> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Drills

> Rehearse a CRA Art. 14 filing end to end with a tabletop drill: real clocks, a simulated SRP, and nothing sent to authorities.

<Info>
  **Plans:** Core and Plus, and the free trial. **Who:** any member starts and completes a drill.
</Info>

A drill is a tabletop exercise that runs the whole CRA Art. 14 flow on a practice incident: from the determination to the final report, with the clocks running. Your team works it in Pharus exactly as it would a real incident, and nothing reaches an authority. When you complete it, Pharus records how long each step took against the CRA's windows, and what you learned. The app suggests rehearsing at least once a year, before you need it for real.

## How a drill differs from a real incident

| | Real incident | Drill |
| - | - | - |
| Reference | `INC-0042` | `DRILL-0003`, a separate series |
| Banner | None | "Exercise — not a real incident. Nothing is sent to authorities." and an EXERCISE watermark |
| Awareness | When you became aware | When the drill starts |
| SRP pack | You file it in the SRP | You don't file it. The recipient shows as "(simulated) NCSC-FI via SRP" |
| Receipt | **Record receipt** with the SRP's reference | **Simulate SRP receipt**, which generates a reference such as `DRILL-RCPT-1A2B` |
| Paging | Real pages to on-call | At most one test page, when the drill starts |
| Deadline warnings | Yes | No |
| VEX status | A determination can change it | Never changed: a drill isn't linked to a real match |
| Lists and reports | Counted | Kept out of the Overview, the open and closed incident lists, the weekly exposure digest, and the board report's incident numbers |
| Ends with | **Close incident** | **Complete drill** |

The DORA and Users tabs don't appear on a drill.

## Start a drill

<Steps>
  <Step title="Open the Drills tab">
    Go to **Incidents** and select the **Drills** tab, then **Start drill**.
  </Step>

  <Step title="Pick a scenario">
    Under **Scenario**, choose **Actively exploited vulnerability** or **Severe incident**.

    * **Actively exploited vulnerability:** "Pharus uses a real CISA KEV match when the family has one." Without one, the drill uses CVE-2021-44228 (Log4Shell) in a component the family ships, and says it is a canned scenario.
    * **Severe incident:** a suspected compromise of the update server, where a tampered firmware update may have reached customers.
  </Step>

  <Step title="Pick a product family">
    The **Product family** gives the scenario its product, versions and member states. You can also run a drill with **No product family**.
  </Step>

  <Step title="Add a facilitator note">
    **Facilitator note** is optional and shown on the drill only: roles, injects, what to watch for. For example, "Kari is on call, Ola approves. Inject at 30 min: the vendor confirms exploitation."
  </Step>

  <Step title="Choose whether to page on-call">
    Tick **Page on-call as part of the drill** to send a test page by SMS to the person on call now, marked as a test. It is never a real page.
  </Step>

  <Step title="Start">
    Select **Start drill**. Pharus opens the new drill with awareness set to now and the clocks running.
  </Step>
</Steps>

## Run the drill

Work the drill like an incident, with the same tabs and the same permissions:

1. Record and approve the determination on the **Determination** tab. See [Decision record](/incidents/decision-record).
2. Check the CSIRT route on the **Routing** tab.
3. On the **SRP pack** tab, prepare each report. The pack says: "Exercise: don't file this pack in the real SRP. Mark it as submitted here, then simulate the receipt."
4. Select **Mark as submitted**, then **Simulate SRP receipt**. "Here Pharus records a simulated one through the normal filing path, so the clocks and the audit trail behave as they would for real."
5. For a vulnerability scenario, record when the fix is available on the Overview tab to start the final report clock. See [Reporting clocks](/incidents/clocks).

## Complete a drill

<Steps>
  <Step title="Open the banner">
    On the drill, select **Complete drill** in the banner at the top.
  </Step>

  <Step title="Write what you learned">
    **What did you learn?** is required: what went well, what slowed you down, and what you will change before a real incident.
  </Step>

  <Step title="Complete">
    Select **Complete drill**. Pharus closes the drill as **Drill complete** and records each step's time from awareness against the CRA Art. 14 windows.
  </Step>
</Steps>

A drill that an approved not-reportable determination closed early can still be completed: the banner says "Closed before the drill was completed. Complete the drill to record the outcome." A completed drill can't be completed again. Completing stays open on every plan, so a drill already running can be finished after a downgrade.

## The drill summary

The **Drill summary** on the drill's Overview tab lists each milestone with its time, the time from awareness, the window it is judged against and the result:

| Milestone | Judged against |
| - | - |
| Awareness | No window |
| Determination recorded | 24 h, because the early warning needs a determination in force |
| Determination approved | 24 h |
| Early warning submitted | 24 h |
| Notification submitted | 72 h |
| Early warning receipt, Notification receipt | No window |
| Final report submitted | 14 days after the fix (vulnerability) or 1 month after the notification (severe incident) |
| Final report receipt | No window |

Each result is **Met**, **Missed**, **Not reached**, **Done** (no window) or **Not required**. The score, such as "4/5 on time", counts the milestones with a window. The summary also shows the facts of the drill, the facilitator note, whether on-call got a test page, and the lessons learned. **Print summary** prints it.

The **Drills** tab lists every drill with its scenario, product family, start and completion times, the score and its status: **In progress**, **Completed** or **Closed**.

## In the board report and the audit trail

* The [board report](/reports/board-report) has a **Drills** section with the drills started and completed, the last drill completed, and whether the annual drill is done or due. Drills never count towards its incident or reporting numbers.
* The [audit trail](/reports/audit-trail) records "Started tabletop drill" and "Completed tabletop drill" with the duration, next to every action taken during the drill. A drill's own **Audit** tab shows them in order.

## Related

<CardGroup cols={2}>
  <Card title="SRP paste pack" icon="clipboard-check" href="/incidents/srp-pack">
    The pack you practise with, and file for real.
  </Card>

  <Card title="Board report" icon="presentation" href="/reports/board-report">
    Where drill outcomes show each quarter.
  </Card>

  <Card title="On-call rota" icon="calendar-days" href="/on-call/rota">
    Who gets the test page when a drill starts.
  </Card>

  <Card title="Reporting clocks" icon="alarm-clock" href="/incidents/clocks">
    The windows each drill milestone is judged against.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.