Article 21-Aligned Cybersecurity Exercises for Critical Infrastructure Operators
NIS2 Directive Article 21 requires essential and important entities to implement cybersecurity risk management measures—including regular security testing and exercises. Our CISA CTEP-aligned tabletop scenarios are purpose-built for critical infrastructure operators across energy, water, transport, and health sectors. No facilitation experience required: launch a compliant exercise in under 5 minutes.
No account required for demo · 3 scenarios free · Cancel anytime
Every scenario is mapped to specific NIS2 Article 21 obligations so your team builds documented evidence for regulators and national competent authorities.
Each scenario includes a full facilitator guide, participant workbook, inject timeline, discussion questions, and compliance-mapped AAR template ready for regulatory submission.
A ransomware group targets an electricity transmission operator, encrypting EMS systems and demanding payment while threatening to publish SCADA configuration data. Teams navigate NIS2 notification timelines and OT isolation decisions.
An adversary gains access to a municipal water SCADA system and begins manipulating chemical dosing parameters. Teams must detect anomalous PLC behavior, initiate manual overrides, and coordinate with public health authorities.
A trusted industrial automation vendor pushes a malicious update containing a backdoor that propagates across multiple OT networks. Teams triage scope, coordinate with sector peers, and assess NIS2 supply chain notification obligations.
A nation-state actor disrupts cargo management and vessel traffic service systems at a major EU port. Teams address OT/IT convergence risks, port authority coordination, and NIS2 cross-border incident notification under IMO maritime cybersecurity guidance.
Ransomware encrypts a hospital clinical OT network, taking down imaging systems, infusion pumps, and building management. Teams triage life-safety priorities, activate downtime procedures, and navigate NIS2 significant incident reporting.
No facilitation experience required. Our platform guides you through every phase of a CISA CTEP-format tabletop exercise.
No credit card required to access 3 full scenarios with complete facilitator guides.