{"id":6209,"date":"2026-11-07T11:15:42","date_gmt":"2026-11-07T10:15:42","guid":{"rendered":"https:\/\/www.lablogic.pl\/?p=6209"},"modified":"2026-11-07T11:40:53","modified_gmt":"2026-11-07T10:40:53","slug":"incident-response-exercise","status":"publish","type":"post","link":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/","title":{"rendered":"How to prepare an incident response exercise?"},"content":{"rendered":"\n<p class=\"ll-art-meta wp-block-paragraph\"><a href=\"https:\/\/www.lablogic.pl\/en\/michal-rutkowski\/\"><strong>Micha\u0142 Rutkowski<\/strong><\/a> \u2022 for security teams, DPOs and the board \u2022 published November 7, 2026 \u2022 15 min read<\/p>\n\n\n\n<div class=\"wp-block-columns ll-art-shell is-layout-flex wp-container-core-columns-is-layout-7387b849 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column ll-art-rail is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group ll-art-railinner is-layout-constrained wp-block-group-is-layout-constrained\">\n\n\n\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column ll-art-main is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group ll-art-answer is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 id=\"krotka-odpowiedz\" class=\"wp-block-heading\">Short answer<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An incident response exercise is prepared starting from its objective and from evaluation criteria written down in advance. The objective is the procedure and the decisions that the exercise is to test. The form is chosen to suit the objective, and the participants according to the roles in the procedure. They include a member of the board and the data protection officer, if one has been designated. The facilitator gives out information according to a scenario with an accelerated clock. The scenario forces an assessment of the event under the Act on the National Cybersecurity System (KSC Act) and under the GDPR, and the recording of the time the incident was detected, the time it was classified as significant and the time the breach was established. The exercise takes place without real notifications or communications. It ends with a report setting out corrective actions, their owners and deadlines, and the date of a follow-up check.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The KSC Act does not name an exercise as a separate obligation. It does require an essential or important entity to test business continuity plans, with exceptions for an important entity that is a public entity and for the banking and financial market infrastructure sector. Regulation 2024\/2690 expressly requires the entities it covers, including cloud computing and managed service providers and trust service providers, to test incident response procedures. For an important entity that is a public entity, Annex 4 requires such testing. The banking and financial market infrastructure sector has been testing plans under DORA since 17 January 2025. The GDPR requires, as appropriate, regular testing of the effectiveness of security measures.<\/p>\n<\/div>\n\n\n\n<h2 id=\"dlaczego-pytanie\" class=\"wp-block-heading\">Why this question arises at all<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An incident response procedure is usually written at a desk. Only the first serious event tests it. That is when it turns out that the contact list is out of date and the person who decides on notification is on leave.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Training will usually not catch this. An incident response exercise tests whether people under time pressure actually apply the procedure and whether it works in the organisation as it really is. In particular, it tests whether someone starts the assessment of the event under the KSC Act and under the GDPR and keeps track of deadlines counted from different moments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then there is the calendar. The amendment to the KSC Act was published on 2 March 2026 and entered into force one month later, on 3 April 2026 (Article 49 of the Act of 23 January 2026). Entities that met the criteria for an essential or important entity on that date perform the obligations under Chapter 3 from 3 April 2027 at the latest (Article 33(1) of the amending Act). An entity that becomes subject to the Act later has 12 months from meeting the criteria (Article 16(1) of the KSC Act). Former operators of essential services report significant incidents under the new wording of Articles 11 to 12b from 3 October 2026 at the latest, that is six months after entry into force (Article 33(4) of the amending Act).<\/p>\n\n\n\n<h2 id=\"co-ustalic\" class=\"wp-block-heading\">What has to be established before a decision<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Is an incident response exercise mandatory<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The KSC Act does not list an exercise among the obligations of an essential or important entity. However, the information security management system of such an entity includes three elements that are hard to demonstrate without testing them in practice. The first is the testing of business continuity plans, contingency plans and disaster recovery plans (Article 8(1)(2)(f)). The second is policies and procedures for assessing the effectiveness of technical and organisational measures (point (h)). The third is incident management, which also covers drawing lessons from incident handling (Article 8(1)(4) and Article 2(18)). The Minister of Digital Affairs states that an organisation must have incident management procedures that are implemented, tested and applied in practice (Q&amp;A 3.7). In practice an exercise is the simplest evidence that the procedures have been tested.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Regulation 2024\/2690 and Annex 4 to the KSC Act expressly require incident response procedures to be tested. Article 8(1) of the Act requires the testing of plans, and the GDPR requires the testing of the effectiveness of measures as appropriate.<\/p>\n\n\n\n<figure class=\"wp-block-table ll-art-table\"><table><thead><tr><th>Who<\/th><th>What is tested<\/th><th>Legal basis<\/th><th>Exceptions and limitations<\/th><\/tr><\/thead><tbody><tr><td>Essential or important entity<\/td><td>Business continuity plans, contingency plans and disaster recovery plans; in addition, policies and procedures for assessing the effectiveness of measures<\/td><td>Article 8(1)(2)(f) and (h) of the KSC Act<\/td><td>an important entity that is a public entity, or a designated entity of the higher education and science system that is not a research organisation, applies Annex 4 instead in the scope of its public tasks (Article 8(3)); the banking and financial market infrastructure sector applies only Article 8(1)(1) and (2)(j) (Article 8i(1)), and its testing follows from DORA<\/td><\/tr><tr><td>In addition, entities covered by Regulation 2024\/2690, including cloud computing and managed service providers and trust service providers<\/td><td>Roles, responsibilities and procedures of the incident handling policy, incident response procedures, business continuity and disaster recovery plans, the crisis management plan and the recovery of backup copies<\/td><td>Regulation 2024\/2690, Article 1 and Annex, points 3.1.3, 3.5.5, 4.1.4, 4.2.6 and 4.3.4; Article 8b(1) and (2) of the KSC Act<\/td><td>according to the Minister of Digital Affairs, only in the scope of the activity covered by the Regulation (Q&amp;A 3.47); the entity plans the intervals; the policy and plans are also tested and reviewed after significant incidents and significant changes to operations or risks<\/td><\/tr><tr><td>Important entity that is a public entity and other entities under Article 8(3)<\/td><td>Procedure in the event of a failure or an incident, and backup copies<\/td><td>Annex 4, Part I, points 11 and 12<\/td><td>the Annex does not set a testing frequency; the system is reviewed at least once a year or without delay in the situations listed in Part III<\/td><\/tr><tr><td>Banking and financial market infrastructure sector<\/td><td>ICT business continuity plans, ICT response and recovery plans and crisis communication plans<\/td><td>Article 11(6) of DORA<\/td><td>ICT plans at least yearly and after substantive changes to ICT systems supporting critical or important functions; except for microenterprises, also scenarios of cyber-attacks<\/td><\/tr><tr><td>Controller and processor<\/td><td>Effectiveness of measures for ensuring the security of processing<\/td><td>Article 32(1)(d) GDPR<\/td><td>&#8220;as appropriate&#8221;; testing is to be regular, but the provision does not set its form or intervals<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In the banking and financial market infrastructure sector the exercise tests the reporting of a major ICT-related incident to the relevant competent authority (Article 19(1) DORA) instead of the early warning and notification under the KSC Act. Clients are informed under DORA of a major ICT-related incident that has an impact on their financial interests (Article 19(3)). From the KSC Act, the exercise then covers cooperation with the CSIRT during the handling of a significant incident (Article 8i(1) and Article 11(1)(5)). DORA has applied since 17 January 2025 (Article 64), so this sector does not wait until 2027 to test.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What should an incident response exercise test<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The objective of the exercise is one or two questions to which the organisation does not know the answer today. For example, they may sound like this.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>How much time passes from the first signal to the detection of the incident, to its classification as significant and to the decision on the early warning?<\/li>\n\n\n\n<li>Does the team record separately the time the incident was detected, the time it was classified as significant and the time the personal data breach was established?<\/li>\n\n\n\n<li>Does the board member learn of a significant incident early enough to decide in time?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Objectives are taken from the results of risk assessment, from lessons learnt from incidents and breaches and from the previous exercise.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The KSC Act counts the deadlines for the early warning (24 hours) and for the significant incident notification (72 hours) from the detection of the incident (Article 11(1)(4) and (4a)). According to the Minister of Digital Affairs, the moment of detection is when the entity can establish that the event is an incident (Q&amp;A 6.5). An incident is classified as significant on the basis of thresholds (Article 11(1)(3)). For entities covered by Regulation 2024\/2690 the thresholds are set by that Regulation (Article 3 of the Regulation and Article 11(4) of the KSC Act). It is safer to count the deadlines from detection as the Minister understands it. Recital 31 of Regulation 2024\/2690 nevertheless links the start of the deadline to the moment when, after an initial assessment, the entity it covers has a reasonable degree of certainty that a significant incident has occurred. It is therefore worth recording both times. The controller notifies a personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it (Article 33(1) GDPR). It does not notify it when the breach is unlikely to result in a risk to the rights and freedoms of natural persons.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Evaluation criteria are written down before the exercise. A criterion states what is to happen, by which scenario time and who will confirm it. An example is the decision on the early warning, taken and recorded by the person named in the procedure within the time the procedure sets, with a margin for submitting the warning before 24 hours have elapsed. The observer counts this time from the scenario moment at which the participants received information allowing them to establish an incident. On the GDPR side a criterion may concern the recorded risk assessment and the decision on notification. A notification made to the President of UODO after 72 hours is accompanied by reasons for the delay (Article 33(1) GDPR). A few criteria are better than a dozen, and an unmet criterion is also a result.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An important entity that is a public entity does not submit the early warning or reports, only the significant incident notification (Article 12c and Q&amp;A 6.12). In an exercise for such an entity the deadline criterion on the KSC Act side therefore concerns the notification within 72 hours of detection. A trust service provider reports a significant incident within 24 hours of detection (Article 11(1a)).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Which form of exercise to choose<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The law does not set the form of the exercise. In practice three forms are used, which differ in cost and in what they test.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Tabletop exercise.<\/strong> Participants receive successive information about the event and say what they will do and who will decide. It does not touch systems. It tests roles, escalation, the classification of the event and decisions on notifications.<\/li>\n\n\n\n<li><strong>Functional exercise.<\/strong> Participants carry out actions as they would in a real event. They call people warned about the exercise, register the event in the service ticketing system and fill in the form templates for the CSIRT and the President of UODO without sending them. It tests tools, the availability of people and the real time actions take. It also tests whether the persons named in the procedure have access to the S46 system, through which the early warning and the notification are submitted (Article 11(2) of the KSC Act).<\/li>\n\n\n\n<li><strong>Technical test.<\/strong> Restoring a system from a backup copy or switching over to backup resources. It tests the disaster recovery plan, the backup copies and part of the business continuity plan. What is measured is the time until the service works, not until the restoration of the backup is complete.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">I recommend starting with a tabletop exercise. It is inexpensive, and the board member does not necessarily take part in the whole exercise. They join when the team calls them in under the escalation procedure, and the observer records the time of the call.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who takes part in the exercise<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Participants are chosen according to the roles in the procedure, not according to job titles. An exercise of the whole path usually involves these roles.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The person who runs the case and keeps track of the chronology.<\/li>\n\n\n\n<li>The person who decides on technical actions.<\/li>\n\n\n\n<li>The persons who prepare the classification and the notification to the CSIRT, including those designated to maintain contacts with the entities of the national cybersecurity system (Article 9(1)(1) of the KSC Act).<\/li>\n\n\n\n<li>The data protection officer, if one has been designated.<\/li>\n\n\n\n<li>The person who decides on behalf of the controller on notifying the breach to the President of UODO and on communicating it to data subjects.<\/li>\n\n\n\n<li>The board member or head of the organisation who takes the decisions reserved for management.<\/li>\n\n\n\n<li>The external monitoring team, if it is the one to detect the event.<\/li>\n\n\n\n<li>The person responsible for communication with clients and service users.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The board&#8217;s tasks justify its participation. The head of an essential or important entity takes decisions on the information security management system and supervises the performance of the tasks assigned (Article 8d(1) and (3)). The head is also responsible for the obligations under Articles 11 to 12b among others, including where they have been entrusted to another person with that person&#8217;s consent (Article 8c(1) and (3)). Where the head is a collective body and no responsible person has been designated, all its members are responsible (Article 8c(2)). The scenario should require a real decision from the board, for example on shutting down a service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The controller and the processor ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data (Article 38(1) GDPR). The officer advises (Article 39(1)(a)), and the controller decides on notifying the breach (Article 33(1)).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The exercise also has a facilitator and an observer. The facilitator gives out successive information and keeps track of time. The observer records the times of decisions and the roles that took them, and with external monitoring separately the time of the alert and the time it was acknowledged. A larger group needs someone to play the external parties, for example the CSIRT, a supplier and the media. The facilitator may be an outside person who signs a confidentiality undertaking.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the scenario assumes that information about the event will come from a supplier, it is worth inviting the supplier as well. According to the Minister of Digital Affairs, contracts with suppliers should include an obligation to inform promptly of an incident related to the supplier&#8217;s service (Q&amp;A 6.5). The supplier&#8217;s participation in the exercise has to be agreed in advance, and ideally written into the contract. Where the supplier processes personal data on behalf of the organisation, the exercise also tests whether it notifies the organisation of the breach without undue delay (Article 33(2) GDPR).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How to write an incident response exercise scenario<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The scenario is based on an event that could happen in this organisation. A good starting point is the risk rated highest in the latest risk assessment or an incident that the organisation has already been through. The scenario consists of successive pieces of information given to the participants at set times.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is worth including five elements in the scenario.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>An ambiguous start.<\/strong> The first signal is an alert from monitoring or a phone call from a supplier, not a ready diagnosis. The participants themselves establish when the event became an incident and record that time. The observer compares it with the time at which the participants received the information that allowed them to establish this.<\/li>\n\n\n\n<li><strong>Personal data revealed later.<\/strong> After a few hours it turns out that the event has affected client or employee data. The team then starts the breach assessment under Articles 33 and 34 GDPR without interrupting the handling of the incident. Where the organisation processes the data as a processor, it notifies the controllers without undue delay (Article 33(2)). The risk assessment and the notification to the President of UODO are theirs.<\/li>\n\n\n\n<li><strong>Night or weekend.<\/strong> Part of the scenario time falls outside working hours. The participants say whom they would reach at that time and how. A separate test outside working hours checks whether people can actually be reached.<\/li>\n\n\n\n<li><strong>Incomplete knowledge at the time of notification.<\/strong> The participants prepare the notification with the information available at that moment. The KSC Act requires the information known at the time of the significant incident notification to be provided and then supplemented during the handling of the incident (Article 12(5)). The GDPR allows the information to be provided in phases without undue further delay where, and in so far as, it is not possible to provide it at the same time (Article 33(4)).<\/li>\n\n\n\n<li><strong>Loss of the primary channel.<\/strong> At some point email and the messaging tool stop working. The team uses the backup channel, printed copies of the procedure and the contact list.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Regardless of personal data, the team assesses whether the significant incident adversely affects the provision of services. If so, it informs the service users about it (Article 11(2b) of the KSC Act).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The scenario clock usually runs faster than real time, so a day of the event fits into a few hours of the exercise. The facilitator announces the scenario time, and the observer records decisions against it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The reference point for assessing decisions is the organisation&#8217;s procedure. The order of actions in the first 24 hours and the deadlines in both regimes are covered in <a href=\"https:\/\/www.lablogic.pl\/en\/what-to-do-after-detecting-an-incident\/\">What to do after detecting an incident?<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How to plan the preparations<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The board approves the objective, the date and the list of roles several weeks in advance. The participants block their calendars straight away, and a deputy from the procedure is named for any absence. The participants do not know the scenario.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The facilitator prepares a run plan. It links the scenario times, the successive pieces of information, the expected decisions and the evaluation criteria. The observer receives a sheet with the same criteria. The participants have with them what they would use for real. These are the procedure, the contact list and the notification form templates prepared outside production systems. A few days in advance, the facilitator rehearses the scenario with the observer.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How to run the exercise safely<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Every document and every message in the exercise is marked &#8220;EXERCISE&#8221;. Before the start, the people who may receive a message from the exercise are informed, including the external monitoring team. Someone outside the exercise is on duty during this time. A real event takes priority, and the decision to stop the exercise rests with the facilitator, who uses a code word agreed at the start.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">No early warning, significant incident notification or breach notification is sent to the CSIRT or to the President of UODO. No communications to service users or to data subjects are sent either. The participants fill in the form templates outside the S46 system and outside the UODO form. The procedure should state which channel the organisation uses to notify a breach. An essential or important entity that is a controller may also notify a breach through S46 if it already uses the system (Article 46(1)(7)). According to the Minister of Digital Affairs this route is optional (Q&amp;A 7.7).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The scenario does not need real personal data. A description of the categories of data and the number of persons is enough. The technical test is carried out in a maintenance window, in an isolated network or in a test environment, with a fallback plan in case the restoration fails. A restored backup usually contains real personal data, so the test environment is given a level of security appropriate to the risk (Article 32(1) GDPR). It is worth marking the records of the exercise so that they do not end up in the breach register or in the incident records. The exception is a real effect, for example a loss of availability of data when a restoration fails. The facilitator then stops the exercise, and the event is handled and documented like any other.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What to record after an incident response exercise<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The debrief takes place right after the exercise. It establishes what worked, what did not and what changes. The report is drawn up within a few days and contains fixed elements.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The objective and the evaluation criteria adopted before the exercise.<\/li>\n\n\n\n<li>The date, the form of the exercise and the plan tested.<\/li>\n\n\n\n<li>The scenario and the participants by role.<\/li>\n\n\n\n<li>The chronology of decisions in scenario time.<\/li>\n\n\n\n<li>The assessment of each criterion.<\/li>\n\n\n\n<li>Corrective actions with an owner and a deadline.<\/li>\n\n\n\n<li>The date of the follow-up check.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The run plan with the date it was drawn up, the observer&#8217;s sheet and the attendance list are attached to the report.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The lessons usually change the procedure, the contact list or contracts with suppliers. A changed procedure is marked with a new version (Article 10(6)(3)). Regulation 2024\/2690 requires the entities it covers to ensure that the business continuity plan and the disaster recovery plan incorporate lessons learnt from tests (point 4.1.4). These entities document the results of tests of the recovery of backup copies and, where needed, take corrective action (point 4.2.6). Corrective actions go into the action register that the organisation already keeps. The next exercise starts by checking whether they were carried out and whether they removed the cause. It is worth presenting the report to the board for approval of the actions and deadlines.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Where a plan or the incident handling procedure provides for a test, the report on it is operational documentation (Article 10(1), (3) and (4)) also in an important entity that is a public entity. Such an entity additionally documents its actions under Annex 4 (Part IV). In my assessment Article 10 does not apply in the banking and financial market infrastructure sector (Article 8i(1) and Q&amp;A 14.2). There, the results of tests are taken into account in reviews of the plans (Article 11(6) DORA). On the GDPR side the report helps to demonstrate the testing of the effectiveness of measures (Article 24(1) and Article 32(1)(d)).<\/p>\n\n\n\n<div class=\"wp-block-group ll-art-zdanie is-layout-constrained wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\">Remember<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The report assesses how roles and the procedure worked, not individual people.<\/p>\n\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Named assessments of participants are personal data of employees and are usually not needed for the lessons.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How often to exercise and whether an exercise replaces training<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Only DORA expressly sets the intervals between tests (Article 11(6)). Regulation 2024\/2690 requires the entities it covers to test incident response procedures at planned intervals (point 3.5.5). For a medium-sized or large organisation I recommend at least one incident response exercise a year covering the whole path. It is worth holding an additional exercise after a significant incident, a change of procedure or a reorganisation. For entities covered by Regulation 2024\/2690 a test after a significant incident or a significant change to operations or risks is an obligation. It covers the roles, responsibilities and procedures of the incident handling policy (point 3.1.3). It also covers the business continuity and disaster recovery plans and the crisis management plan (points 4.1.4 and 4.3.4).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The head of the entity and the person entrusted with the head&#8217;s obligations in the field of cybersecurity undergo training once in each calendar year (Article 8e(1)). An incident response exercise may be part of that training. The attendance list from the report may then document participation in the training (Article 8e(3)). Yet an exercise limited to incident handling will not cover the whole scope of Article 8e(2). That scope includes Article 8, Article 14 and Article 15 among others. A decision-making exercise as part of the board training programme is covered in <a href=\"https:\/\/www.lablogic.pl\/en\/what-should-nis2-training-for-the-board-cover\/\">What should NIS2 training for the board cover?<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An exercise does not replace education of all personnel either (Article 8(1)(2)(i)). In an important entity that is a public entity it does not replace the training under Annex 4 (Part I, point 17) either.<\/p>\n\n\n\n<div class=\"wp-block-group ll-art-board is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 id=\"zarzad\" class=\"wp-block-heading\">What should the board know?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before the exercise, the board approves the objective, the date and the list of roles and names a deputy for the decision-maker. I recommend that the board member who decides on incidents takes part in at least one exercise a year. The cost is mainly the time needed for preparation, usually longer than the exercise itself, and possibly an external facilitator. The head of an essential or important entity plans adequate financial resources for the performance of cybersecurity obligations (Article 8d(2)). An exercise serves to test plans and procedures, so it is worth including its cost in those resources. After the exercise the board asks how many criteria were met and what changes, and then follows up on the deadlines for the actions.<\/p>\n<\/div>\n\n\n\n<h2 id=\"najczestsze-bledy\" class=\"wp-block-heading\">Common mistakes<\/h2>\n\n\n\n<ul class=\"wp-block-list ll-art-errors\">\n<li><strong>The best people take part instead of the deputies.<\/strong> The exercise then does not test leave or the night.<\/li>\n\n\n\n<li><strong>The facilitator is the author of the procedure.<\/strong> The author then tends to defend the procedure instead of testing it.<\/li>\n<\/ul>\n\n\n\n<h2 id=\"wnioski\" class=\"wp-block-heading\">Conclusions and next steps<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In an entity outside the banking and financial market infrastructure sector that met the criteria on 3 April 2026 and was not an operator of an essential service, it is worth holding the first exercise of the KSC Act path at the beginning of 2027. The lessons will then have time to change the procedure before 3 April 2027, and it is worth starting the preparations in 2026. A former operator of an essential service outside that sector reports significant incidents under the new rules, so it is worth holding the exercise straight away. The GDPR path can be exercised now.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Choose the procedure and decisions that the exercise is to test, and write down the evaluation criteria. Present them to the board together with the date and the list of roles.<\/li>\n\n\n\n<li>Appoint the facilitator and the observer, then write a scenario with the five elements and a run plan.<\/li>\n\n\n\n<li>Agree the safety rules of the exercise, including duty cover outside the exercise and form templates instead of sending.<\/li>\n\n\n\n<li>After the exercise, present to the board the report with the actions, owners and deadlines.<\/li>\n\n\n\n<li>Put the date of the follow-up check and the next exercise into the plan for the coming year.<\/li>\n<\/ol>\n\n\n\n<h2 id=\"materialy-powiazane\" class=\"wp-block-heading\">Related materials<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/what-to-do-after-detecting-an-incident\/\"><strong>What to do after detecting an incident?<\/strong><\/a> \u2014 the order of actions in the first 24 hours and the parallel deadlines.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/what-does-a-significant-incident-report-to-a-csirt-contain\/\"><strong>What does a significant incident report to a CSIRT contain?<\/strong><\/a> \u2014 the content of the early warning, the notification and the reports.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/annual-training-plan\/\"><strong>How to build an annual training plan for the GDPR and NIS2?<\/strong><\/a> \u2014 the place of the exercise in the calendar year.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/how-to-measure-training-effectiveness\/\"><strong>How do you know that training produced a real effect?<\/strong><\/a> \u2014 measures of effect instead of measures of activity.<\/li>\n<\/ul>\n\n\n\n<h2 id=\"zrodla\" class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list ll-art-sources\">\n<li>Regulation (EU) 2016\/679 of the European Parliament and of the Council (GDPR) \u2014 Article 24(1), Article 32(1), Article 33(1), (2) and (4), Article 34, Article 38(1) and Article 39(1)(a) \u2014 <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A02016R0679-20160504\" target=\"_blank\" rel=\"noreferrer noopener\">eur-lex.europa.eu<\/a>.<\/li>\n\n\n\n<li>Act of 5 July 2018 on the National Cybersecurity System, consolidated text as at 18 August 2026 \u2014 Article 2(18), Article 8(1) and (3), Article 8b(1) and (2), Article 8c, Article 8d, Article 8e, Article 8i(1), Article 9(1), Article 10(1), (3), (4) and (6), Articles 11 to 12c, Article 14, Article 15, Article 16, Article 46(1) and Annex 4 (in Polish) \u2014 <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/DocDetails.xsp?id=WDU20180001560\" target=\"_blank\" rel=\"noreferrer noopener\">isap.sejm.gov.pl<\/a>.<\/li>\n\n\n\n<li>Act of 23 January 2026 amending the Act on the National Cybersecurity System and certain other acts (Journal of Laws 2026, item 252) \u2014 Article 33(1) and (4) and Article 49 (in Polish) \u2014 <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/DocDetails.xsp?id=WDU20260000252\" target=\"_blank\" rel=\"noreferrer noopener\">isap.sejm.gov.pl<\/a>.<\/li>\n\n\n\n<li>Commission Implementing Regulation (EU) 2024\/2690 of 17 October 2024 \u2014 recital 31, Article 1, Article 3 and Annex, points 3.1.3, 3.5.5, 4.1.4, 4.2.6 and 4.3.4 \u2014 <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32024R2690\" target=\"_blank\" rel=\"noreferrer noopener\">eur-lex.europa.eu<\/a>.<\/li>\n\n\n\n<li>Regulation (EU) 2022\/2554 of the European Parliament and of the Council (DORA) \u2014 Article 11(6), Article 19(1) and (3) and Article 64 \u2014 <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32022R2554\" target=\"_blank\" rel=\"noreferrer noopener\">eur-lex.europa.eu<\/a>.<\/li>\n\n\n\n<li>Minister of Digital Affairs, National Cybersecurity System \u2014 questions and answers on the amendment of the KSC Act, update of October 2026 \u2014 Q&amp;A 3.7, 3.47, 6.5, 6.12, 7.7 and 14.2 (in Polish) \u2014 <a href=\"https:\/\/cyber.gov.pl\/assets\/pdf\/faq-ksc.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">cyber.gov.pl<\/a>.<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-group ll-art-cta is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 class=\"wp-block-heading ll-nietoc\">Let us rehearse the procedure before a real incident tests it<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.lablogic.pl\/en\/training\/\">Training and workshops<\/a> include preparing and running an incident response exercise for the security team, the data protection officer and the board. We start the work by reviewing the procedure and choosing the decisions that the exercise is to test.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/www.lablogic.pl\/en\/training\/\">Training and workshops<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>An incident response exercise starts from an objective and evaluation criteria written down in advance. Participants are chosen by role in the procedure, and the scenario forces an assessment under the KSC Act and the GDPR. It ends with a report on corrective actions, their owners and deadlines.<\/p>\n","protected":false},"author":2,"featured_media":6200,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ll_stan_prawny":"November 2026","footnotes":""},"categories":[75],"tags":[],"class_list":["post-6209","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-workshops"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"Incident response exercise step by step \u2014 objective and evaluation criteria, form, participants, a KSC Act and GDPR scenario, safe running and the report.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Micha\u0142 Rutkowski\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"LabLogic - Micha\u0142 Rutkowski | DPO, GDPR, NIS2 and cybersecurity in practice\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"How to prepare an incident response exercise?\" \/>\n\t\t<meta property=\"og:description\" content=\"Incident response exercise step by step \u2014 objective and evaluation criteria, form, participants, a KSC Act and GDPR scenario, safe running and the report.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-incident-response-exercise-en.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-incident-response-exercise-en.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:section\" content=\"Training and workshops\" \/>\n\t\t<meta property=\"article:tag\" content=\"incident response exercise\" \/>\n\t\t<meta property=\"article:tag\" content=\"tabletop exercise\" \/>\n\t\t<meta property=\"article:tag\" content=\"incident response procedure test\" \/>\n\t\t<meta property=\"article:tag\" content=\"incident exercise scenario\" \/>\n\t\t<meta property=\"article:tag\" content=\"business continuity plan testing\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-11-07T10:15:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-11-07T10:40:53+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"How to prepare an incident response exercise?\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Incident response exercise step by step \u2014 objective and evaluation criteria, form, participants, a KSC Act and GDPR scenario, safe running and the report.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-incident-response-exercise-en.jpg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response-exercise\\\/#article\",\"name\":\"Incident response exercise \\u2014 how to prepare and evaluate it\",\"headline\":\"How to prepare an incident response exercise?\",\"author\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/ll-og-incident-response-exercise-en.jpg\",\"width\":1200,\"height\":630,\"caption\":\"Incident response exercise \\u2014 LabLogic article graphic by Micha\\u0142 Rutkowski\"},\"datePublished\":\"2026-11-07T11:15:42+01:00\",\"dateModified\":\"2026-11-07T11:40:53+01:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response-exercise\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response-exercise\\\/#webpage\"},\"articleSection\":\"Training and workshops\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response-exercise\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#listItem\",\"position\":1,\"name\":\"LabLogic\",\"item\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/workshops\\\/#listItem\",\"name\":\"Training and workshops\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/workshops\\\/#listItem\",\"position\":2,\"name\":\"Training and workshops\",\"item\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/workshops\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response-exercise\\\/#listItem\",\"name\":\"How to prepare an incident response exercise?\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#listItem\",\"name\":\"LabLogic\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response-exercise\\\/#listItem\",\"position\":3,\"name\":\"How to prepare an incident response exercise?\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/workshops\\\/#listItem\",\"name\":\"Training and workshops\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#organization\",\"name\":\"LabLogic\",\"description\":\"DPO, GDPR, NIS2 and cybersecurity in practice\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/\",\"email\":\"m.rutkowski@lablogic.pl\",\"telephone\":\"+48586231777\",\"foundingDate\":\"2004\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/cropped-lablogic-site-icon-512.png\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response-exercise\\\/#organizationLogo\",\"width\":512,\"height\":512},\"image\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response-exercise\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/michal-rutkowski-iod\"],\"additionalType\":\"https:\\\/\\\/schema.org\\\/ProfessionalService\",\"legalName\":\"LabLogic Consulting Micha\\u0142 Rutkowski\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"ul. Wolno\\u015bci 15\",\"postalCode\":\"81-327\",\"addressLocality\":\"Gdynia\",\"addressRegion\":\"pomorskie\",\"addressCountry\":\"PL\"},\"vatID\":\"PL9580972114\",\"taxID\":\"9580972114\",\"areaServed\":{\"@type\":\"Country\",\"name\":\"Poland\"},\"knowsAbout\":[\"GDPR\",\"Data Protection Officer (DPO)\",\"NIS2 Directive\",\"Polish National Cybersecurity System Act (KSC)\",\"Cybersecurity incident and data breach response\",\"EU AI Act\",\"ISO\\\/IEC 27001\",\"Information security management\"],\"founder\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\"},\"hasOfferCatalog\":{\"@type\":\"OfferCatalog\",\"name\":\"Services\",\"itemListElement\":[{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"External Data Protection Officer (DPO)\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/external-dpo\\\/\"}},{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"NIS2 and KSC implementation support\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-ksc\\\/\"}},{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"Incident and data breach response\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response\\\/\"}},{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"GDPR and NIS2 training\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/training\\\/\"}},{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"AI Act: roles, obligations and preparation\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/ai-act\\\/\"}}]}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/michal-rutkowski\\\/\",\"name\":\"Micha\\u0142 Rutkowski\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski-portret\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/michal-rutkowski-iod-dpo-rodo-nis2-lablogic.webp\",\"width\":864,\"height\":1080,\"caption\":\"Micha\\u0142 Rutkowski\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/michal-rutkowski-iod\"],\"jobTitle\":\"Data Protection Officer (DPO), NIS2\\\/KSC and cybersecurity advisor\",\"description\":\"Data protection and cybersecurity practitioner, owner of LabLogic. Since 2004 he has supported medium and large organisations: audits, implementations, incidents and training.\",\"email\":\"m.rutkowski@lablogic.pl\",\"knowsAbout\":[\"GDPR\",\"Data Protection Officer (DPO)\",\"NIS2 Directive\",\"Polish National Cybersecurity System Act (KSC)\",\"Cybersecurity incident and data breach response\",\"EU AI Act\",\"ISO\\\/IEC 27001\",\"Information security management\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response-exercise\\\/#webpage\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response-exercise\\\/\",\"name\":\"Incident response exercise \\u2014 how to prepare and evaluate it\",\"description\":\"Incident response exercise step by step \\u2014 objective and evaluation criteria, form, participants, a KSC Act and GDPR scenario, safe running and the report.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response-exercise\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/ll-og-incident-response-exercise-en.jpg\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response-exercise\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Incident response exercise \\u2014 LabLogic article graphic by Micha\\u0142 Rutkowski\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response-exercise\\\/#mainImage\"},\"datePublished\":\"2026-11-07T11:15:42+01:00\",\"dateModified\":\"2026-11-07T11:40:53+01:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/\",\"name\":\"Micha\\u0142 Rutkowski - LabLogic\",\"alternateName\":\"LabLogic\",\"description\":\"DPO, GDPR, NIS2 and cybersecurity in practice\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Incident response exercise \u2014 how to prepare and evaluate it","description":"Incident response exercise step by step \u2014 objective and evaluation criteria, form, participants, a KSC Act and GDPR scenario, safe running and the report.","canonical_url":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/#article","name":"Incident response exercise \u2014 how to prepare and evaluate it","headline":"How to prepare an incident response exercise?","author":{"@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski"},"publisher":{"@id":"https:\/\/www.lablogic.pl\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-incident-response-exercise-en.jpg","width":1200,"height":630,"caption":"Incident response exercise \u2014 LabLogic article graphic by Micha\u0142 Rutkowski"},"datePublished":"2026-11-07T11:15:42+01:00","dateModified":"2026-11-07T11:40:53+01:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/#webpage"},"isPartOf":{"@id":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/#webpage"},"articleSection":"Training and workshops"},{"@type":"BreadcrumbList","@id":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/#listItem","position":1,"name":"LabLogic","item":"https:\/\/www.lablogic.pl\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/workshops\/#listItem","name":"Training and workshops"}},{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/workshops\/#listItem","position":2,"name":"Training and workshops","item":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/workshops\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/#listItem","name":"How to prepare an incident response exercise?"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/#listItem","name":"LabLogic"}},{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/#listItem","position":3,"name":"How to prepare an incident response exercise?","previousItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/workshops\/#listItem","name":"Training and workshops"}}]},{"@type":"Organization","@id":"https:\/\/www.lablogic.pl\/#organization","name":"LabLogic","description":"DPO, GDPR, NIS2 and cybersecurity in practice","url":"https:\/\/www.lablogic.pl\/en\/","email":"m.rutkowski@lablogic.pl","telephone":"+48586231777","foundingDate":"2004","logo":{"@type":"ImageObject","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/cropped-lablogic-site-icon-512.png","@id":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/#organizationLogo","width":512,"height":512},"image":{"@id":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/#organizationLogo"},"sameAs":["https:\/\/www.linkedin.com\/in\/michal-rutkowski-iod"],"additionalType":"https:\/\/schema.org\/ProfessionalService","legalName":"LabLogic Consulting Micha\u0142 Rutkowski","address":{"@type":"PostalAddress","streetAddress":"ul. Wolno\u015bci 15","postalCode":"81-327","addressLocality":"Gdynia","addressRegion":"pomorskie","addressCountry":"PL"},"vatID":"PL9580972114","taxID":"9580972114","areaServed":{"@type":"Country","name":"Poland"},"knowsAbout":["GDPR","Data Protection Officer (DPO)","NIS2 Directive","Polish National Cybersecurity System Act (KSC)","Cybersecurity incident and data breach response","EU AI Act","ISO\/IEC 27001","Information security management"],"founder":{"@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski"},"hasOfferCatalog":{"@type":"OfferCatalog","name":"Services","itemListElement":[{"@type":"Offer","itemOffered":{"@type":"Service","name":"External Data Protection Officer (DPO)","url":"https:\/\/www.lablogic.pl\/en\/external-dpo\/"}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"NIS2 and KSC implementation support","url":"https:\/\/www.lablogic.pl\/en\/nis2-ksc\/"}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"Incident and data breach response","url":"https:\/\/www.lablogic.pl\/en\/incident-response\/"}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"GDPR and NIS2 training","url":"https:\/\/www.lablogic.pl\/en\/training\/"}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"AI Act: roles, obligations and preparation","url":"https:\/\/www.lablogic.pl\/en\/ai-act\/"}}]}},{"@type":"Person","@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski","url":"https:\/\/www.lablogic.pl\/michal-rutkowski\/","name":"Micha\u0142 Rutkowski","image":{"@type":"ImageObject","@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski-portret","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/michal-rutkowski-iod-dpo-rodo-nis2-lablogic.webp","width":864,"height":1080,"caption":"Micha\u0142 Rutkowski"},"sameAs":["https:\/\/www.linkedin.com\/in\/michal-rutkowski-iod"],"jobTitle":"Data Protection Officer (DPO), NIS2\/KSC and cybersecurity advisor","description":"Data protection and cybersecurity practitioner, owner of LabLogic. Since 2004 he has supported medium and large organisations: audits, implementations, incidents and training.","email":"m.rutkowski@lablogic.pl","knowsAbout":["GDPR","Data Protection Officer (DPO)","NIS2 Directive","Polish National Cybersecurity System Act (KSC)","Cybersecurity incident and data breach response","EU AI Act","ISO\/IEC 27001","Information security management"],"worksFor":{"@id":"https:\/\/www.lablogic.pl\/#organization"}},{"@type":"WebPage","@id":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/#webpage","url":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/","name":"Incident response exercise \u2014 how to prepare and evaluate it","description":"Incident response exercise step by step \u2014 objective and evaluation criteria, form, participants, a KSC Act and GDPR scenario, safe running and the report.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.lablogic.pl\/en\/#website"},"breadcrumb":{"@id":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/#breadcrumblist"},"author":{"@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski"},"creator":{"@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski"},"image":{"@type":"ImageObject","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-incident-response-exercise-en.jpg","@id":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/#mainImage","width":1200,"height":630,"caption":"Incident response exercise \u2014 LabLogic article graphic by Micha\u0142 Rutkowski"},"primaryImageOfPage":{"@id":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/#mainImage"},"datePublished":"2026-11-07T11:15:42+01:00","dateModified":"2026-11-07T11:40:53+01:00"},{"@type":"WebSite","@id":"https:\/\/www.lablogic.pl\/en\/#website","url":"https:\/\/www.lablogic.pl\/en\/","name":"Micha\u0142 Rutkowski - LabLogic","alternateName":"LabLogic","description":"DPO, GDPR, NIS2 and cybersecurity in practice","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.lablogic.pl\/#organization"}}]},"og:locale":"en_US","og:site_name":"LabLogic - Micha\u0142 Rutkowski | DPO, GDPR, NIS2 and cybersecurity in practice","og:type":"article","og:title":"How to prepare an incident response exercise?","og:description":"Incident response exercise step by step \u2014 objective and evaluation criteria, form, participants, a KSC Act and GDPR scenario, safe running and the report.","og:url":"https:\/\/www.lablogic.pl\/en\/incident-response-exercise\/","og:image":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-incident-response-exercise-en.jpg","og:image:secure_url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-incident-response-exercise-en.jpg","og:image:width":1200,"og:image:height":630,"article:section":"Training and workshops","article:tag":["incident response exercise","tabletop exercise","incident response procedure test","incident exercise scenario","business continuity plan testing"],"article:published_time":"2026-11-07T10:15:42+00:00","article:modified_time":"2026-11-07T10:40:53+00:00","twitter:card":"summary_large_image","twitter:title":"How to prepare an incident response exercise?","twitter:description":"Incident response exercise step by step \u2014 objective and evaluation criteria, form, participants, a KSC Act and GDPR scenario, safe running and the report.","twitter:image":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-incident-response-exercise-en.jpg"},"aioseo_meta_data":{"post_id":"6209","title":"Incident response exercise \u2014 how to prepare and evaluate it","description":"Incident response exercise step by step \u2014 objective and evaluation criteria, form, participants, a KSC Act and GDPR scenario, safe running and the report.","keywords":null,"keyphrases":{"focus":{"keyphrase":"incident response exercise","score":0,"analysis":[]},"additional":[{"keyphrase":"tabletop exercise","score":0,"analysis":[]},{"keyphrase":"incident response procedure test","score":0,"analysis":[]},{"keyphrase":"incident exercise scenario","score":0,"analysis":[]},{"keyphrase":"business continuity plan testing","score":0,"analysis":[]},{"keyphrase":"NIS2 exercise","score":0,"analysis":[]}]},"primary_term":null,"canonical_url":null,"og_title":"How to prepare an incident response exercise?","og_description":"Incident response exercise step by step \u2014 objective and evaluation criteria, form, participants, a KSC Act and GDPR scenario, safe running and the report.","og_object_type":"article","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":"Training and workshops","og_article_tags":[{"label":"incident response exercise","value":"incident response exercise"},{"label":"tabletop exercise","value":"tabletop exercise"},{"label":"incident response procedure test","value":"incident response procedure test"},{"label":"incident exercise scenario","value":"incident exercise scenario"},{"label":"business continuity plan testing","value":"business continuity plan testing"}],"twitter_use_og":true,"twitter_card":"summary_large_image","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-11-07 10:19:02","updated":"2026-11-07 10:42:03","seo_analyzer_scan_date":null,"focus_keyword":"incident response exercise","additional_keywords":[{"word":"tabletop exercise","score":0},{"word":"incident response procedure test","score":0},{"word":"incident exercise scenario","score":0},{"word":"business continuity plan testing","score":0},{"word":"NIS2 exercise","score":0}],"truseo_locale":null},"spectra_blocks_featured_image_url":{"thumbnail":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-incident-response-exercise-en-150x150.jpg","width":150,"height":150},"medium":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-incident-response-exercise-en-300x158.jpg","width":300,"height":158},"medium_large":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-incident-response-exercise-en-768x403.jpg","width":768,"height":403},"large":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-incident-response-exercise-en-1024x538.jpg","width":1024,"height":538},"full":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-incident-response-exercise-en.jpg","width":1200,"height":630}},"spectra_blocks_author_info":{"display_name":"Micha\u0142 Rutkowski","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/29f5af5a0ce65a4307813722032192bdf08e740cbda98b61aa73b548422ff768?s=96&d=mm&r=g","author_link":"https:\/\/www.lablogic.pl\/en\/author\/michal-rutkowski\/","description":"Micha\u0142 Rutkowski \u2014 praktyk ochrony danych i cyberbezpiecze\u0144stwa, w\u0142a\u015bciciel LabLogic. Od 2004 roku pracuje na styku technologii, ochrony danych i zarz\u0105dzania ryzykiem. Pe\u0142ni funkcj\u0119 zewn\u0119trznego IOD\/DPO, prowadzi audyty RODO, kwalifikacj\u0119 i wdro\u017cenia NIS2 oraz ustawy o KSC, wspiera organizacje przy incydentach i naruszeniach ochrony danych, szkoli zarz\u0105dy, kadr\u0119 kierownicz\u0105 oraz zespo\u0142y IT i compliance. Pracuje ze \u015brednimi i du\u017cymi organizacjami, w tym z sektora finansowego i bran\u017c regulowanych."},"_links":{"self":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts\/6209","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/comments?post=6209"}],"version-history":[{"count":3,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts\/6209\/revisions"}],"predecessor-version":[{"id":6214,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts\/6209\/revisions\/6214"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/media\/6200"}],"wp:attachment":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/media?parent=6209"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/categories?post=6209"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/tags?post=6209"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}