise packages describe separate roles for planners, facilitators or evaluators, and participants. Observers should not also play.

How long does a drill take?

A focused drill on one procedure can take 30 to 60 minutes. A scenario tabletop with several decision points usually needs 60 to 120 minutes plus time to debrief. These are planning rules of thumb from our experience and not a standard; fit the length to the scenario.

What should we write down afterwards?

Record what happened, what worked, what did not, and a short list of corrective actions with owners and dates. FEMA’s HSEEP calls this an After-Action Report and Improvement Plan, and CISA’s packages include an After Action Report template. The value comes from closing the actions, so review them at the next drill.

Do we need a plan before we run a drill?

A basic plan helps, but a drill is a good way to find out that you do not have one. If the plan is missing, start with a short plan and drill it. NIST SP 800-61 Rev. 3, published April 2025, recommends building incident response into wider cybersecurity risk management using Cybersecurity Framework 2.0.

Can we run a drill without a real scenario?

Yes. Use a made-up scenario based on a threat your organisation actually faces, such as ransomware, a compromised account or a supplier breach. Fictional details keep it safe. Never use real credentials or live production systems in a discussion drill.