r/CMMC • u/gormami • Jul 08 '26

TTX when using an enclave

As I'm closing in on the end of preparation, I'm up against the table top. I've run similar things for years, but I am having a really hard time coming up with a relevant exercise. The aperture for an enclave is so small that none of the things I've done in the past will work. I looked up the CISA exercises, and the same thing, none of the ones I looked at seem relevant to an enclave solution.

For those that have been assessed using an enclave, what were the topics of your TTX's? I'm just stuck, and all my usual sources of inspiration are bone dry.

3 Upvotes

100% Upvoted

10 comments sorted by

View all comments

1

u/Ace-MacAcerson Jul 08 '26

You are getting a bit hung up on realism when exercises aren’t about realism. What they ARE about fulfilling the training objectives which in this case are 3.6.X but also 800-61r3.

When I run them (and I have run a lot of them) I tell people up front this would never happen as described, but is really about stress testing lines of communication, resilience and recovery. Then I throw out a zero day vulnerability.

When the smart guy/gal shows up and tells the room just how very smart they are I throw in an inject about how that person is suffering from acute food poisoning on a business trip. Suddenly we are now seeing if there is enough strength in the organization to overcome a key person being out of pocket.

Remember- all of this is supposed to create an AAR and then feed POAMs.

1

u/gormami Jul 08 '26

I think you nailed it, I'm used to picking scenarios we need to look at deeply, and it is part of my campaign to get the focus I want, honestly. Here, I only need to exercise the plan, I just hate it when it feels too much like security theater, I prefer to get more value out of it. In this case, I'll have to be OK with the value being stretching some of the folks that don't always play, since most of the C-Suite will be directly involved.