Drills

A drill is a tabletop exercise that runs the whole CRA Art. 14 flow on a practice incident: from the determination to the final report, with the clocks running. Your team works it in Pharus exactly as it would a real incident, and nothing reaches an authority. When you complete it, Pharus records how long each step took against the CRA’s windows, and what you learned. The app suggests rehearsing at least once a year, before you need it for real.

​

How a drill differs from a real incident

The DORA and Users tabs don’t appear on a drill.

​

Start a drill

​

Run the drill

Work the drill like an incident, with the same tabs and the same permissions:

1. Record and approve the determination on the Determination tab. See Decision record.
2. Check the CSIRT route on the Routing tab.
3. On the SRP pack tab, prepare each report. The pack says: “Exercise: don’t file this pack in the real SRP. Mark it as submitted here, then simulate the receipt.”
4. Select Mark as submitted, then Simulate SRP receipt. “Here Pharus records a simulated one through the normal filing path, so the clocks and the audit trail behave as they would for real.”
5. For a vulnerability scenario, record when the fix is available on the Overview tab to start the final report clock. See Reporting clocks.

​

Complete a drill

A drill that an approved not-reportable determination closed early can still be completed: the banner says “Closed before the drill was completed. Complete the drill to record the outcome.” A completed drill can’t be completed again. Completing stays open on every plan, so a drill already running can be finished after a downgrade.

​

The drill summary

The Drill summary on the drill’s Overview tab lists each milestone with its time, the time from awareness, the window it is judged against and the result: Each result is Met, Missed, Not reached, Done (no window) or Not required. The score, such as “4/5 on time”, counts the milestones with a window. The summary also shows the facts of the drill, the facilitator note, whether on-call got a test page, and the lessons learned. Print summary prints it. The Drills tab lists every drill with its scenario, product family, start and completion times, the score and its status: In progress, Completed or Closed.

​

In the board report and the audit trail

• The board report has a Drills section with the drills started and completed, the last drill completed, and whether the annual drill is done or due. Drills never count towards its incident or reporting numbers.
• The audit trail records “Started tabletop drill” and “Completed tabletop drill” with the duration, next to every action taken during the drill. A drill’s own Audit tab shows them in order.

​

Related