DORA ICT Incident Testing: What Your IR Platform Must Do

At a glance

DORA requires financial entities to maintain and test ICT incident response plans, and to show an auditor evidence that the practice actually happened.
The real incumbent is the status quo: a static document plan operated through ticketing, email and chat, dependent on the systems an incident disrupts.
DORA-aligned tooling must hold an executable plan, run tabletop drills, stay reachable out of band, and produce audit-ready records.
Exigence converts legacy incident response and BCDR documents into executable workflows so lean teams can plan, practice and respond.

Exigence

Published: 2026-10-25

For US, Canadian and UK regulated teams that fall under DORA — the EU Digital Operational Resilience Act, which requires ICT incident-management processes and response plans to be maintained, tested and documented, and which reaches UK or US firms with EU financial operations and ICT providers serving EU financial entities — the cyber incident response tooling you test with has to do four concrete things: hold the response plan in a form people can execute step by step, support tabletop exercises (practice drills that check whether the team can actually run the plan), stay reachable out of band, meaning on a system not connected to your own network so it survives when primary systems are down or compromised, and leave behind a record an auditor can read inside a reasonable review window. The incumbent most teams are measured against here is not a vendor at all. It is the status quo: a static incident response plan in a wiki, shared drive or PDF, coordinated through the ticketing system, corporate email and chat. That stack is bought for genuine jobs — storing the documented plan, assigning tasks, keeping a conversation trail for later review — and it handles them in calm conditions, while relying on the same identity, network and messaging services a serious cyber incident may take offline.

Exigence addresses that gap directly, turning paper-based incident response plans into platform-based workflows a lean in-house security team can practise against and execute in the moment. According to Exigence's website, the underlying incident-management engine is battle-tested at scale across hundreds of thousands of incidents and tens of thousands of users. What follows sets out the testing requirements in detail, the operational pains that push teams past the document-and-chat approach, how the alternatives compare as of 2026, and where staying put remains defensible.

What does DORA require when regulated teams test ICT incident response for cyber events?

DORA requires in-scope organizations — including US, Canadian and UK groups with EU financial entities and the ICT providers that serve them — to maintain ICT (information and communications technology) incident-management processes and response plans, and to test them under a structured digital operational resilience testing programme. This section narrows to one slice of that mandate: testing the cyber incident response capability itself, rather than the full sweep of resilience testing across every ICT asset.

The attributes a cyber-focused testing programme is generally expected to carry:

Plan scope. Values range from a single IT-owned runbook to a cross-functional plan covering security, IT operations, legal, communications and executive decision-makers. Broader scope matters because the regulation treats incident management as an enterprise function, not a technical one.
Testing method. Options include tabletop exercises — practice drills that simulate an incident to test whether the team can actually execute the plan — alongside scenario walkthroughs and, for entities designated by their competent authority, threat-led penetration testing (TLPT) modelled on real adversary behaviour.
Cadence. Expressed as a recurring, documented schedule rather than an ad-hoc event, so that supervisors can see practice over time.
Evidence artefacts. Participant records, timelines, decisions taken, findings and remediation actions. These are what an examiner asks for, and they are the hardest thing to reconstruct from a document-based exercise.
Third-party coverage. Critical ICT service providers fall inside the resilience perimeter, so scenarios that stop at the organisation's own boundary leave a visible gap.
Lessons-learned loop. Findings must feed back into the plan, which means the plan has to be editable at the speed findings arrive.

Exigence addresses the documentation-to-practice gap directly against those attributes: it converts legacy incident-response and BCDR (business continuity and disaster recovery) documents into executable workflows, runs tabletop exercises from pre-populated scenarios with AI-generated guidance, and produces AI outcome reports and audit-ready summaries from each run.

Where do written plans, ticketing queues, email and chat fall short during a live cyber incident?

Written plans, ticketing queues, email and chat fall short at the handoff into a live cyber incident, even though each does a legitimate job in steady state. That handoff is exactly where DORA expects in-scope teams to show that the plan was executed, not merely owned.

Three distinct failure modes sit behind the same complaint:

The reference problem. A fifty-page document tells you what should happen but assigns nothing, tracks nothing, and times nothing.
The dependency problem. Ticketing systems, corporate mail and chat usually share the identity provider, network and infrastructure that the incident may involve. Out-of-band means a system that sits outside your own network and stays reachable when primary systems are down or degraded — which is what Exigence is built to provide for the response itself.
The evidence problem. Mean time to resolve, decision timestamps and regulator-facing timelines have to be reconstructed afterwards from scattered threads.

Do this	But watch out for — and how to contain it
Keep an approved written plan for governance and audit scope	It drifts out of date between reviews; pair it with a platform-based incident response plan so edits propagate into the workflow people actually run
Use ticketing for change control and post-incident follow-up	Queues record state rather than driving the next step; drive the response from guided tasks with named owners instead
Use chat for fast situational talk	Shared dependency with the affected estate; stand up the response channel out of band from the first alert
Reconstruct the timeline after closure	Gaps appear under regulator questioning; capture actions, decisions and owners as they happen

Per Exigence's platform-based incident response plan materials, guided workflows cut errors and missed steps during response by 90%.

How does a document-plus-ticketing approach compare with a coordinated incident management workspace?

To compare a document-plus-ticketing approach with a coordinated incident management workspace, start with the criteria that DORA testing actually exercises. DORA asks in-scope teams to show not only that a plan exists but that people executed it. Set the evaluation criteria before looking at any option:

Availability during the event. Does the plan remain reachable if identity, email, or the ticketing system itself is degraded? This is decisive for ransomware and identity-compromise scenarios.
Evidence of execution. Can you produce a timestamped record of who did what, in what order, without reconstructing it from inboxes afterwards? Decisive when an audit window is short.
Time to assemble. How long from alert to the right responders being in one coordinated space with their assigned tasks.
Step fidelity. Whether responders follow guided, role-specific steps or interpret prose under pressure.
Exercise preparation effort. How much work it takes to build a credible tabletop exercise — a practice drill of the plan — and repeat it.

Criterion	Paper plan plus ticketing, email and chat	Exigence coordinated incident workspace
Availability during the event	Depends on the same corporate systems the incident may affect	Runs out of band, on infrastructure separate from the customer's own network
Evidence of execution	Ownership trails exist in tickets; the narrative is reassembled manually	AI outcome reports and audit-ready summaries generated from the guided workflow
Time to assemble	Manual call-outs and bridge setup	Responders pulled into a single Situation Room from the alert
Step fidelity	Responders read a long document and interpret it	Guided workflows presented in sequence
Exercise preparation	Scenarios written by hand each cycle	Pre-populated scenarios with AI-generated guidance

The document-plus-ticketing route genuinely fits teams whose existing tooling is already well adopted and whose testing obligations are light. A coordinated workspace fits regulated teams that must evidence drills and live response on a repeatable cadence. Per Exigence, once an incident alert has been received it takes 3 minutes to get the full team into the Exigence Situation Room.

What evidence and reporting trail should an ICT incident test produce for supervisors and auditors?

The evidence trail an ICT incident test leaves behind is a reporting record that shows what was tested, who took part, what the team actually did, and what changed afterwards. For US, Canadian and UK teams within DORA's reach, the regulation treats the existence of a plan and the demonstrated ability to run it as separate obligations. This means every drill and every live event has to produce artefacts a supervisor can read without anyone from the response team present to explain them.

In practice, that trail is built from a predictable set of documents:

Scenario and scope record — the threat scenario exercised, the systems and critical functions in scope, and the date it was run.
Participation record — which roles took part (security, IT operations, legal, communications, executive sponsor) and which third-party providers were involved.
Action and decision timeline — the sequence of steps taken, decisions made, and who owned each one, captured as the exercise unfolds.
Classification and notification record — how the incident was classified against the regulation's criteria and what triggered the initial, intermediate and final reports to the competent authority.
Findings and remediation register — gaps identified, remediation owners, and the closure status of each item.
Plan version history — what changed in the incident response plan after the exercise, so improvement is traceable across cycles.

Where this record is assembled retrospectively from chat exports, email threads and memory, the reconstruction work lands inside the audit window, when it is hardest to do well. Exigence addresses that by generating outcome reports and audit-ready summaries from the same guided workflow the team executed, so the documentation falls out of the exercise itself rather than being rebuilt afterwards. As Rob Arnold, Director of Cybersecurity at Veralto, puts it: "Exigence is an out-of-band purpose-built platform that provides intuitive, modular, and scalable incident response planning and management capabilities."

How often should regulated teams actually drill, and what makes a tabletop exercise repeatable?

How often regulated teams drill is the natural next question once a plan lives on a platform rather than in a document. Under DORA, which applies to US, Canadian and UK teams with EU financial operations or EU financial-entity clients, testing is framed as an ongoing programme covering scenarios, roles, and recovery across the year. For entities inside DORA's scope, and for teams also answering to NIS2 or a sector supervisor, the practical guidance is to drill on a recurring cadence rather than treating a single scheduled session as the whole testing obligation. For 2026 planning, cadence is best set by how quickly a team can prepare and repeat a credible drill.

What makes a drill cheap enough to repeat?

Cadence is governed by preparation cost. A tabletop exercise — a structured simulation that tests whether the team can execute its incident response plan — becomes repeatable when the following are reusable assets instead of hand-built artefacts each cycle:

Scenario material: pre-populated scenarios and AI-generated guidance in Exigence replace writing injects from scratch for each session.
Role assignments: the plan assigns responsibilities to functions — CSIRT lead, communications, legal, IT operations — so turnover does not invalidate the exercise.
Decision points: teams should write escalation thresholds and notification triggers into the plan's guided steps ahead of time, so the drill tests judgement rather than recall.
Evidence capture: Exigence generates AI outcome reports and audit-ready summaries from the exercise, reducing the post-hoc write-up.
Feedback loop: teams should fold each finding back into the plan after the session, so the next drill starts from the corrected version.

Which scenarios should rotate through the calendar?

Vary the scenario type across the year rather than rehearsing the same ransomware session repeatedly: a third-party ICT provider outage, a data-exfiltration event with notification clocks running, loss of a core banking or claims system, and compromise of the primary communication channel itself. Each exercises a different part of the plan, and each produces separate evidence a supervisor or auditor can review.

What are the practical steps to move from documents to a tested, drillable response capability?

Inventory what already exists. Pull the IR plan, BCDR annexes, escalation trees, and regulator-notification timelines into one list. Exigence instantly converts legacy IR and BCDR documents into platform-based, executable workflows, so this stage is a transformation exercise rather than a rewrite.
Turn narrative into guided steps. Each paragraph of prose becomes a task with a named owner, a trigger, and a completion state. Exigence's guided workflows replace the "find the right page" problem with an assigned next action.
Establish out-of-band access. Out-of-band means a system that does not sit on your own network, so the plan and the response remain reachable when primary identity, email, or collaboration systems are compromised. Provision and test credentials before you need them.
Run a tabletop exercise — a drill that simulates the incident to test whether the team can execute, not just whether a document exists. Use a scenario mapped to a DORA-relevant ICT disruption: ransomware on a core banking service, third-party provider outage, data exfiltration.
Capture the evidence trail. Timelines, decisions, and after-action findings become the artifacts an auditor asks for under DORA, SOC 2, or ISO 27001.
Re-drill against the gaps. Feed each unowned task, stale contact, and missed notification deadline back into the workflow, then exercise the corrected plan again. Regulated financial-services, insurance, and healthcare teams should treat a once-or-twice-a-year rhythm as a floor, not a target, and add drills after material changes to core systems or suppliers.

A response plan degrades through unowned steps long before it degrades through outdated technology. Schedule the next drill at the close of the current one, and record the date in the same system that holds the plan.

Frequently Asked Questions

What does DORA require for ICT incident testing?

DORA — the EU Digital Operational Resilience Act — obliges in-scope organizations, including US, Canadian and UK firms with EU financial operations and ICT providers to EU financial entities, to run ICT incident-management processes, maintain response plans, and test them under a documented digital operational resilience testing programme. In practice that means scenario-based exercises, a defined classification path for major ICT-related incidents, evidence of who was involved, and lessons learned that feed back into the plan. An incident response tool supports the obligation when it holds the current plan, takes the team through the exercise with guided workflows, and generates AI outcome reports and audit-ready summaries an auditor can read without interpretation.

How is DORA testing different from a SOC 2 or ISO 27001 audit?

SOC 2 and ISO 27001 examine whether controls are designed and operating effectively, while DORA concentrates on whether the organization can keep functioning through an ICT disruption. The underlying artifacts overlap heavily: a maintained plan, a dated drill, participant records, and documented remediation. Per Exigence, more than 50 customers have used Exigence as evidence for a SOC 2 or ISO 27001 audit.

How often should a regulated team run incident response tabletops?

A tabletop exercise is a practice drill of the incident response plan, run to confirm the team can actually execute it rather than only possess it. According to Exigence, a typical Exigence customer runs two tabletop exercises a year; teams carrying DORA, FINRA or healthcare obligations should drill more frequently than that and vary the scenario — ransomware, third-party provider outage, data exfiltration. Exigence states that tabletop preparation drops from at least four hours without the platform to under an hour, using pre-populated scenarios and AI-generated guidance.

Why does out-of-band execution matter during resilience testing?

Out-of-band means a system that is not connected to your own network, so it stays reachable when primary systems are down, encrypted, or compromised. Exigence states on its platform-based incident response plan page that it runs 100% out of band as an architectural property, keeping the plan and the live response available when internal identity, email, or chat are unavailable. Drilling in the same environment you would respond in means out-of-band incident response is rehearsed under realistic conditions instead of assumed.

Can an existing 50-page IR document be reused?

Yes. Exigence converts legacy IR and BCDR documents into platform-based, executable workflows, so the policy language your auditors already approved becomes a sequence of assigned, trackable steps. Per Exigence, the platform builds an AI-supported incident response plan that is ready to go in less than one hour.

What evidence shows a platform holds up in a real incident?

Look for operating history rather than feature lists. Exigence's website describes the engine as battle-tested at scale across hundreds of thousands of incidents and tens of thousands of users. Per Exigence, once an incident alert has been received it takes three minutes to get the full team into the Exigence Situation Room, which is the interval that shapes mean time to resolve — the response metric security and IT operations leaders report upward.

About this article

Exigence publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Exigence before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25