Getting started

Exercise in a Box works by taking a small group of your key staff through a series of structured questions (known as 'exercises') relating to a specific area of cyber security. By completing the exercises, you will understand the risks your organisation is currently exposed to, and what you can do about it.

Exercise in a Box has been designed to work for organisations of all sizes, but as a guide, for each exercise, you'll need a Senior leader, Cyber security engineer, and potentially a HR/communications advisor.

In addition to the staff listed above, you'll also need to identify a facilitator. This person is in charge of preparing for the exercises, running the exercises, and reporting the findings.

Not necessarily. If you think it's worth somebody attending for part of an exercise, consider asking them to contribute via a virtual meeting, by phone, or ask them to work nearby so they can be called upon when needed.

Exercises run best in a dedicated space, we recommend you hold a meeting in line with your usual business practices.

At various points during the exercises, you'll need to share the exercise content with the group, so that the participants can take part. You might want to share the content on screen, or print copies where you feel necessary.

You need to download the exercise pack for each exercise, and familiarise yourself with the materials. Each pack will contain resources for both the facilitator and the participants. This includes guidance on how each exercise should be run, as well as how to get the most out of it.

Exercises start by introducing an event, which could be (for example) 'your organisation’s IT is being attacked'. In exercising jargon, these events are known as 'injects'. The exercise continues by asking a set of questions relating to the inject. Exercise in a Box does not require you to enter a simple answer to these questions; they are intentionally worded in order to solicit discussion. You'll often find there is no simple answer.

The exercise pack includes scribe sheets for you to make notes as you go along. The group discussion questions at the end of each exercise are a further opportunity for participants to reflect and review the discussions.

We strongly recommend you review the discussion outcomes and agree any follow-up actions, as required. You should also consider reviewing the links to relevant NCSC guidance, which are provided at the end of the exercise.