MAKE YOUR EXERCISE CATCHY   expose trainees to unusual situations and in an interactive way test their reactions and readiness for a real crisis (without the loss of life, money, good reputation or prestige). Moreover, admitting mistakes, and identifying inefficient processes during the exercise is a good practice. Creating adequate pressure – It is difficult to know the limits of employees when they are exposed to high pressure and stressful situations, prior to their experiencing such conditions. Add more pressure by increasing workload and shortening deadlines for task completion, in order to determine how participants behave in a crisis situation. Distinguish clearly between exercise and real documents – Avoid inducing panic that might result from forwarding exercise documents to persons not involved in the exercise. It is good practice that all documents and subject lines in emails be marked as “EXERCISE” in a prominent and visible location. Add a note to whom the document may be releasable.    WHAT IS USEFUL AND RECOMMENDED   Strategic anticipation – Exercise designers should be able to come up with a red cell style scenario, which entails constantly implementing new threats and discovered vulnerabilities into the storylines. If your red cell designers struggle with this task, steer them to cooperate with in-house intelligence threat/analytical unit/other experts that handle this kind of information. Open-minded and out of the box thinking – By integrating (or consulting) technically oriented experts, legal advisors, managers, STRATCOM professionals and analysts during the planning phase, you can enrich the story with nuanced perspectives, dilemmas and difficulties (mostly unknown to the exercise creators).   Gripping and engaging scenario – Generate a scenario based on real attacks, current threats and trends, explore alternative exploits and attack vectors, consider “what if” scenarios. Such hypothetical situations/inputs might galvanize the creation of new disaster recovery plans, standard operating procedures, and/or emergency action plans to mitigate potential cyber security crises. Cyber security as a team effort – Exercises pose a perfect opportunity to strengthen team work, and build trust and relationships with important counterparts. Make sure you tap into this opportunity. Active involvement of professional journalists – Do not simulate press and public media actions if the opportunity exists to invite professionals. In return for providing exercise access to the media, they will potentially bring a much-needed element of pressure, stress, panic and urgency. Additionally, following consent and authorization by the exercise design team, journalists can effectively publicize the exercise in their media and thus further spread awareness of its importance among the general public. Consult experts – It is not the responsibility of exercise designers to be familiar with all areas and determine all challenges that individual institutions face. The responsibility of the exercise designers is to compile the story and develop highly specific injects based on the exercise objectives set at the beginning. E.g. if there is an intent to test the private sector, customize the exercise to the sector´s current needs and framework. To avoid answers like “this is not how commercial organizations work”, consult specific aspects of the scenario with your partners from the private sphere in advance. Do not underestimate the value of a test run/exercise review – Before each exercise, ask colleagues/partners for an 20/29