How to conduct a cyber security drill

Charities imagine it’ll never happen to them, until it happens to them. Cyber-attacks are prevalent in our sector because charities often have plenty of sensitive data, outdated systems, limited resources, and a need to redirect funds to service users. Our good work leaves us vulnerable.

But charities can improve cyber security with simple steps, without breaking the bank. They can employ strong passwords , frequently update devices, and offer regular cyber security training to their teams. But perhaps the best way to bolster security is with a cyber security drill, using simulation to ensure preparedness .

The drill is an essential, and oft-overlooked, part of a charity’s security toolkit . In this article, we’ll explore the cyber security drill in detail and look at easy steps you can take to put one into practice.

What is a cyber security drill?

Organisations give employees a scenario, with or without their knowledge, that resembles a real-life cyber attack. That might mean alerting them to a fake ransomware attack, or a false data breach, or perhaps a “stolen” laptop that contains sensitive information. Charities should pick the cyber security attacks that they’re most likely to face, preparing them for the real-world.

The greater the risk, the greater the need for a drill. The most common attack in our sector comes from phishing . So, to use that as an example, a phishing drill might consist of an email seemingly sent from a senior employee, asking others to change the bank details for a supplier payment. The email will feature all the staples of phishing : a sense of urgency, a believable tone, supporting branding and imagery. Charities then monitor the response and improve security based on findings.

The cyber security drill tests preparedness in a controlled setting. They simulate a problem that creates anxiety to minimise future anxiety. If mistakes are made, good: the drill was needed and you can make informed improvements. If employees succeed with aplomb, good: you’ve got robust security and should be prepared for that eventuality. Either way it’s positive.

How do you conduct a cyber security drill?

So how do you conduct a cyber security drill? Below we provide a step-by-step guide showing charities how they can launch a successful drill.

Allocate responsibilities

You’ll first need to decide who’s in charge. Much of that will depend on the size and type of drill and the objectives. Large drills at large charities might demand an entire IT team, but for smaller charities one volunteer would suffice. Charities should always aim to include charity managers and leaders, regardless of size and type of drill, as they’ll need to incorporate findings into future strategies .

You’ll need to decide who you’re testing and whether to employ an open or a closed drill. An open drill informs everyone involved of the upcoming test, providing complete transparency. A closed drill means testing people without their knowledge. Both can be effective.

The type of drill will largely depend on the attack you’re testing. If you’re testing a ransomware attack , for example, you can likely have an open drill, allowing people to learn from the response and monitor its effectiveness. But if you’re testing the response to phishing, a closed drill would prove more desirable, as knowledge limits the ability to effectively test the response.

Set objectives for the drill

You need to establish what you want to test. It’s worth remembering that success stems from failure, as that’ll best prepare you for the real thing. So always pick an area of weakness, rather than an area in which you feel confident, because you’ll find much more room for improvement.

The more realistic, the better. Pick something that might actually happen, then start to build out the scenario. As you’re building, think carefully exactly what you wish to monitor, the employees you want to test, and make choices that will improve your cyber security in the future.

Let’s take data breach as an example. You’ll likely want to look at how quickly your team identifies the breach, the speed with which the breach is contained, the clarity of roles and responsibilities, the effectiveness of internal/external communication, and how quickly the breach was reported.

Ensure cyber security processes are in place

In advance of the drill, make sure you have clear and effective processes for identifying, reporting , containing, and responding to any given cyber attack . Every member of your charity should have visibility of the processes, meaning they can access and action documentation at any time.

The point of the simulation is to test these processes. A drill without processes creates unnecessary pandemonium and you’ll learn precisely one thing: the need to have a process in place. So, if you don’t have a process for a specific attack, now’s the time to create one. Then you can test it.

Run a safe simulation and measure the response

Once you’ve built the simulation, figured out the objectives, and put the right people and processes in place, then you can run the cyber security drill. Remember to practice a safe simulation. Do the exercise on ‘test’ accounts and never use real or sensitive data, even in a test environment. You do not want your simulated cyber security incident to lead to a real cyber security incident.

Then simply observe the response. You should have established core criteria that you’re testing when you built the simulation, but be prepared for unexpected results. Drills can highlight unclear wording in documentation, outdated information, problems with software, and a number of other surprises. All of that is great information. All of that helps you prepare for the future.

Review the results and take in learnings

The focus should be on areas of improvement. Compare the results with original objectives and, if possible, contrast them with other organisations. Then gather feedback from participants. You might ask whether the documentation was easy to follow, whether they understood the degree of risk, how confident they felt in the moment, and so on. Remember that you should never shame any participants if they got anything wrong. Failure is the point. It helps us grow and learn.

Then, once you’ve got the results, develop a plan to improve the future response. That might mean updating policies and procedures, allocating clearer responsibilities, providing additional training, and so on. And, if necessary, you can re-run the drill in the future to monitor improvements.

Follow-up questions for CAI

Artificial intelligence: How to make fair decisions

Why capacity building involves the whole team

Why trustees should be celebrated

How charities can get technology for less

Artificial intelligence and cyber security

Cyber security threats to watch out for in 2027

How cyber security builds trust

Zendesk AI-powered Resolution Suite: free for 6 months

Artificial intelligence: How to make fair decisions

Why capacity building involves the whole team

Why trustees should be celebrated

How charities can get technology for less

Webinar: How charities can unlock more value from their CRM

Webinar: Microsoft Copilot in action – Using AI across Microsoft 365

Webinar: Smarter volunteer reimbursement – what charities are getting wrong

Webinar: An introduction to AI literacy for charities

Webinar: How to create a digital strategy

Charity Digital Academy

Our courses aim, in just three hours, to enhance soft skills and hard skills, boost your knowledge of finance and artificial intelligence, and supercharge your digital capabilities. Check out some of the incredible options by clicking here.

Ask our Charity AI a question

Our chatbot has been optimised using Charity Digital content to provide up-to-date information to meet your every need. Note any help the AI provides may be used to further improve the quality of replies and assistance provided by CAI.