Reviewed 17 August 2026
Reporting drill vs incident response plan
Teams with a mature incident response plan often assume reporting is covered by it. It usually is not. The two answer different questions, run on different clocks and fail for different reasons.
Last updated · Written and reviewed by Jonatan Tensetti · Tensetti Tools
| Incident response plan | CRA reporting drill | |
|---|---|---|
| Question it answers | How do we contain, eradicate and recover? | Can we notify the right authority, in time, with the right information? |
| Clock | Driven by business impact and customer commitments. | Fixed in law: 24 hours, 72 hours, then a final report. |
| Primary audience | Engineering, operations, executives, customers. | The coordinating CSIRT and ENISA, through the single reporting platform. |
| Typical failure | Unclear ownership during containment. | Nobody has platform access, or nobody is authorised to press send at 03:00. |
| Evidence produced | Timeline, root cause, remediation record. | Dated exercise record, gap list with owners, approved report drafts. |
| Frequency | Reviewed annually, exercised occasionally. | Short and repeatable — worth rehearsing after every change of owner or product line. |
Where the two touch
One shared moment matters more than any other: awareness. Your incident response plan probably starts at detection or triage. The reporting clock starts at awareness, which may be earlier and may be held by someone outside the response team — a support agent, a product manager reading a researcher email, a CSIRT notification landing in a shared inbox. If the two definitions are not reconciled, you can run a textbook response and still be late.
What a good drill covers that an IR plan usually does not
- Who is authorised to submit, and who deputises when they are unreachable.
- Whether platform access and entity registration exist before they are needed.
- Which Member States the product is available in — a 24-hour field, not a research task.
- How sensitive detail is handled so that a report does not itself become an exposure.
- What "unknown" looks like in a submission, and how it converts into an assigned action.
How to run one without theatre
Book sixty minutes. Use fictional data only. Set an awareness time, work through the early warning, then the notification, then the final report content. Write down every answer that was a guess. The output is not a score — it is a list of gaps with names and dates against them.
Never use live incident detail in a rehearsal tool, including this one. Keep exploit specifics in your own controlled channel.
Do both, in this order
If you have neither, build the reporting drill first: it is smaller, it is the obligation that arrives first, and it exposes the ownership questions your response plan will need answered anyway. Then extend outwards into containment and recovery.
Reviewed 17 August 2026 · assessment version 1.0.0