Twelve months, four outages, one calendar. Before any drill goes on it, a plant's year is mostly spoken for, and its owner is the maintenance planner, not the security lead.
That is why so many OT drill programs stall at one annual tabletop. It gets booked when the compliance reminder arrives, collides with a shutdown or a peak, and is pushed, squeezed, then run by whoever was free. The scheduling order is backwards.
This is for whoever was told to "sort out the exercise program" at a site with an outage schedule, a shift roster and an auditor asking for test records.
First, how small a drill can be. HSEEP, the US federal exercise doctrine, splits exercises into discussion-based types, such as tabletops, and operations-based types, such as drills. FEMA's own course material on HSEEP defines the smallest operations-based type like this:
"A drill is a coordinated, supervised activity usually employed to validate a specific function or capability in a single agency or organization."
A specific function. Fifteen minutes confirming the call list still reaches the person who can declare an incident counts. Most of a working drill year is checks that size, with four bigger events placed around the plant.
Fill the year in this order
Each layer is harder to move than the next:
- Outages and turnarounds. From maintenance planning. They outrank any drill.
- Blackout periods. The startup after a turnaround, and peak season. Only short drills run here.
- Compliance clocks. The date your designated test is due, and the update window that follows it.
- The four quarterly events. Executive tabletop, technical tabletop, restore drill, retest, in that sequence, in the gaps.
- The heartbeat. A monthly call-list check on a rotating shift; a quarterly out-of-band communications check and safe-state walk-through at the panel. They fit anywhere, so they go on last.
Walking the sample year
January to March: decisions before drills
The executive tabletop goes first, because without it every later exercise stalls at a shift supervisor waiting for permission nobody can give. January also comes before the budget is committed, so a finding that needs money can still be funded. On another fiscal year, anchor it to budget planning.
The March technical tabletop makes the playbook carry out what January authorized, against a scenario that starts ambiguous and escalates. If nobody has time to write one, start from the CISA Tabletop Exercise Packages, most of which are free to download, and swap in your own systems. February's line outage closes the corrective actions that were waiting for equipment to be down.
The compliance clock, placed early on purpose
For an electric utility, NERC CIP-008-6 requires response plan tests no more than 15 calendar months apart, then allows 90 calendar days to record lessons learned, update the plan and notify everyone with a role in it. NERC's practice guide on calendar months counts the 15 to the last day of the fifteenth month. Testing every March leaves three months of slack for a storm or an outage overrun, and the update window closes before peak season.
Critical pipelines answer to the TSA directive now in force, SD Pipeline-2021-02G, which requires a yearly test covering two or more of the plan's objectives, with the people named in the plan taking part. Whether that means a calendar year or a rolling twelve months cannot be settled from public sources, because the directive text is restricted, so plan for the stricter reading. The test gives an auditor evidence to check; the auditor decides compliance.
April to June: the drill rides the turnaround
The restore drill goes into the May turnaround as a work order with hours and people, submitted in April while the outage plan is being built. Equipment that is down anyway can be isolated, reloaded and verified for real, the closest an OT team gets to testing a controller restore without risk. Startup stays empty: every engineer is on the floor.
July to September: only the heartbeat
Peak season is blacked out for events, but the short drills keep running: fifteen minutes on a night shift threatens nobody's output. In January 2024, malware later named FrostyGoop cut heating to apartment buildings in Lviv, Ukraine, in the middle of winter. Dragos put the figure at about 600 buildings; an independent count of affected heating units came in lower. Either way, it landed in the season a heating operator would black out for exercises. Attackers do not read your blackout dates.
Does your calendar have anything in your peak months? If yes, keep it short and on nights. If no, the July row is the cheapest gap you will ever close.
October to December: test the fixes, then plan the next year
The October retest is built from improvement plan rows marked closed, because a closed row is a claim that something works. If the restore drill found a missing vendor support contract, since signed, write an inject where that vendor line is the only way forward and see whether the night shift can find the number. December drafts next year while the lessons are fresh.
"You are not putting a drill on my turnaround"
"Outage weeks are sacred. I have contractors on the clock, permits to close and a critical path measured in hours. A cyber drill is not going on my turnaround."
The planner is right about the priority, and the calendar agrees. Look at what lands in an outage: one restore drill, in one of four windows, plus corrective actions that needed a shutdown anyway. The equipment is already down, isolated and permitted. The drill asks to reload it from backup and time the job.
The difference is paperwork. A training request loses to the first mechanical job that runs long. A work order with hours and named people competes on equal terms.
"Not on my night shift"
"Nights are two operators and me. The console is never left unattended for a drill, and I am not ringing the plant manager at 3 a.m. to test a phone list."
The console stays manned. The call-list check runs from it: open with "this is a drill", work down the list, and stop the clock when the person with authority to declare an incident is on the line. That number is your time to escalate.
Day shift is the least informative place to measure it, because everyone is in the building. That is why the table rotates. As for the plant manager at 3 a.m., agree it once, in writing, at the January tabletop: a night call now and then is a drill, it costs a few minutes, and the alternative is learning the number during a real incident.
Could you write down your night shift's time to escalate today? If no, that is the first row to fill.
"There is no security team here"
"We have one controls engineer, and he also fixes the boiler. There is no security team to own a calendar."
Then the calendar shrinks and keeps its shape. Keep the heartbeat in full: a monthly call-list check costs fifteen minutes and catches the failure small sites suffer most, the one contact who changed phones. Merge the two tabletops into one full tabletop a year, plant manager present for the decisions, built on an adapted CISA package. Keep the restore drill, scaled to one workstation on a bench. Rotate scenario types across years.
Put each short check on a one-page card: objective, steps, the number to record, who to call if it fails. Anyone on shift can run a card.
The planner's calendar comes first
Start a drill year from the compliance deadline and you spend it fighting the plant. Start from the outage schedule and the year mostly arranges itself: events slide into the gaps, the restore drill gets equipment that is down anyway, and short checks fill every month. The regulator's clock still gets met, with slack.
Twelve months, four outages, one calendar. What separates a site that drills from one that rediscovers the same stale phone list every year is mostly the order those three were written down.
Sources: FEMA IS-360, Exercise Descriptions (HSEEP) | NERC CIP-008-6 | ERO Enterprise CMEP Practice Guide, Calendar Month | TSA, Security Directives and Emergency Amendments | Vinson & Elkins on the TSA pipeline testing requirement | CISA Tabletop Exercise Packages | TechCrunch on FrostyGoop, reporting Dragos
