Quick Answer
Measure IRT readiness by scoring five dimensions after each exercise: detection speed, escalation clarity, decision quality, playbook adherence, and communication clarity (each 1–5, max 25). Measure management engagement with the MEI — a 10-point index across preparation, active participation, and follow-through. Track both as trends over time, not one-off scores.
Running a cyber exercise is the easy part. The hard part is knowing what it actually told you.
Most teams walk away from a tabletop with a vague sense of "that went pretty well" or "we need to work on communication." Neither of these is actionable. And when your CISO asks whether the team is ready, or when the Board wants to know if the last drill showed improvement, gut feeling doesn't cut it.
This guide covers two things most exercise programs get wrong: measuring actual IRT readiness (not just participation), and measuring whether management is genuinely engaged — not just showing up.
Cybersecurity readiness is inherently qualitative. You can't directly measure "how prepared" a team is the way you measure patch coverage or mean time to detect. What you can measure are observable behaviors and outcomes — and over time, those proxy metrics tell a clear story.
The goal isn't a perfect score. It's a directional trend: are we faster, clearer, and more decisive than last quarter?
📘 Why NIST 800-61 matters here NIST Special Publication 800-61 is the federal standard for incident response. It defines four phases every IR team should master: Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. The five readiness dimensions below map directly to these phases — so if your team scores low on one, you know exactly which part of the NIST lifecycle to strengthen.
Evaluate your team across five areas after each exercise:
1. Detection Speed How quickly did the team recognize that a real incident was occurring? During a tabletop, this maps to: how long did it take participants to correctly identify the attack type and scope from the injects provided?
Metric: Time from first inject to correct classification (benchmark: under 15 minutes for a well-drilled team)
2. Escalation Clarity Did the right people get notified at the right time? Escalation failures are among the most common IR gaps — the CISO finds out three hours late, legal isn't looped in until after external notification was required, the IR lead doesn't have the CISO's personal number.
Metric: Were all required escalation paths activated within the scenario timeline? (Yes/No per path, scored as a percentage)
3. Decision Quality Under Pressure Containment decisions made under time pressure and incomplete information are where exercises diverge from reality. Did the team make defensible decisions? Did they isolate aggressively or wait for certainty? Did they have the authority to act, or did decisions stall waiting for approvals?
Metric: Facilitator-scored decision quality (1–5 scale per key decision point, averaged)
4. Playbook Adherence Does the team actually follow the documented playbook, or do they improvise? Both can be appropriate — but knowing the gap between the playbook and actual behavior is critical. Either the playbook needs updating, or the team needs training.
Metric: Percentage of playbook steps executed correctly during the scenario
5. Communication Clarity Internal communications during an incident degrade fast. Did participants share accurate information? Did they use the right channels? Were external-facing communications (regulatory, customer, press) produced with appropriate speed and accuracy?
Metric: Clarity score from peer review of communications produced during the exercise (1–5 scale)
After each exercise, score each dimension 1–5 and track the average over time. A simple table works:
| Dimension | Score (1–5) | Notes |
|---|---|---|
| Detection Speed | 3 | Took 22 min to classify — above benchmark |
| Escalation Clarity | 4 | Legal loop missed in first cycle |
| Decision Quality | 3 | Containment decision delayed 18 min waiting for approval |
| Playbook Adherence | 4 | Steps 3–4 skipped under pressure |
| Communication Clarity | 5 | Internal comms crisp, external drafted well |
| Average | 3.8 |
Run this after every exercise. The trend line matters more than any single score.
📘 NIST 800-61 recommends tracking metrics like time-to-detect and time-to-contain across incidents and exercises. The scorecard above is a practical way to do exactly that — without needing a dedicated metrics program.
Executive engagement in cyber exercises is one of the clearest predictors of organizational security maturity. But "the CISO attended the tabletop" is not the same as "management is engaged."
Here's how to tell the difference.
Before the exercise:
During the exercise:
After the exercise:
Track executive engagement with a simple 10-point index across three categories:
Preparation (0–3 points)
Active Participation (0–4 points)
Post-Exercise Follow-Through (0–3 points)
Score interpretation:
Executives who score low on the MEI consistently appear in post-incident reviews as bottlenecks: approvals that didn't come in time, communications that weren't authorized, containment decisions that waited for the right person to pick up the phone.
Management engagement in exercises isn't about optics. It's about ensuring that when the real incident happens, every decision-maker in the chain has practiced making decisions under pressure — with the people they'll be working alongside.
At the end of each quarter, combine your IRT Readiness Scorecard with the Management Engagement Index into a single one-page report for leadership:
Drillber Security Team
Practitioners who have planned, facilitated, and analyzed hundreds of cyber exercises across enterprise, government, and MSSP environments. Drillber is built on NIST 800-61 and MITRE ATT&CK frameworks.