# Standards and Regulatory References — Breach Simulation Exercise

## Regulatory Basis

### GDPR Article 32(1)(d) — Testing Obligation
- "A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing."
- Breach simulation exercises directly fulfil this obligation by testing breach response measures.

### EDPB Guidelines 9/2022 — Preparedness
- Section 6: Controllers should prepare for breaches in advance through "regular testing of breach handling procedures."
- Tabletop exercises are explicitly mentioned as an appropriate testing mechanism.

### NIST SP 800-84 — Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities (2006)
- Provides the foundational framework for designing tabletop, functional, and full-scale exercises.
- Section 3: Tabletop exercises — discussion-based sessions where participants walk through a scenario.
- Section 4: Functional exercises — test specific operational functions with simulated scenario inputs.

### NIST CSF 2.0 — RS.IM (Respond — Improvements)
- "Response plans incorporate lessons learned" — exercises generate lessons learned for plan improvement.

### ISO/IEC 27001:2022 — Annex A Control 5.29 (ICT Continuity)
- Requires testing of ICT continuity plans, which includes breach response procedures.

### ISO 22398:2013 — Guidelines for Exercises
- Provides comprehensive guidance on designing, planning, conducting, and improving exercises for societal security.
- Applicable to breach simulation exercise design.

## Industry Standards

### SANS Incident Response Exercise Framework
- Recommends quarterly tabletop exercises rotating through different breach scenarios.
- Provides scenario templates covering ransomware, insider threat, supply chain, and social engineering.

### Verizon DBIR Exercise Recommendations (2024)
- Recommends exercises based on the most prevalent breach types identified in the annual Data Breach Investigations Report.
- 2024 report: 68% of breaches involved a human element — exercises should heavily feature social engineering scenarios.