Who actually requires you to test the plan

Who it applies to

Any company whose customers ask for a report — in practice, most B2B software and services. Nothing in law obliges you to have one. Your largest customer's vendor review does, which is why the deadline feels statutory even though it is contractual.

Does it require a test?

SOC 2 is an attestation, not a regulation, and there is no sentence in it that says run a tabletop. The Trust Services Criteria state criteria to be met, and none of them sets a testing or exercise frequency for the incident response plan.

A Type II report examines whether the controls you described actually operated across a stated window, so what reaches your desk is an evidence request rather than a rule: show me the incident response the CC7 criteria describe. That makes the auditor, not the standard, the person you are answering, and a dated record of who was in the room and what they decided is difficult to argue with.

What the report cites, and from which exercise

• CC7.2Monitoring system components for anomalies
• CC7.3Evaluating security events to determine their impact
• CC7.4Responding to identified security incidents
• CC2.3Communicating with external parties about security matters
• CC9.2Assessing and managing risks associated with vendors and business partners
• CC6.1, CC6.2, CC6.3, CC6.7Logical access, user registration, access change on role change, and restricting movement of information — mapped by the cloud-compromise and insider packs

9 identifiers across the four scenario packs. All four scenario packs map it. The common criteria an incident touches. Nothing in the availability, confidentiality, processing-integrity or privacy categories is claimed.

Who it applies to

Anyone who stores, processes or transmits payment card data, and the service providers who do it on their behalf. Your acquirer or the card brands decide your validation route — a QSA-led Report on Compliance or a self-assessment questionnaire — and either route puts a date in your calendar.

Does it require a test?

This is the hardest sentence in the set. Requirement 12.10.2 states that at least once every 12 months the security incident response plan is “Reviewed and the content is updated as needed” and “Tested, including all elements listed in Requirement 12.10.1.” Not reviewed. Reviewed and tested, across every element of the plan 12.10.1 defines.

A tabletop appears only in the Guidance column beside that requirement, as good practice — and PCI DSS states that guidance is not required to be followed and neither replaces nor extends a requirement. So the testing is mandatory and the method is yours. A discussion-based exercise is one permitted way to do it, not the way.

What the report cites, and from which exercise

• Requirement 12.10.1The incident response plan exists and is ready to be activated
• Requirement 12.10.2The annual review and test of the plan — the record of the test itself
• Requirement 12.10.5The plan covers monitoring and responding to alerts from security monitoring systems
• Requirement 12.10.6The plan is modified and evolved from lessons learned
• Requirement 12.10.7Procedures on detection of stored PAN where it is not expected

5 identifiers across the four scenario packs. Only the supply-chain breach pack maps it. Five of the six 12.10 requirements. 12.10.4 — that responding personnel are appropriately and periodically trained — is deliberately left out: taking part in an exercise is not the delivery of a training programme, and claiming it would be the kind of stretch a QSA notices. Nothing in Requirements 1 through 11 is claimed either; those are technical controls in your cardholder data environment, and a discussion in a room evidences none of them.

Who it applies to

Defense contractors and subcontractors handling Federal Contract Information or Controlled Unclassified Information. The rule states that CMMC Level 2 security requirements are identical to those in NIST SP 800-171 Rev. 2, all 110 of them, and it incorporates that publication by reference.

Does it require a test?

NIST SP 800-171 Rev. 2 § 3.6.3 is one sentence long: “Test the organizational incident response capability.” It is assessed as CMMC practice IR.L2-3.6.3, published title Incident Response Testing. No frequency, no method, no exceptions written into the requirement.

Rev. 2's discussion names the methods it has in mind — “checklists, walk-through or tabletop exercises, simulations (both parallel and full interrupt), and comprehensive exercises” — conducted to determine the effectiveness of the capability and identify weaknesses. A tabletop is one item on that list, and the requirement itself names none of them.

The pressure here is consequence rather than text. An assessment happens on a booked date, an Affirming Official signs, and a contract award waits on the outcome. Of everything on this page, this is the trigger with the shortest fuse.

What the report cites, and from which exercise

• IR.L2-3.6.3Incident Response Testing — the record of the test
• IR.L2-3.6.1Incident Handling: preparation, detection, analysis, containment, recovery, response
• IR.L2-3.6.2Incident Reporting: tracking, documenting and reporting to designated officials
• AT.L2-3.2.3Insider Threat Awareness — mapped by the insider-threat pack
• CA.L2-3.12.2Plan of Action: the findings become items with owners and dates

5 identifiers across the four scenario packs. Mapped by the ransomware and insider threat packs. The IR family, plus one awareness practice and the plan of action the findings feed. Nothing in access control, media protection, physical protection, system and communications protection or system and information integrity — those are implemented controls, evidenced by the systems that implement them. No Level 3 practice is claimed.

Who it applies to

Anyone certified, or working toward certification, against ISO/IEC 27001:2022 — often the same companies that carry SOC 2, plus the European and Asian buyers who ask for ISO instead of it. The forcing event is a certification, surveillance or recertification audit.

Does it require a test?

ISO/IEC 27001 sets no exercise cadence. A.5.24 through A.5.27 require incident management planning, response and learning; none of them requires the plan to be tested or exercised. Which Annex A controls apply to you at all is what your own Statement of Applicability declares, and the audit then asks for evidence that the ones you declared applicable are operating.

That is where a written-but-never-run plan is exposed. A.5.27 is about learning from incidents; if you have had no incidents and run no exercises, there is nothing to show, and the certification body is entitled to say so.

What the report cites, and from which exercise

• A.5.24Planning and preparation for incident management — roles, processes, responsibilities
• A.5.26Response to incidents, in accordance with documented procedures
• A.5.27Learning from incidents: what the exercise found, and what changed afterwards
• A.5.28Collection of evidence — where the room says the record is being kept
• A.5.19 – A.5.23Supplier relationships, supplier agreements, the ICT supply chain, monitoring supplier services, and cloud services — the supply-chain pack
• A.6.4, A.6.5Disciplinary process and responsibilities after termination — the insider pack
• A.5.7, A.5.17, A.8.2, A.8.12, A.8.15Threat intelligence, authentication information, privileged access, data leakage prevention and logging, where a decision genuinely turns on one

16 identifiers across the four scenario packs. All four scenario packs map it. The incident, supplier, people and a handful of technical controls the packs map. The bulk of Annex A — everything about building and running the controls themselves — is outside this and is evidenced by the controls, not by a conversation about them.

Who it applies to

Covered entities and their business associates, which by now means most vendors selling anything into healthcare, and their subcontractors. The trigger is rarely OCR. It is a BAA renewal or a health system's vendor questionnaire asking for the date of your last test.

Does it require a test?

Be careful here, because the market is full of vendors who are wrong about it. The only testing language in the Security Rule is 45 CFR 164.308(a)(7)(ii)(D): “Testing and revision procedures (Addressable). Implement procedures for periodic testing and revision of contingency plans.”

Two things follow. It reaches the contingency plan at 164.308(a)(7), not the security incident procedures at 164.308(a)(6). And it is Addressable, which under 164.306(d)(3) means you must assess whether it is a reasonable and appropriate safeguard in your environment and then either implement it, or document why it would not be and implement an equivalent alternative measure where that is reasonable and appropriate.

So there is a real testing duty here, and there is a documented analysis standing in front of it. What is not true is the sentence a competitor will put in front of you: “HIPAA requires an annual tabletop.” It does not, and the compliance officer you say it to will know it does not.

What the report cites, and from which exercise

• 45 CFR 164.308(a)(7)(ii)(D)Testing and revision procedures — the record of a test, and the revision items it produced
• 45 CFR 164.308(a)(6)(ii)Response and reporting: identify, respond, mitigate, and document the incident and its outcome
• 45 CFR 164.308(a)(7)(ii)(B)Disaster recovery plan — that the room knows the restore path and who authorises it
• 45 CFR 164.308(a)(7)(ii)(C)Emergency mode operation plan — the degraded process, and what protects ePHI inside it
• 45 CFR 164.308(a)(7)(ii)(E)Applications and data criticality analysis: the restore order, argued out loud

5 identifiers across the four scenario packs. Only the ransomware pack maps it. The security incident specification and the contingency plan family. The Security Rule only: breach notification lives in Subpart D — 164.402 through 164.412 — and none of it is claimed, even though the room will argue about the notification clock. A tabletop is also not a risk analysis under 164.308(a)(1)(ii)(A), and it does not evidence that your backups are retrievable.

Who it applies to

Financial entities in the EU — banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and more — plus the ICT third-party providers serving them. It is a Regulation, so it binds directly, without waiting for national law.

Does it require a test?

Article 11(6), point (a) is explicit: financial entities shall “test the ICT business continuity plans and the ICT response and recovery plans in relation to ICT systems supporting all functions at least yearly, as well as in the event of any substantive changes to ICT systems supporting critical or important functions”. Point (b) adds the Article 14 crisis communication plans, with no frequency stated.

The next subparagraph requires entities other than microenterprises to include scenarios of cyber-attacks in those testing plans. DORA never names a tabletop, a simulation or any other delivery format.

Article 11(6) is the clause to cite. Do not let anyone sell you Article 25(1) as an annual scenario-test mandate — it is a non-exhaustive list with no frequency attached to it.

What the report cites, and from which exercise

• Article 17(3), points (b) to (f)The ICT-related incident management process, walked end to end
• Article 18(1) and (2)Classification of incidents against the criteria — argued in the room, on the clock
• Article 19(1), (2), (3) and (4)Major-incident reporting decisions and the notification path
• Article 14(1) and (3)Communication plans for clients, counterparties and the public
• Commission Delegated Regulation (EU) 2024/1772, Article 8The major-incident thresholds, applied to the scenario in front of the room
• Commission Delegated Regulation (EU) 2025/301, Article 5Time limits for the initial notification and for the intermediate and final reports

6 identifiers across the four scenario packs. Only the supply-chain breach pack maps it. Incident management, classification, communication and reporting. Article 11(6) is the clause that makes you run the test; it is not mapped as a control, because the exercise is the test rather than evidence about it. Nothing in Chapter V on ICT third-party risk, and nothing in threat-led penetration testing under Articles 26 and 27 — TLPT is a different exercise entirely, run by different people.

Who it applies to

Essential and important entities across energy, transport, banking, health, drinking water, digital infrastructure, public administration, manufacturing and more, in every Member State. It is a Directive: scope, supervision and penalties reach you through your country's transposing law, not through the text itself.

Does it require a test?

The Directive itself requires no test. Article 21(2), point (f) requires “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” — a policy-and-procedure duty, and we will not stretch it into a testing obligation.

The testing duty is in the Implementing Regulation. Its Annex, point 3.1.3: the roles, responsibilities and procedures laid down in the incident-handling policy “shall be tested and reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes to operations or risks.” Point 4.1.4 says the same of the business continuity and disaster recovery plans, and adds that they must incorporate lessons learnt from those tests.

That Regulation binds one group: DNS service providers, TLD name registries, cloud computing and data centre providers, content delivery networks, managed service and managed security service providers, online marketplaces, search engines, social networking platforms and trust service providers. If you are a hospital, a utility or a manufacturer in NIS 2 scope, your testing duty comes from your Member State's law, and what it says is a question for your counsel and not for a vendor's website.

What the report cites, and from which exercise

• Article 21(2), point (b)Incident handling
• Article 23(1)The duty to notify a significant incident, and the decision that it is one
• Article 23(4), point (a)The 24-hour early warning, and whether the room commits to it
• Article 23(4), point (b)The 72-hour incident notification and what it has to contain
• CIR (EU) 2024/2690, Annex, point 3.4Event assessment and classification
• CIR (EU) 2024/2690, Annex, point 3.5Incident response

6 identifiers across the four scenario packs. Only the cloud account compromise pack maps it. Incident handling and the reporting clock. If you are not one of the entity types the Implementing Regulation names, the two rows drawn from it are not law for you — they are the Regulation's, not the Directive's. The notification deadlines above are the Directive's own; how they land on you is your national transposition's business, and your counsel's.

Who it applies to

Anyone, which is the point. CSF 2.0 is the vocabulary a customer security questionnaire, an insurance broker or a board committee reaches for when it wants to ask about your programme without picking a certification scheme.

Does it require a test?

CSF 2.0 states outcomes, not requirements. It mandates no test, no exercise and no drill of any kind, and any vendor telling you it does has not read it.

The closest published outcome is ID.IM-02: “Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties.” That is an outcome an organisation may adopt in its own Target Profile. If it is in yours, the expectation is one you chose — it is not NIST's, and it certainly is not ours.

Which is why the honest pitch here is not a deadline. It is that when the questionnaire arrives written in CSF language, RESPOND and RECOVER are the Functions with the least to show, and an exercise is the cheapest thing that puts something in them.

What the report cites, and from which exercise

• RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-05Executing the plan with third parties, triage, categorisation, and applying the criteria for starting recovery
• RS.AN-03, RS.AN-06, RS.AN-07, RS.AN-08Analysis, the preserved record of investigative actions, incident data and provenance, and estimating magnitude
• RS.CO-02, RS.CO-03Notifying internal and external stakeholders, and what is shared with them
• RS.MI-01Containment
• RC.RP-02Recovery actions selected, scoped, prioritised and performed
• DE.AE-08Incidents declared when adverse events meet the defined criteria
• GV.RR-02, GV.OC-03, GV.SC-08Roles and authorities, legal and regulatory obligations, and third parties inside the response

16 identifiers across the four scenario packs. All four scenario packs map it. 16 of the 106 Subcategories CSF 2.0 publishes, concentrated in RESPOND, with RECOVER, DETECT and GOVERN alongside. Nothing from PROTECT and nothing from IDENTIFY. A tabletop is not a control assessment, and a CSF Subcategory is a desired outcome rather than a control with a pass mark.

Who it applies to

Nobody, as an obligation. It arrives second-hand: a consultant specifies an exercise against it to close an incident-management finding, or your incident response plan was written to its structure and your internal audit follows the plan's own vocabulary.

Does it require a test?

The series states its guidance in “should” form and places no obligation on the reader. There is no certification scheme against it and nobody is audited to it, so not following any of it is not a nonconformity against anything.

What it has that none of the other eight has is a clause about this exact activity. ISO/IEC 27035-2:2023 Clause 11.2 covers exercises — defining the goal, defining the scope, and conducting one — and ISO/IEC 27035-4:2024 covers coordinated multi-organisation exercises. If somebody handed you a finding that cites 27035, this is the map that speaks back to it in its own terms.

What the report cites, and from which exercise

• 27035-1:2023, 5.3, 5.4, 5.5, 5.6The detect-and-report, assess-and-decide, respond and learn-lessons phases, walked in order
• 27035-1:2023, 4.6Communication during an incident
• 27035-1:2023, 4.7.3The incident management log — what the room says is being written down, and where
• 27035-2:2023, 6.5Applying the incident classification scale to the event in front of them
• 27035-2:2023, 6.9Handling confidential or sensitive material during the response
• 27035-2:2023, 8.3Dealing with external interested parties
• 27035-3:2020, 8.2.4, 9.2, 12.3Escalation judgment, how triage is conducted, and establishing external reporting where it is required

12 identifiers across the four scenario packs. All four scenario packs map it. The detect, assess, respond and learn clauses across parts 1, 2 and 3. Nothing from the clauses about standing up the capability in the first place — an exercise does not build an incident management team, it finds out whether the one you have can work.

Each scenario pack maps only the frameworks it can honestly evidence, so the framework you need decides the scenario you run. A ransomware exercise produces HIPAA evidence and no PCI DSS evidence, because nothing in it touches cardholder data. PCI DSS and DORA come from the supply-chain breach. NIS 2 comes from the cloud account compromise. If a specific regime is what sent you here, pick accordingly — or run more than one exercise, which is what the multi-exercise tiers are for.

SOC 2, ISO/IEC 27001, NIST CSF 2.0 and ISO/IEC 27035 are in all four, because an incident-response decision evidences something in each of them whatever the scenario is.