Drills

Rehearse a CRA Art. 14 filing end to end with a tabletop drill: real clocks, a simulated SRP, and nothing sent to authorities.

Plans: Core and Plus, and the free trial. Who: any member starts and completes a drill.

A drill is a tabletop exercise that runs the whole CRA Art. 14 flow on a practice incident: from the determination to the final report, with the clocks running. Your team works it in Pharus exactly as it would a real incident, and nothing reaches an authority. When you complete it, Pharus records how long each step took against the CRA’s windows, and what you learned. The app suggests rehearsing at least once a year, before you need it for real.

How a drill differs from a real incident

	Real incident	Drill
Reference	INC-0042	DRILL-0003, a separate series
Banner	None	”Exercise — not a real incident. Nothing is sent to authorities.” and an EXERCISE watermark
Awareness	When you became aware	When the drill starts
SRP pack	You file it in the SRP	You don’t file it. The recipient shows as “(simulated) NCSC-FI via SRP”
Receipt	Record receipt with the SRP’s reference	Simulate SRP receipt, which generates a reference such as DRILL-RCPT-1A2B
Paging	Real pages to on-call	At most one test page, when the drill starts
Deadline warnings	Yes	No
VEX status	A determination can change it	Never changed: a drill isn’t linked to a real match
Lists and reports	Counted	Kept out of the Overview, the open and closed incident lists, the weekly exposure digest, and the board report’s incident numbers
Ends with	Close incident	Complete drill

The DORA and Users tabs don’t appear on a drill.

Start a drill

1. Open the Drills tab

   Go to Incidents and select the Drills tab, then Start drill.

2. Pick a scenario

   Under Scenario, choose Actively exploited vulnerability or Severe incident.

   • Actively exploited vulnerability: “Pharus uses a real CISA KEV match when the family has one.” Without one, the drill uses CVE-2021-44228 (Log4Shell) in a component the family ships, and says it is a canned scenario.
   • Severe incident: a suspected compromise of the update server, where a tampered firmware update may have reached customers.
3. Pick a product family

   The Product family gives the scenario its product, versions and member states. You can also run a drill with No product family.

4. Add a facilitator note

   Facilitator note is optional and shown on the drill only: roles, injects, what to watch for. For example, “Kari is on call, Ola approves. Inject at 30 min: the vendor confirms exploitation.”

5. Choose whether to page on-call

   Tick Page on-call as part of the drill to send a test page by SMS to the person on call now, marked as a test. It is never a real page.

6. Start

   Select Start drill. Pharus opens the new drill with awareness set to now and the clocks running.

Run the drill

Work the drill like an incident, with the same tabs and the same permissions:

1. Record and approve the determination on the Determination tab. See Decision record.
2. Check the CSIRT route on the Routing tab.
3. On the SRP pack tab, prepare each report. The pack says: “Exercise: don’t file this pack in the real SRP. Mark it as submitted here, then simulate the receipt.”
4. Select Mark as submitted, then Simulate SRP receipt. “Here Pharus records a simulated one through the normal filing path, so the clocks and the audit trail behave as they would for real.”
5. For a vulnerability scenario, record when the fix is available on the Overview tab to start the final report clock. See Reporting clocks.

Complete a drill

1. Open the banner

   On the drill, select Complete drill in the banner at the top.

2. Write what you learned

   What did you learn? is required: what went well, what slowed you down, and what you will change before a real incident.

3. Complete

   Select Complete drill. Pharus closes the drill as Drill complete and records each step’s time from awareness against the CRA Art. 14 windows.

A drill that an approved not-reportable determination closed early can still be completed: the banner says “Closed before the drill was completed. Complete the drill to record the outcome.” A completed drill can’t be completed again. Completing stays open on every plan, so a drill already running can be finished after a downgrade.

The drill summary

The Drill summary on the drill’s Overview tab lists each milestone with its time, the time from awareness, the window it is judged against and the result:

Milestone	Judged against
Awareness	No window
Determination recorded	24 h, because the early warning needs a determination in force
Determination approved	24 h
Early warning submitted	24 h
Notification submitted	72 h
Early warning receipt, Notification receipt	No window
Final report submitted	14 days after the fix (vulnerability) or 1 month after the notification (severe incident)
Final report receipt	No window

Each result is Met, Missed, Not reached, Done (no window) or Not required. The score, such as “4/5 on time”, counts the milestones with a window. The summary also shows the facts of the drill, the facilitator note, whether on-call got a test page, and the lessons learned. Print summary prints it.

The Drills tab lists every drill with its scenario, product family, start and completion times, the score and its status: In progress, Completed or Closed.

In the board report and the audit trail

• The board report has a Drills section with the drills started and completed, the last drill completed, and whether the annual drill is done or due. Drills never count towards its incident or reporting numbers.
• The audit trail records “Started tabletop drill” and “Completed tabletop drill” with the duration, next to every action taken during the drill. A drill’s own Audit tab shows them in order.

Related

SRP paste pack

The pack you practise with, and file for real.

Board report

Where drill outcomes show each quarter.

On-call rota

Who gets the test page when a drill starts.

Reporting clocks

The windows each drill milestone is judged against.