University · Running an exercise · Lesson 6
How to write exercise objectives you can grade
A gradeable objective names a decision or action, the person or team who owns it, and a condition that can be observed, usually a time. 'Improve readiness' cannot be graded. 'The incident commander declares a severity level within [target] of the first confirmed alert' can. Write two or three per exercise, no more.
Editorial assessment · Assessed from vendor sites, product pages and published pricing, September 2026
By Security Training assessors · 20 May 2026
L2-1What makes an objective gradeable?
- An observable action: declares, decides, notifies, isolates, approves.
- An owner: a named role, not 'the team'.
- A condition: a time limit, an information threshold or a required output.
- A source: the plan or playbook step the objective tests, so a failure points to a fix.
L2-2Templates you can adapt
Replace the bracketed parts with your own targets and plan references.
- The incident commander declares a severity level within [target] of the first confirmed alert, following [plan section].
- Legal and the CISO make, or formally defer, the materiality determination within [target] of the scoping inject, and record the reasons.
- Communications produces an approved holding statement before the first media inject is answered.
- The executive sponsor decides whether to take [system] offline, with the business impact stated, within [target] of the decision being requested.
L2-3How many objectives, and who grades them?
Two or three per exercise. More than that and the facilitator spends the session steering instead of observing. The note-taker, or the platform, records the times; the evaluator marks each objective met, partly met or not met in the after-action report, with the evidence. The six-step tabletop guide shows where objectives fit in planning.
L2-4What should you avoid?
- Objectives that test knowledge, such as 'players understand the plan', rather than an action someone takes.
- Objectives with no owner, which nobody can fail.
- Objectives that cannot fail at all. If every outcome counts as met, the objective adds nothing to the report.
Sources: csrc.nist.gov/pubs/sp/800/61/r3/final, cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages · Reviewed Sep 2026
Next lesson: How to write tabletop exercise injects and a master scenario events list