baselineRFIAre training environments live, isolated virtual infrastructure running real OS/network stacks, or a simulated/gamified interface — and can custom scenarios replicate the customer's actual network topology and technology stack?weight 3
Answer key — what a strong answer shows
Live, isolated infrastructure with customer-topology replication is materially stronger for skill transfer than a generic simulated UI with no real systems underneath.
baselineRFPDetail the scenario content library — how many scenarios exist, how they map to current real-world attack techniques (e.g., MITRE ATT&CK coverage), and the stated cadence for adding new scenarios as threats evolve.weight 3
Answer key — what a strong answer shows
Look for explicit ATT&CK mapping and a concrete content-refresh cadence; a static, unmapped library ages out of relevance quickly.
baselineRFIHow is individual and team performance measured during an exercise — objective scoring (time-to-detect, time-to-contain, specific actions taken) versus subjective facilitator grading — and is scoring benchmarked against peer organizations?weight 3
Answer key — what a strong answer shows
Objective, peer-benchmarked scoring is stronger evidence of real skill development than subjective, unbenchmarked facilitator grading.
baselineRFPDescribe support for purple-team/collaborative exercises where red and blue teams operate simultaneously with real-time visibility for facilitators, and whether after-action reports map identified gaps to specific, actionable remediation recommendations.weight 3
Answer key — what a strong answer shows
Structured after-action reporting tied to concrete remediation steps is stronger than a bare pass/fail scorecard with no follow-through guidance.
baselineRFICan the platform run tabletop/executive-level exercises alongside hands-on technical ranges, with content genuinely tailored by audience (SOC analyst versus executive/board), rather than a single format for everyone?weight 3
Answer key — what a strong answer shows
Audience-tailored content is a real differentiator — probe for concrete evidence (sample materials, a customer reference) rather than accepting the claim at face value.
baselineRFIWhat is the scalability model for large-scale exercises — e.g., a company-wide, hundreds-of-participants incident-response drill — and what infrastructure or licensing constraints apply at that scale?weight 3
Answer key — what a strong answer shows
Demand a concrete participant-count ceiling and cost model; 'scales as needed' with no numbers is not a real answer for planning a large exercise.
baselineRFPExplain how training completion and skill-progression data integrates with broader workforce/compliance systems (LMS, HR platforms) for certification tracking and organization-wide skills-gap reporting to leadership.weight 3
Answer key — what a strong answer shows
Real LMS/HR integration with skills-gap reporting is stronger than a standalone completion certificate with no downstream visibility for leadership.
baselineRFIIs the range hosted in the vendor's cloud, deployable on-prem/air-gapped, or both — and for regulated or classified environments, what isolation guarantees exist to prevent customer data or scenario details from leaving the environment?weight 3
Answer key — what a strong answer shows
An explicit, working air-gapped/on-prem option matters for regulated or classified customers; a vague cloud-only answer is a real disqualifier for that segment.
baselineRFIWhat is the pricing model — per participant, per exercise, or an annual platform license — and how does cost scale for running frequent, recurring exercises versus a single annual event?weight 3
Answer key — what a strong answer shows
Look for transparent, predictable pricing that accounts for a realistic recurring-exercise cadence, not just a one-time-event price that becomes expensive at real ongoing usage.
baselineRFPDoes exercise completion count toward any recognized industry certification or accreditation (continuing-education credits for existing certs, or a vendor-issued credential with real market recognition), or is completion purely internal with no external credentialing value?weight 3
Answer key — what a strong answer shows
Real, recognized certification credit adds tangible career value for participants beyond the training itself — ask for a specific, named credentialing relationship, not a vague 'certificate of completion.'
baselineRFIDoes the scenario library include OT/ICS-specific exercises (distinct from generic IT-focused scenarios), and how are those scenarios validated for physical-safety-aware realism by someone with genuine OT expertise?weight 3
Answer key — what a strong answer shows
OT-specific exercises require genuinely different technical content than generic IT scenarios — ask for evidence of real OT expertise behind that specific content, not a repurposed IT scenario relabeled.
baselineRFPIs this purely a training/exercise platform, or does it double as a real assessment/red-team-as-a-service capability that could be used for an actual security evaluation — and if the latter, how is training data kept separate from real assessment findings?weight 3
Answer key — what a strong answer shows
Clarify this scope boundary explicitly — conflating training exercise data with real security-assessment findings could create confusion about what represents an actual organizational vulnerability versus a training scenario.
baselineRFIDoes after-action reporting integrate with the customer's own ticketing/remediation workflow so identified skill or process gaps automatically generate tracked follow-up items, or does the after-action report remain a standalone document requiring manual follow-through?weight 3
Answer key — what a strong answer shows
Automated ticket creation from after-action findings is materially more likely to result in real remediation than a standalone report that can be filed away and forgotten.
baselineRFIWhat historical trend reporting exists showing organizational readiness improvement over time (average time-to-detect/contain across successive exercises), suitable for demonstrating program maturity to leadership?weight 3
Answer key — what a strong answer shows
Trend-over-time readiness reporting is a distinct capability from a single exercise's scorecard — confirm this exists as a maintained, exportable report across multiple exercises.
baselineRFPWhat support exists for multi-language/international distributed teams participating in the same exercise — is content and facilitation available in multiple languages, and how does that affect scoring consistency across language groups?weight 3
Answer key — what a strong answer shows
A genuinely global organization needs real multi-language support, not just an English-only platform — ask for specific language coverage and how cross-language scoring consistency is maintained.
baselineRFPWhat is the vendor's own content-update cadence for incorporating newly observed real-world attack techniques into scenarios, and can they cite a specific recent example of a new technique added shortly after it became prevalent in the wild?weight 3
Answer key — what a strong answer shows
A concrete, recent example of fast content updates is more credible than a generic 'we stay current' claim — press for a specific instance and timeline.
baselineRFPPerform periodic incident response exercises with a deliverable report and debriefing upon completion.weight 3
baselineRFPMSSP must deliver at least one annual tabletop exercise (scenario themes prioritizing phishing compromise, ransomware, privileged account misuse), with technical teams and leadership participation and a mutually agreed after-action reporting format.weight 3
baselineRFPContractor shall lead enterprise IR readiness via an annual Incident Response Tabletop Exercise (TTX) plan developed with the Privacy team, designing at least 3 distinct high-fidelity scenarios per exercise (incorporating both cybersecurity e.g. ransomware and privacy e.g. PII breach components), and delivering a formal After-Action Report within 10 business days of TTX conclusion.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
