EXERCISE TYPOLOGY AND DESIGN capabilities, via interaction between these two specific levels. Nowadays it is not possible to strictly separate the technical world from the political or strategic. Since this is a rather advanced model of exercise, it is worth deploying it only after you have gained enough experience with technical and table-top exercises. Hybrid exercises can realistically only accomplish positive outcomes when they are properly prepared, and when the operational level (and the sum of its outcomes) is logically linked to a strategic intent, and vice versa. This might be very challenging, especially when linear development on the technical layer does not correspond to the time-based nonlinear aspects of decision making at the strategic level. Unlike cyber-attacks, decision making often burdened by bureaucracy - might seem to be too slow. The cyber defense exercise Locked Shields, organized by NATO CCD COE, might serve as a good inspiration and example of a hybrid exercise (https://ccdcoe.org/locked-shields2017.html). Note: Hybrid exercises should not be confused with the concept of hybrid as the nature of a threat (combining kinetic operations with irregular and cyber warfare). The type and scope of an exercise should be selected based on available resources and exercise objectives to be achieved. EXERCISE DESIGN Design questions should be dealt with after the exercise type is outlined, in order to drive subsequent planning steps. Design decisions must go hand in hand with the basic objectives of the exercise. E.g.:   Do we want to test the IT security team’s speed to recognize, analyze and respond to a cyber incident? Will the exercise test the roles of law enforcement, the intelligence community and military bodies, as well as their coordination and information exchange procedures during crisis? What else must be decided before we start planning? Here are examples of questions worth addressing during the initial planning stage, in order to select the right exercise concept.       Will the exercise simulate reality by running 24/7, or will it be phased over a two-day/one-week period condensed into a very busy 6-hour exercise, where a few hours reflects some pre-determined time passage? Is the exercise aimed at practicing crisis management only during office hours, or conversely, does the exercise intend to test readiness outside of working hours, or even during the weekend? What other specific tasks, functions, roles, or activities does the exercise intend to evaluate? What are all the components that could be simulated in order to make the exercise authentic? What hardware or equipment does the exercise require – computers, phones, mock news reports or any other tools? Is an exercise team/unit present in your institution? What is the maturity level of that team? Do they have any experience with conducting the selected type of exercise? How much time do they need to get familiar with the preparation mechanism/exercise lifecycle? The optimal length of a table-top exercise is around 60-90 minutes (excluding break time). 7/29