Security Training

University · Running an exercise · Lesson 6

How to write exercise objectives you can grade

Field note

A gradeable objective names a decision or action, the person or team who owns it, and a condition that can be observed, usually a time. 'Improve readiness' cannot be graded. 'The incident commander declares a severity level within [target] of the first confirmed alert' can. Write two or three per exercise, no more.

Editorial assessment · Assessed from vendor sites, product pages and published pricing, September 2026

By Security Training assessors · 20 May 2026

L2-1What makes an objective gradeable?

  • An observable action: declares, decides, notifies, isolates, approves.
  • An owner: a named role, not 'the team'.
  • A condition: a time limit, an information threshold or a required output.
  • A source: the plan or playbook step the objective tests, so a failure points to a fix.

L2-2Templates you can adapt

Replace the bracketed parts with your own targets and plan references.

  • The incident commander declares a severity level within [target] of the first confirmed alert, following [plan section].
  • Legal and the CISO make, or formally defer, the materiality determination within [target] of the scoping inject, and record the reasons.
  • Communications produces an approved holding statement before the first media inject is answered.
  • The executive sponsor decides whether to take [system] offline, with the business impact stated, within [target] of the decision being requested.

L2-3How many objectives, and who grades them?

Two or three per exercise. More than that and the facilitator spends the session steering instead of observing. The note-taker, or the platform, records the times; the evaluator marks each objective met, partly met or not met in the after-action report, with the evidence. The six-step tabletop guide shows where objectives fit in planning.

L2-4What should you avoid?

  • Objectives that test knowledge, such as 'players understand the plan', rather than an action someone takes.
  • Objectives with no owner, which nobody can fail.
  • Objectives that cannot fail at all. If every outcome counts as met, the objective adds nothing to the report.

Sources: csrc.nist.gov/pubs/sp/800/61/r3/final, cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages · Reviewed Sep 2026

Next lesson: How to write tabletop exercise injects and a master scenario events list