Laserfiche WebLink
<br />©2025 Lumifi Cyber, Inc. All rights reserved. <br />PRIVATE - Controlled by Lumifi Cyber <br /> <br />11/19 <br />PRIVATE - Controlled by Lumifi Cyber <br />• Conduct Exercise – Lumifi Cyber and Kittitas County <br />• Identify Lessons Learned – Lumifi Cyber <br />• Improve Cybersecurity Program – Kittitas County <br />The NIST-based methodology has the following components: <br />• Design. The design phase and planning for exercises typically starts at least <br />one month in advance. The major steps in the event design process are as <br />follows: <br />o Determine the exercise topic based on the focus of the plan being <br />exercised <br />o Determine the exercise scope based on the target audience <br />o Identify the objectives of the exercise <br />o Identify the individuals that should participate in the exercise and invite <br />them to the event <br />o Identify the staff for the exercise, including a facilitator and a data <br />collector <br />o Coordinate the logistics for the exercise event. <br />• Development. Typical documentation includes a briefing, a facilitator guide, a <br />participant guide, and an after-action report. <br />• Conduct. In this phase, the IR plan is actually exercised. Tabletop exercises <br />are usually conducted in a classroom -type setting. The facilitator provides a <br />briefing to the participants, then walks them through the scenario and initiates <br />a group discussion using a question from the facilitator guide. As the <br />discussion continues, the facilitator may inject additional questions <br />periodically. The data collector documents issues to be included in the after - <br />action report. Immediately following the facilita ted discussion, the facilitator <br />and data collector conduct an exercise debrief, in which they ask the <br />participants in which areas they excel, in which areas they could use additional <br />training, and which areas of the IT plan should be updated. <br />• Evaluation. The comments from the debrief, along with lessons learned during <br />the exercise, are captured in an after -action report. The report should include <br />background information about the exercise, documented observations made <br />by the facilitator and data collector, and recommendations for enhancing the <br />IR plan that was exercised. Outcomes of the evaluation could include updating <br />the IR plan or other security -related documents, briefing managers on the <br />results, and performing other actions.