Recently got referred, hopefully we all land an interview slot for Nasa Emergency Management Specialist. Good luck to all, I’m sure it competitive.

County EM coordinator, been running HSEEP exercises for 11 years, MSEL, controllers, evaluators, hotwash, AAR/IP all of it.

Last month IT ran their annual cyber tabletop and invited me to observe. 2 hours of the IT director reading a scenario off a slide and asking the room what they’d do. No injects that changed anything, nothing got activated, and the after action was an email saying good discussion everyone. Meanwhile the county two over from us lost CAD and payroll for 3 weeks to ransomware.

I want to pitch a cyber functional exercise for spring where we stand up the EOC and departments have to keep services running on paper. Problem is I don’t have the cyber background to write a believable MSEL and IT doesn’t have the exercise design side.

What I hve looked at so far:

•CISA CTEP cyber packages. Closest to what I know but static, the scenario doesnt move no matter what players decide.

•Reflex Security. Someone demoed it at our state EM conference, it builds the scenario from your own org info, AI plays the attacker, press and vendors, and the injects change based on the calls people make. Puts out the AAR at the end too. Not sure yet how that sits with HSEEP evaluation.

•Exigence. A hospital EM friend uses it, but I think it’s more for running the real event than practicing it.

•BreachRx. Came up in a CISA webinar, haven’t dug into it.

•Hiring a contractor to write a custom MSEL, which is what we’d normally do for a full-scale.

Anyone co run a cyber exercise with their IT side? Mostly curious how you handled evaluation.

I've seen a few iterations of the phrase in a few different forums - search and rescue, firefighting, first response, etc. These days, I spend more time working with teams in the international disaster response community, and the adage has been in discussion amongst some of the teams with which we work.

The phrase is typically associated with aspects of physical fitness for roles that require some sort of fitness baseline, but I think there's a bridge between that train of logic and what it takes to be physically, mentally, and emotionally ready for all aspects of the job. As a gross oversimplification, I think this is an area in which the Emergency Management community could stand to improve.

If you're interested in more of the thoughts, you can find them here.