Skip to content
Drillroom
Sign in
Buy for £499 a year

Who made this

I am Matt Whetton. I am CTO at a UK regulated payments company, where I own information security and technology risk.

I have been CTO at three regulated UK fintech firms, in lending and payments, over roughly eight years, and I have worked in and around regulated firms for about fourteen. At those three firms I have implemented ISO 27001 from scratch and taken it to certification twice, and kept it certified at all three. I have done the same with Cyber Essentials Plus, once from scratch and maintained at two. I have run a PCI DSS Level 1 service provider programme for three years, including the move to version 4 and through major infrastructure change.

Incident response exercising sits inside all of that. I run the incident process at my current firm. I have signed off our own internally run exercise write-ups before the assessor saw them, and I have reviewed other firms' write-ups as evidence. I know what gets accepted and what gets a question.

Why this exists

I have watched internally run exercises go the same way at every firm. Someone has to facilitate, and the person who can is usually the person who most needs to be tested. The scenario chosen is the one the firm is already prepared for. Everyone in the room knows a colleague is marking, and that colleague would rather the result was good. The facilitator does this once a year at most, forgets steps, and leads the room to the answers without meaning to. None of that makes the exercise worthless. It makes it soft, and the write-up softer.

A paid facilitator fixes most of that and costs more than most firms this size can justify once they do the arithmetic honestly. Drillroom sits between the two: the facilitation and the record done by the tool, so the people who should be in the exercise can stay in it.

What I am not claiming

I am not an auditor and not a lawyer, and Drillroom is not a compliance service. It is structured around what assessors look for. Whether yours accepts a pack from it is their judgement.

How it is run

There is nobody to talk to before you buy and no sales team afterwards. Support is by email at support@getdrillroom.com, and it comes to me. Drillroom is sold by ItsMonkie Limited.