‘Show me, don’t tell me’ – practical exercises

What are the exercises?

This document outlines three practical, reflective exercises designed to help firms test their cyber, IT, and operational resilience in real-world scenarios rather than relying on paper policies.

The exercises focus on proving operational readiness through:

• The ‘regulator in the room’ exercise: Analysing a real, past issue to trace how it was detected, escalated, and resolved
• The ‘evidence vs. intention’ table: Identifying the gap between what a firm says it does and what it can actually demonstrate across key control areas
• The 72-hour reality check: Simulating the exact timeline, personnel involvement, and evidence required during the first three days of a major cyber incident