Framework alignment
The exercise record frameworks ask you to keep.
NIST, ISO, CIS, PCI DSS, DORA and others ask the same things of an incident-response test: run it against a realistic scenario, record what the people did, and show what changed afterwards. Here is where each of those sits in a MetisForge exercise.
What every exercise leaves behind
Four parts of one record.
- 01The test itself
Date, duration, facilitator, participants and their roles, the scenario and every inject, with document control and a version.
- 02What the team did
Each analyst's written answer to each question, when it arrived after the question was revealed, team chat, and the path taken at each decision point.
- 03How it was judged
The facilitator's score and note on every answer against the scenario's rubric, inject and overall scores with the method shown, and objectives with their success criteria.
- 04What changes because of it
Findings that cite the inject and answer behind them, lessons learned with owners, corrective actions with due dates, training, SME validation and re-test status.
Clause by clause
What each framework asks, and where it is recorded.
| Framework | What it asks for | Where it is in the MetisForge record |
|---|---|---|
| NIST Cybersecurity Framework 2.0ID.IM-02, ID.IM-04; Respond (RS) and Recover (RC) | Improvements are identified from security tests and exercises, and incident response plans are maintained and improved. | Each finding cites the inject and the team's answer behind it, and becomes a corrective action with an owner, a due date and a re-test. |
| NIST SP 800-61 Rev. 3Incident response recommendations, a CSF 2.0 community profile (2025) | Incident response is treated as part of risk management, with lessons learned feeding back into preparation. | Lessons learned are recorded by category with owners, and the report keeps the decision record they came from. |
| NIST SP 800-84Guide to test, training and exercise programs | Exercises have stated objectives, a designed scenario, facilitation, and an after-action report that evaluates the plan and the people. | Objectives with success criteria, the scenario and every inject, the facilitator's scores and notes, and a full after-action report with its method stated. |
| ISO/IEC 27001:2022Annex A 5.24, 5.26, 5.27 | Incident management is planned and prepared, incidents are responded to by documented procedure, and knowledge from incidents is used to strengthen controls. | Questions test the documented procedure step by step; answers, scores and findings show where the procedure held and where it did not. |
| ISO 22301:2019Clause 8.5, exercise programme | Business continuity strategies and procedures are exercised against objectives, with formal post-exercise reports of outcomes, recommendations and actions. | The after-action report states outcomes against each objective, recommendations per finding, and actions with owners and due dates. |
| CIS Critical Security Controls v8Safeguard 17.7 | Routine incident response exercises for key personnel, at least annually, testing communication channels, decision making and workflows. | Who answered, when, and how long after each question was revealed; team chat; the decisions taken at each decision point. |
| PCI DSS v4.0Requirement 12.10.2 | At least once every 12 months, the incident response plan is reviewed, updated as needed, and tested. | A dated record of the test: scenario, participants, answers, scores and the report, with document control and version. |
| EU Digital Operational Resilience Act (DORA)Article 11(6); Article 13 | ICT response and recovery plans are tested at least yearly, including cyber-attack scenarios, and lessons from tests and incidents feed back into the framework. | Cyber-attack scenarios mapped to MITRE ATT&CK, the team's response recorded per inject, and lessons and corrective actions carried to re-test. |
| NYDFS Cybersecurity Regulation23 NYCRR 500.16 (as amended 2023) | Incident response and business continuity plans are tested at least annually. | A dated test record and report for each exercise, with the people who took part. |
| HIPAA Security Rule45 CFR 164.308(a)(7)(ii)(D) | Procedures for periodic testing and revision of contingency plans. | Results of each test, and the revisions it led to as corrective actions with status and re-test. |
| SEC Regulation S-KItem 106 | Public companies describe their processes for assessing, identifying and managing material cybersecurity risks, and the board's oversight. | A record that the incident process was exercised, by whom, with what result, and a report that can be released to leadership. |
Questions
What this page does and does not claim.
Does MetisForge make us compliant with these frameworks?
No product does that on its own. MetisForge produces the record of an incident-response test and what followed from it. Whether that record satisfies a requirement is your auditor's or regulator's call.
Is MetisGrid certified to SOC 2 or ISO 27001?
No. MetisGrid makes no certification claim. This page is about the content of the exercise record, not about the vendor's own certifications.
Does the report tag findings to framework clauses?
Not today. Injects are mapped to MITRE ATT&CK techniques and the report summarises coverage by tactic. The alignment on this page describes where the report's content sits relative to each clause.
Can the report go to our board or a regulator?
The report is a light, printable document with document control and a release step on Professional and Enterprise. What you send to whom remains your decision.