Official intent
Keep the technical workforce running your defenses current and practiced through continuous, role-based readiness. The official source remains authoritative.
Read the official campaign ↗Why it matters
A misconfigured control or a missed alert undoes expensive tooling. The people running your defenses need current, role-specific skills — not a once-a-year slideshow — and the confidence that comes from practicing before a real incident. Readiness also reduces key-person risk, so one departure does not blind your program.
Minimum / Strong / Advanced
Technical staff have defined roles and receive role-relevant training beyond general awareness.
A skills plan maps roles to required competencies, training is scheduled, and the team practices with tabletop or hands-on exercises.
Readiness is continuous and measured: skills are tracked, cross-training removes single points of failure, and exercises feed back into improvements.
Implementation timeline
- List who runs each core defense (identity, endpoints, backup, response)
- Identify any single-person dependencies
- Map each technical role to the skills it needs
- Schedule role-based training for the biggest gaps
- Run a tabletop exercise for a likely incident
- Begin cross-training on critical functions
- Track skills and training completion
- Fold exercise lessons into runbooks and the training plan
Implementation steps
- Define the technical roles that operate your defenses and who holds each today.
- Map each role to the specific competencies it requires and identify the gaps.
- Schedule role-based training — hands-on where possible — against those gaps.
- Practice with tabletop and hands-on exercises so skills are rehearsed before an incident.
- Cross-train critical functions and track readiness so it keeps pace with your stack and the threat.
Validation
- Confirm each critical defense has more than one person able to operate it.
- Verify role-based training was completed for staff in technical roles this cycle.
- Check that the last exercise produced documented lessons that changed a runbook or plan.
Evidence to retain
Roles-to-skills plan and training policy
Training records mapped to technical roles
Exercise reports and cross-training coverage
Skills/readiness tracker and post-exercise improvement log
Common failure modes
One annual awareness video counted as technical training, a single person who is the only one who understands a critical system, and exercises that generate slides but never change a runbook. Readiness that is never practiced is a resume, not a capability.
Framework mappings
Independent mappings are aids, not authoritative equivalence or compliance determinations.