EXERCISE NARRATIVE AND INJECTS participants to become familiarized with their role more easily. However, there is the risk that if you lose control over sensitive exercise materials and these are released to third parties, this may escalate into real-time diplomatic tensions. For this reason, it is important to mark all sensitive/classified exercise materials accordingly and determine exercise material handling procedures (as defined below). You can also provide a disclaimer explaining the zero attribution and fictitious basis of a scenario (see Appendix). INJECTS Just like the initial scenario helps get the exercise started, injects get the game moving forward. Injects or drivers should always have a purpose. They develop the baseline narrative given to the players at the start. You can imagine injects as short pre-scripted messages that provide context and information which will stimulate trainees to do something. They may be used to plot out the story, to speed up, or slow down the play. They may act as additional information, or can include one or more questions to be answered. Additional injects can be made operatively to steer participants in a certain direction. To maintain storyline consistency, all injects must relate back to the exercise objectives and the road to crisis. Further, injects must not conflict with each other. Well-crafted injects should engage trainees in active discussions or other activity. Clear, grounded, realistic, creative and gripping injects are essential. Responders often tend to claim “that would never happen that way”. Creating injects which mirror the real world as much as possible can reduce those complaints. However, if participants continue to fight the scenario and not the problems within the scenario, make it clear that “you are here to fight the problem, not the scenario”. If necessary, repeat/summarize the current situation, which the participants must address. Injects should always be customized to the institution/country framework and the environment with which the participants are familiar. Injects should match participant skills and capacity; otherwise, it might be difficult for players to identify with their role and situation. Moreover, exceeding participant capacity can make them feel uncomfortable and demotivated. Be aware that the more the exercise injects reflect a real cyber security framework, the more trainees can get involved in their roles and provide game success. Once you have a list of vetted injects, you can consider how these will be delivered to your target group, for example by using:                 slides with notes and pictures, emails, phone calls, text messages, technical/contextual/threat/situation reports (describing and reporting an incident, providing overall contextual analysis), tailor-made audio/video clips, real videos, authentic photos (even if taken by you), radio, TV, or newspapers articles, electronic news media outlets, social media posts, blogposts, audio records, personal visits, message from role-played actors, etc. A combination of the above in realistically designed delivery methods creates a more challenging and engaging experience for training audiences. Defining a time limit to complete injects and respective tasks is also worth considering in advance. Since dealing with time pressure is a vital and inseparable part of an exercise, choose such deadlines that provide responders time to read assignments and discuss them in the team, but still feel under increased timepressure. For example, at the beginning of an 15/29