Most CISOs run cyber drills to satisfy SEBI ID.5. The best CISOs run drills to find out where their command structure actually breaks. The difference between these two approaches shows up during a real incident at 2 AM.
The Command Gap Problem No One Talks About
Every CISO has an incident response plan. Fewer have actually tested whether it works under pressure with incomplete information and a board member on the phone. The gap between the plan on paper and the command chain in practice is almost always larger than CISOs expect — and cyber drills are the only reliable way to measure it.
The problem is that most drills are designed to confirm the plan works, not to find out where it breaks. The scenario is familiar, the participants are the security team, the outcome is predetermined ("we handled it well"), and the report is written to satisfy SEBI's ID.5 checkbox. Nobody learns anything.
From analysis of drill reports across regulated BFSI entities, the most common command gaps exposed in well-designed drills are: CERT-In portal submission ownership (nobody knows whose credentials, whose authority), parallel regulator notification (CERT-In filed, RBI/IRDAI forgotten), MD/CEO escalation trigger (too late, too early, or unclear), and evidence preservation failure (systems isolated before forensic capture).
Designing Drills to Expose Gaps, Not Confirm Plans
The CISO's role in drill design is to resist the temptation to make it easy. A drill that confirms your IR plan works is worthless. A drill that surfaces three specific, fixable gaps is worth more than any gap assessment a consultant can deliver.
The Three Design Principles CISOs Must Own
The first principle is ambiguity by design. Real incidents don't arrive clearly labelled. Your drill scenario must force progressive revelation — do not hand participants a scenario that says "a ransomware attack has occurred." Give them an alert, a symptom, and incomplete data.
The second principle is clock pressure that is real. If the CERT-In 6-hour clock doesn't feel real in the drill, it won't be respected in an actual incident. The facilitator must explicitly call out the clock: "T+2 hours. You have 4 hours remaining on the CERT-In deadline. Have you identified the reporting owner?"
The third principle is forcing decisions without your IRP. The participants should not have the incident response plan in front of them. The point of the drill is to test whether the plan is internalised — not whether they can read it under pressure.
The CISO's Pre-Drill Checklist
"The drill told me what three years of assessments couldn't: nobody on my team had actually submitted a CERT-In report. They'd read the process document. They'd attended the training. But when the inject said 'file the CERT-In report now' — nobody moved. That silence was the most valuable finding I've had in a decade."
— CISO, Large Private Sector Bank, MumbaiWhat SEBI ID.5 Actually Evaluates — and How CISOs Miss It
SEBI CSCRF ID.5 requires cyber drill evidence — but the quality of evidence is what distinguishes a mature entity from a compliant one. SEBI inspectors are looking for three things that most drill reports fail to provide:
- Specific findings: Not "communication needs improvement" but "CERT-In notification was delayed 85 minutes because portal credentials were not maintained by the IR team lead." Named, specific, traceable.
- Drill-over-drill improvement: The second and third drill reports must reference findings from the prior drill and demonstrate closure.
- Cross-functional participation evidence: An attendance register showing only the security team tells an inspector the entity is running a security team exercise — not an organisational preparedness exercise.
SEBI-Deficient Drill Evidence
- ×Annual drill — only security team
- ×Generic findings with no specifics
- ×No action items with owners
- ×No comparison to prior drill
- ×No senior management present
- ×Report signed by CISO only
SEBI ID.5 Inspection-Grade Evidence
- ✓Semi-annual drills — cross-functional
- ✓Named findings with root cause
- ✓Action items: owner + deadline + status
- ✓Improvement mapped to prior findings
- ✓MD/CEO present, documented
- ✓Signed by CISO + MD/CEO
The CERT-In 6-Hour Clock: Testing What Most CISOs Assume Is Working
The most common assumption CISOs carry into their first structured drill is that CERT-In reporting will work because there is a process document. The drill almost universally proves this wrong.
The failure points are consistent: the portal credentials belong to someone who left 6 months ago; the 9-field prescribed format has never been practiced; nobody has tested partial report submission (filing when scope is unknown, then updating); and the parallel RBI/IRDAI/SEBI notifications are not mapped to anyone's responsibility.
Building the Annual CyberDrill Program
SEBI ID.5 requires a drill program, not a single exercise. A program has a multi-year improvement arc, varying scenario complexity, expanding participant scope, and measurable maturity progression.
CISO Investment Case: In-House vs. External Facilitation
The Post-Drill CISO Action: Turning Findings Into Fixes
The drill report is not the outcome — it is the input. The CISO's job after the drill is to convert every finding into a dated, owned remediation action and track it to closure before the next drill. This is what SEBI inspectors mean by "demonstrating improvement over successive drill cycles."
Practical mechanics: within 48 hours of the drill, hold a findings review with all participants. Categorise each finding as P1 (fix before next incident), P2 (fix before next drill), or P3 (systematic improvement). Assign each finding to a named individual — not a team. The next drill's inject sequence should specifically probe the P1 findings to confirm they are resolved.
Connect Drill Findings to Quantified Cyber Risk
The CyberDrill module generates inspection-grade SEBI ID.5 drill reports, inject sequences, role cards, and action-item trackers — all within Practitioner Toolkit.
Open Practitioner Toolkit →