Built on NIST, run like HSEEP.
Cyber Ambush maps to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0, Special Publication (SP) 800-61r3, SP 800-84, SP 800-53, and the Homeland Security Exercise and Evaluation Program (HSEEP) / Cybersecurity and Infrastructure Security Agency (CISA) Cyber Tabletop Exercise Package (CTEP). Exercises produce structured evidence, not just narratives.
NIST Cybersecurity Framework (CSF) 2.0
Cyber Ambush scores against these CSF 2.0 categories.
GV — GOVERN
- GV.OCOrganizational Context
Injects map to mission-critical services and stakeholders.
- GV.RMRisk Management Strategy
Objectives reflect organizational risk tolerance.
- GV.RRRoles, Responsibilities & Authorities
Master Scenario Events List (MSEL) injects test escalation and decision authority.
- GV.SCCybersecurity Supply Chain Risk Management
Verifies third-party contacts and escalation paths.
ID — IDENTIFY
- ID.IMImprovement
AAR findings track corrective actions with owners.
PR — PROTECT
- PR.AAIdentity Management & Access Control
Tests multi-factor authentication (MFA) and privileged access under pressure.
- PR.IRTechnology Infrastructure Resilience
Tests infrastructure resilience and backup isolation.
DE — DETECT
- DE.CMContinuous Monitoring
Simulates alerts to test triage speed.
- DE.AEAdverse Event Analysis
Scores time-to-declaration metrics.
RS — RESPOND
- RS.MAIncident Management
Tracks incident declaration and activation timing.
- RS.ANIncident Analysis
Tests choices between containment and evidence integrity.
- RS.COResponse Reporting & Communication
Tests communications against regulatory deadlines.
- RS.MIIncident Mitigation
Scores containment and evidence preservation.
RC — RECOVER
- RC.RPRecovery Plan Execution
Tests backup integrity and restoration sequencing.
- RC.CORecovery Communication
Drafts recovery messaging and all-clear criteria.
SP 800-61r3 — Incident Response Lifecycle
- CSF-aligned — 800-61r3 maps incident handling to CSF 2.0. Cyber Ambush follows this mapping.
- Triage by risk — Tests prioritization under pressure against organizational risk tolerance.
- Evidence integrity — Tests the tension between containment speed and forensic integrity.
- Leadership briefings — Schedules briefings to practice accurate, calibrated status reporting.
SP 800-84 — Exercise Guidance
- Design — Planning cycle ensures objectives and Master Scenario Events List (MSEL) are set before exercise day.
- Conduct — Facilitator and evaluator consoles enable real-time scenario execution.
- Evaluation — Objectives are scored against pre-defined success criteria.
- Roles — Separates facilitation and evaluation lanes for clarity.
- AAR content — Generates after-action review (AAR) content and improvement plans directly from the exercise record.
SP 800-53 Rev. 5 — IR Control Family
- IR-2IR Training
Provides documented, role-based incident response training.
- IR-3IR Testing
Supports repeatable incident response testing and records.
- IR-4Incident Handling
Covers the full incident handling lifecycle: detection through recovery.
- IR-6Incident Reporting
Tests reporting accuracy and regulatory deadlines.
- IR-8Incident Response Plan
Validates incident response (IR) plans and identifies gaps as corrective actions.
HSEEP / CISA CTEP
- Situation Manual — Scenario briefs generated from objectives and threat profiles.
- MSEL — MSEL-driven injects sequenced by objectives.
- Evaluation guides — Defined success criteria for evaluators set before play.
- AAR/IP delivery — Generates AAR and improvement plan (IP) drafts same-day for faster review cycles.
Traceability Chain
The full chain from planning through after-action reporting.
| Exercise objective | → CSF 2.0 outcome | → SP 800-53 control | → AAR evidence |
|---|---|---|---|
| Recognize and declare an incident | DE.AE, RS.MA-01 | IR-4, IR-6 | time to declaration, severity assigned |
| Escalate to executives | GV.RR, RS.CO | IR-8, IR-6 | decision-makers reached, authority documented |
| Contain without destroying evidence | RS.MI, RS.AN | IR-4(12) | isolation decisions, forensic preservation |
| Meet notification clocks | RS.CO-02/03 | IR-6, IR-8 | Regulatory timelines identified |
| Coordinate vendors and law enforcement | GV.SC, RS.CO | IR-4(10), IR-6(3) | contacts and contracts current |
| Restore and verify | RC.RP, RC.CO | IR-4(3), CP-10 | backup integrity and restoration order |
| Capture lessons | ID.IM-02 | IR-3(3), IR-4c | AAR delivered with corrective actions |
Regulatory clocks
Stress-test whether your organization can hit these deadlines.
| Regime | Clock | Trigger |
|---|---|---|
| SEC Form 8-K Item 1.05 | 4 business days | from materiality determination |
| GDPR Art. 33 | 72 hours | from awareness of breach |
| HIPAA Breach Notification | 60 days | from discovery |
| NYDFS Part 500 | 72 hours | after determining occurrence; 24h for extortion payment |
| NIS2 | 24h warning, 72h notification | from awareness of significant incident |
| DORA | 4 hours initial | from major ICT incident classification |
| US state breach laws | 30 to 60 days | from discovery; varies by state |
| CIRCIA | 72h incident, 24h ransom | when final rule takes effect (est. 2026) |
Clocks are indicative; consult counsel for applicability. Details on the sources page.