Discussion-based vs operations-based exercises: which one to run

L1-1What is the difference?

In a discussion-based exercise, players read a scenario and say what they would do. Nothing is switched off, no system is touched, and the output is a set of decisions and gaps. In an operations-based exercise, players perform the actions: analysts investigate alerts in a range, responders isolate hosts, a team restores from backup. The output is evidence of what happened and how long it took. NIST SP 800-84 covers both within what it calls a test, training and exercise (TT&E) program.

L1-2Where does each format sit?

• Tabletop exercise: discussion-based. The format CISA's free packages support.
• Crisis simulation: discussion-based in what players do, but the scenario reacts to their decisions and arrives through simulated channels such as email, calls and news.
• Drill: operations-based, usually one procedure, such as a backup restore or an out-of-hours call tree.
• Live-fire range exercise: operations-based. Defenders respond to an attack running in a range.

L1-3Which should come first?

Discussion-based, in most cases. If the incident commander, legal and communications disagree about who declares an incident, a range exercise will expose the same disagreement at higher cost. Once decision rights are clear, operations-based exercises test whether the technical team can execute them. The formats explainer compares length and evidence for each format.

L1-4What does each cost in time?

A self-facilitated tabletop needs weeks of preparation for a session of a few hours. Operations-based exercises need an environment: a range, a test system or a maintenance window, and someone to reset it afterwards. Platforms reduce preparation for both, which makes more than one exercise a year practical.