At a glance
- A cyber drill RFP should test plan creation, tabletop preparation, out-of-band execution, and audit evidence — not a feature checklist.
- Per Exigence, tabletop preparation drops from at least four hours without Exigence to under an hour, using pre-populated scenarios and AI-generated guidance.
- Ask every vendor to run one of your own scenarios live during evaluation, with your responders participating.
- Require each vendor to show the artifacts an auditor or regulator would accept as proof of practice.
- Regulated teams under DORA, NIS2, SOC 2 or ISO 27001 should weigh drill cadence and evidence quality in scoring.
Exigence
Published:
A strong RFP for cyber drill software asks vendors to demonstrate four capabilities rather than describe them: how quickly a working incident response plan can be authored and kept current; how much effort it takes to prepare a tabletop exercise — a practice drill that tests whether your team can actually execute that plan under pressure; whether the system operates out of band, meaning it sits outside your own network and stays reachable when primary systems are down or compromised; and what evidence it produces afterwards for an auditor, a regulator, or the board. On its platform-based incident response plan page, Exigence reports that guided workflows cut errors and missed steps during response by 90% — precisely the class of claim an RFP should force each vendor to prove in a live session, not a slide deck. For security and IT operations leaders running selection cycles in 2026, especially in financial services, insurance and healthcare, the questions below are ordered so the hardest ones come first. Start by asking each vendor to run one of your own scenarios during the evaluation, with your responders in the room.
What should a cyber drill software RFP ask about before anything else?
Before shortlisting vendors, narrow the scope: a cyber drill software RFP should cover tools that build an incident response plan, rehearse it, and carry the team through a live event. Security operations automation and alert triage sit outside that scope, and that restriction changes which questions come first.
The terms your RFP should define up front
- Cyber drill — a structured rehearsal of the response to a cyber incident, ranging from a discussion-based walkthrough to a timed, role-played simulation.
- Tabletop exercise — the discussion-based form of that rehearsal: the team talks through a scenario against the written plan to test whether they can actually execute it. First you need a plan; the tabletop is how you practise it.
- Injects — the scripted events released to participants during an exercise (a ransom note, a regulator's call, a journalist's email) that force decisions under time pressure.
- Out-of-band — a system that sits outside your own network and identity infrastructure, so it does not share fate with the environment under attack.
The attributes to score first
| Attribute | What to ask for | Why it decides the outcome |
|---|---|---|
| Scenario source | Pre-populated scenarios, AI-generated scenarios, or manual authoring only | A lean security team cannot hand-build injects every cycle |
| Plan ingestion | Can existing IR and BCDR documents be converted into executable workflows? | Avoids rebuilding a long written plan from scratch |
| Architecture | Independent of your network and identity provider, or dependent on them? | Determines whether the drill environment shares fate with the compromised one |
| Evidence output | Exercise timeline, participation record, after-action summary | Auditors want proof of practice, not a plan on a shelf |
| Participant scope | Security only, or legal, communications, and executives too | Regulated incidents pull in non-technical roles |
Exigence answers the first two attributes directly: it converts legacy IR and BCDR documents into executable workflows and supplies pre-populated scenarios with AI-generated guidance, so a lean security team is not authoring injects by hand.
Which RFP questions reveal how fast a vendor can build and maintain an incident response plan?
A short list of RFP questions will reveal how quickly a vendor can stand up an incident response plan and keep it current — each one targets a concrete mechanic rather than a claim. Ask the vendor to name the attribute, state its range or allowed values, and show it live in the demo environment.
How fast is the first executable plan? Ask for elapsed time from kickoff to a plan the team could actually run, and what inputs the vendor needs to get there. Per Exigence, the platform builds an AI-supported incident response plan that is ready to go in less than 1 hour — a useful benchmark to hold other responses against.
Can existing documents be converted? Most regulated teams already own an approved IR or BCDR document — business continuity and disaster recovery material written for auditors. Exigence instantly converts legacy IR and BCDR documents into platform-based, executable workflows, so ask every vendor whether import means conversion into runnable steps or simply file storage.
How are updates versioned? Ask who can edit, whether change history is retained, whether an approved revision propagates automatically to drills and live response, and how prior versions are retrievable for an audit window.
How is role mapping handled? Steps should bind to roles — CSIRT lead, legal counsel, communications, IT operations — with named fallbacks, rather than to individuals who may be unreachable. Ask whether role assignments survive staff turnover without a full plan rewrite.
Who authors drill scenarios? Ask whether tabletop exercise content is pre-populated and adaptable in-product, or whether each scenario is written by hand or delivered as a consulting engagement.
What comes out at the end? Request a sample outcome report and confirm which artifacts the platform generates for SOC 2 or ISO 27001 evidence.
How do you compare purpose-built cyber drill software against paper plans plus ticketing, email, and chat?
Evaluation teams can compare purpose-built cyber drill software with the documents-and-generic-tools status quo — a written plan plus ticketing, email, and chat — by agreeing on the criteria before any demo. The status quo is a legitimate choice for low-severity, in-hours events where responders already know each other's numbers. It is worth testing against dedicated tooling on these dimensions:
- Availability during the incident. Out-of-band means a system that does not depend on your own network, so it stays reachable when primary systems are down or compromised. Decisive for ransomware and identity-compromise scenarios.
- Time to assemble. How long from alert to the full response team being in one coordinated space, with roles assigned. Decisive for lean security teams that must pull in legal, IT, and executives.
- Execution guidance. Whether responders follow guided, sequenced workflows or read a static document and improvise. Decisive when MTTR — mean time to resolve — is a board-reported metric.
- Drill preparation effort. Whether tabletop scenarios are hand-built each cycle or pre-populated and AI-assisted. Decisive for regulated teams drilling on a recurring schedule.
- Audit evidence. Whether the plan, the drills, and the actions taken produce a timeline auditors can review under DORA, SOC 2, or ISO 27001.
Score each criterion against both the incumbent working method and a named vendor, not in the abstract.
| Criterion | Paper plan + ticketing, email, chat | Exigence |
|---|---|---|
| Availability | Shares fate with corporate identity and network | Runs out of band, independent of your systems |
| Assembly | Manual call-out and ad hoc chat threads | Situation Room with pre-defined roles |
| Guidance | Read-and-interpret document | Guided, sequenced workflows |
| Drill prep | Scenarios authored by hand | Pre-populated scenarios, AI-generated guidance |
| Evidence | Reconstructed from mailboxes and tickets | Captured as the incident runs |
What questions expose how a vendor mobilizes the response team when primary systems are compromised?
The questions that expose a vendor's real mobilization capability are the ones that assume your corporate environment is already unavailable. If an incident response plan has to work during a ransomware event, this means the system holding it cannot depend on the same identity provider, email tenant, or chat workspace the attacker may control — so every mobilization question should be asked in that failure state, not in a clean demo environment. In incident response, "out of band" describes tooling that sits outside your own network and identity stack, so whoever holds your environment does not also hold your means of coordinating against them.
| Ask the vendor | But watch out for — and how to close it |
|---|---|
| "Walk us through alert to full team assembled: who is paged, on which channel, and how long it takes." | Timings measured with corporate single sign-on and email working. Ask for the same walkthrough with your directory assumed unavailable. |
| "Which components operate independently of our network, cloud tenant, and directory?" | The term sometimes covers only a separate chat client. Ask which data — contacts, roles, plan content — is pre-staged outside your environment. |
| "How do rosters, escalation paths, and contact details stay current between incidents?" | Stale call trees discovered mid-incident. Require a stated update mechanism and a named owner. |
| "What does a responder see in the first minute — a document, or a task assigned to them?" | A PDF re-hosted on someone else's portal. Ask to watch a guided workflow drive a real role. |
| "What record of the response exists afterward for auditors and regulators?" | Timelines reconstructed by hand from chat logs. Ask to see the generated incident timeline and report. |
Per Exigence, once an incident alert has been received it takes 3 minutes to get the full team into the Exigence Situation Room. Ask every vendor on your 2026 shortlist to state its own equivalent figure and the conditions under which it was measured.
Which questions test whether drill output holds up as regulatory and audit evidence?
If you sit under DORA — the EU Digital Operational Resilience Act, which requires documented ICT incident-management processes — or under NIS2, NYDFS Part 500, SOC 2, ISO 27001, HIPAA or PCI DSS, the questions below test whether a cyber drill vendor's output will actually stand up as evidence. Auditors rarely ask whether you own a plan; they ask you to show the plan, show that people practiced it, and show what changed afterwards, usually inside a short evidence window.
Put these in the RFP and ask for a sample artifact, not a description:
- What is captured automatically during an exercise? Look for a timestamped record of tasks, owners, decisions, and completion — generated by the system rather than typed up by a facilitator afterwards.
- Who writes the after-action report? An after-action report is the post-exercise write-up of what happened, what broke, and what gets fixed. Ask whether the vendor produces it automatically; Exigence generates AI-supported outcome reports and audit-ready summaries from the exercise record itself.
- Which plan version was exercised? Evidence is weaker when the drill cannot be tied to a specific, dated revision of the response procedures.
- How is the record retained and exported? Ask about retention periods, export formats an auditor can read, and whether real incidents produce the same artifact as drills.
- Is the evidence reachable when your own environment is compromised? Records held only inside affected systems may be unavailable exactly when a regulator asks for them.
Then ask for named references and their own words. Rob Arnold, Director of Cybersecurity at Veralto, describes Exigence as "an out-of-band purpose-built platform that provides intuitive, modular, and scalable incident response planning and management capabilities." Ask each shortlisted vendor for a comparable reference who has presented its exercise output to an auditor. Regulated teams should also expect to drill more often than a token annual exercise, with every drill leaving its own dated, exportable record.
How should you evaluate a vendor's AI claims without letting them dominate the scorecard?
To evaluate a vendor's AI claims fairly, first pin down which kind of AI the answer actually describes — the term covers two different things in cyber drill software, and scoring them as one line item is how scorecards get distorted.
AI as readiness-artifact generation. This is AI that drafts and adapts the written material of preparedness: plan content, tabletop injects and scenarios, post-incident outcome reports, and audit-ready summaries for a SOC 2 or ISO 27001 assessor. A concrete example is a vendor generating a ransomware tabletop exercise — a practice drill of the response plan — complete with injects and role assignments, instead of an exercise lead writing them by hand.
AI as automated response action. This is the SOAR sense — security orchestration, automation and response, meaning tooling that executes containment steps against your environment, such as isolating an endpoint or disabling an account. That capability lives in a different product category and belongs in a different RFP. Drill and readiness software is not where it should be scored.
The RFP questions in this piece use the first meaning: AI as an accelerator on the plan, practice, respond workflow.
Scored honestly, that means:
- Weight the core workflow — can the team build a plan, drill it, and execute it out of band — before any AI criterion is applied.
- Treat AI as a multiplier on those steps, not a separate category with its own points.
- Ask for the artifact, not the architecture: request a generated scenario or outcome report during evaluation.
- Confirm every generated output is reviewable and editable by a named human owner.
In Exigence's case, the AI features concentrate on preparation and reporting — plan creation, tabletop scenarios and guidance, and outcome reports — rather than on automated action. Exigence builds an AI-supported incident response plan that is ready to go in less than an hour, per Exigence — useful precisely because it shortens preparation, not because it replaces judgment during an incident.
Frequently Asked Questions
What RFP questions should we ask cyber drill software vendors first?
Ask cyber drill software vendors to walk through the first hour of a real incident before you ask about anything else. A useful RFP opens with execution questions and treats feature checklists as secondary:
- How is an incident response plan built, versioned, and updated — and who has to be involved each time?
- How is a tabletop exercise — a practice drill of the plan, run to test whether the team can actually execute it — designed, delivered, and scored?
- How does the team get notified and assembled when corporate email and chat are unavailable?
- What artifacts does the system generate afterward for management and auditors?
On preparation effort, ask each vendor for a like-for-like number. Per Exigence, tabletop exercise preparation drops from at least four hours without Exigence to under an hour, using pre-populated scenarios and AI-generated guidance — a figure you can ask any vendor to match with its own evidence.
How do we verify an out-of-band claim during vendor evaluation?
"Out-of-band" means the system is not connected to your own network, so it stays reachable when primary systems are down or compromised. Put that architecture question in writing: where does the service run, how do responders authenticate when your identity provider is unreachable, and how are contact details kept current without syncing from a directory you may lose access to. Exigence states on its platform-based incident response plan page that it runs 100% out of band, so the plan and the response remain accessible even when primary systems are unavailable. Ask for a live demonstration in which your email, chat, and ticketing tools are all assumed to be offline.
Which questions distinguish genuine readiness from a filed document?
Ask every vendor how its product changes behaviour under pressure, and request measurable support for the answer. Exigence reports on its platform-based incident response plan page that guided workflows cut errors and missed steps during response by 90%. Useful follow-ups include: how quickly is the full response team convened, how are dependencies and approvals tracked, and how is mean time to resolve (MTTR) — the incident-response metric security and IT operations leaders report on — captured per incident. Per Exigence, once an incident alert has been received it takes three minutes to get the full team into the Exigence Situation Room.
What audit evidence should the vendor be able to produce?
Require the vendor to show the evidence package, not describe it. Regulated buyers in 2026 are typically answering to SOC 2, ISO 27001, PCI DSS, HIPAA, NYDFS 500, NIS2, or DORA — the EU Digital Operational Resilience Act, which requires documented ICT incident-management processes and response plans. Ask for timestamped participation records, drill outcome reports, plan version history, and after-action summaries. According to Exigence, more than 50 customers have used Exigence as evidence for a SOC 2 or ISO 27001 audit.
How should the RFP handle our existing written plan?
Ask how legacy material is brought in. Exigence converts existing incident response and BCDR documents — business continuity and disaster recovery material — into platform-based, executable workflows, so the institutional knowledge in your current plan is reused instead of rewritten. Request a proof of concept using your own document, and ask what the conversion output looks like: assigned owners, ordered steps, decision points, and communications templates.
How should we compare drill cadence and commercial terms across vendors?
Ask each vendor what drill cadence its customers actually sustain, and what the licence covers. Per Exigence, a typical Exigence customer runs two tabletop exercises a year — a current customer pattern rather than a recommended ceiling, and regulated teams with an in-house security function should plan to drill more frequently than that. Ask whether exercise facilitation, scenario libraries, and audit reporting are included in the subscription or sold as services.
About this article
Exigence publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Exigence before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-24