Questions, answered precisely
Including the places where the requirement is softer than this category's marketing implies.
Run a credible cyber incident response tabletop exercise without hiring a consultant, and leave with a dated evidence pack. Exercise tooling with evidence output, structured around what auditors look for.
Does ISO 27001 require a tabletop exercise?
No. ISO 27001 does not name a tabletop exercise as a requirement.
Annex A controls apply once you have selected them as part of your risk treatment. Three that an exercise bears on are 5.24, planning and preparing for information security incident management, 5.29, information security during disruption, and 5.30, ICT readiness for business continuity. If they are in scope, an auditor may reasonably want evidence that your incident and continuity arrangements have been prepared and exercised.
A tabletop exercise is a common way to produce that evidence, and it is often the simplest way to show the preparation. It is a means, not the mandate. A discussion exercise shows that people know what they would do; it does not replace technical checks such as restoring from a backup.
Will an auditor accept an exercise we ran ourselves?
Self-run exercises are common and are often accepted. Whether yours is accepted is your auditor's judgement, and no tool can promise you that outcome.
ISO 27001 does not ask for an exercise to be run by an external party. What tends to matter to the person reviewing it is whether the record is specific: a date, who was there, what scenario was used, what was decided and when, what gaps came out of it, and what was done about them afterwards. A dated record with named participants and timed entries answers those questions. A paragraph written from memory usually does not.
Drillroom is built to produce the first kind. It cannot make your auditor agree, and it does not confirm that any of your controls are adequate.
How is this different from NCSC Exercise in a Box?
Exercise in a Box is a good free resource from the NCSC and you should look at it. The difference is not the questions, it is the assembly and the record.
Drillroom drafts the organiser pack that gets the session into everyone's diaries, timestamps entries as you log them so nobody has to be the scribe, and formats the output for the person on the reviewing side.
If you have the time and confidence to assemble it yourself, the free route genuinely works.
Do participants need accounts or an app?
No. One person operates Drillroom and everyone else watches a shared screen, in a room or on a video call.
Participants are named in your profile so the role sheet and the evidence pack can refer to them, but they never log in or install anything. The organiser pack is sent from your own inbox. In this version only the operator uses Drillroom: participants do not get their own view of it.
What happens to our data?
Your participants, logged entries and evidence packs are kept in your Drillroom account. We use a few service providers to run it, for hosting, sign-in, email, payments and AI, and the privacy page lists each one.
When you ask Drillroom to draft findings after a session, it sends your logged entries to our AI provider. When you ask for suggested wording for a scenario before a session, it sends your corrections and the parts of the scenario they change. The provider does not train on either and deletes them within 30 days, except where it must keep them for misuse checks or by law. Nothing is sent to it while a session is running.
What do we get if we do not renew?
Every evidence pack you have exported stays downloadable for twelve months, and you can export everything at once before you go.
Your org profile and participant list are kept for those twelve months too, so coming back within them is one click.
Tracking of open actions stops and no action reminders are sent.
Can a consultant use this across clients?
Not yet. A licence covers one organisation, and there is no way to keep several clients' exercises separate in this version.
If you are running exercises for other people for money, this is not the right tool for you today. It may be later.
Note. Nothing on this page tells you that Drillroom makes you compliant, audit-ready or certain to pass anything. If you find a sentence here that implies it, it is a mistake and we would like to know.