Labshock / Training and exercise references
Start with the requirements that apply to your organisation. Use the guidance below to plan learning, run exercises and act on the findings.
Requirements / OT programmes
Legal duties, adopted standards and training guidance have different roles. Choose the references that apply to your organisation and the people doing the work.
For covered essential and important entities, Article 20(2) addresses management-body training and encourages regular employee training. Article 21(2)(g) includes cybersecurity training; 21(2)(f) addresses assessing the effectiveness of risk-management measures.
Read NIS2 Articles 20 and 21The 2024 edition sets security programme policy and procedure requirements for owners of operating industrial automation and control systems. Use the full standard to establish the requirements adopted for your OT programme.
View the official IEC standardNIS2 duties depend on scope and national implementation. IEC requirements depend on the applicable programme, contract or regulatory framework; the full standard is paid material. Neither reference creates a universal requirement to buy a cyber range or run a CTF.
Guidance / From learning to exercises
Define the skills people need, choose suitable practice and decide how you will evaluate the result.
Build and maintain a learning programme: identify needs, prepare learning activities, deliver them and evaluate their effectiveness. Practical exercises and cyber ranges are among the formats considered.
Read the learning programme guidancePlan, run and evaluate a cybersecurity exercise. The February 2026 methodology includes a support toolkit with templates for exercise planners.
Open the methodology and templatesA practical sequence
Define the skill → Prepare the scenario → Run the exercise → Review the evidence → Improve and repeat
Explore learning in WorldCSF 2.0 frames the outcomes. The supporting publications address exercise method, selected controls and OT context.
The NIST Cybersecurity Framework (CSF) 2.0 — NIST CSWP 29
Risk-management outcomes for setting exercise priorities and turning test findings into improvements.
Six Functions; Improvement (ID.IM), especially ID.IM-02
Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities
Exercise design, preparation, conduct and evaluation, with sample functional-exercise documents.
Section 5 and Appendix B
Security and Privacy Controls for Information Systems and Organizations
Incident response training, testing effectiveness and using results for continuous improvement.
IR-2, IR-3 and IR-3(3)
Guide to Operational Technology (OT) Security
The operational context: industrial systems, their dependencies, and performance, reliability and safety needs.
OT architecture and security considerations
NIST CSF 2.0 / Exercise planning
Choose relevant CSF outcomes for your organisation, then define the scenario, observations and review criteria. These examples show how an organiser can use an OT lab across the six Functions.
Govern · Identify · Protect · Detect · Respond · Recover
The six Functions work together continuously. They are not six consecutive stages of a match. Select the outcomes relevant to each exercise; a single scenario does not establish coverage of the whole framework.
Improvement / ID.IM-02
CSF 2.0 explicitly connects improvement with security tests and exercises. Our Learn → Test → Validate → Improve cycle gives organisers a practical way to act on findings: assign a change, make it and repeat the exercise.
Keep the observed result and its limits. Use that evidence when reviewing your organisation’s Current and Target Profiles; the platform does not generate a CSF assessment or compliance verdict.
Read CSF 2.0 and ID.IM-02Exercise method / SP 800-84
Section 5 covers functional exercises. Appendix B includes example scenarios, event schedules, inject tracking and after-action reports. Adapt that method to the industrial process and participants.
Choose the process, scope and participants. Agree what success looks like and what evidence the reviewer needs.
Set up the lab, briefing and objectives. Assign roles and check the environment before participants join.
Work through the exercise. Record decisions and observations alongside the available objectives and results.
Discuss the findings, assign follow-up actions and prepare the next exercise to check what changed.
SP 800-84 addresses organisational IT test, training and exercise programmes. Applying it to an OT range also requires the operational context described in SP 800-82.
Assessment objectives / SP 800-53
Use these controls to frame an exercise brief and review. The examples below describe assessment work an organiser can plan; they are not a claim that every Labshock scenario covers every control.
Define the roles and skills to practise. Use the briefing, practical work and review to examine how participants carry out those responsibilities.
Choose a response capability and criteria for assessing it. Review the available observations and results against those criteria.
Use qualitative and quantitative findings to decide what needs to change. Retain the measures and context needed for a meaningful comparison next time.
Identify the awareness and practical skills each role needs. Choose relevant activities and retain evidence of the work and its evaluation.
Record the objective, scenario and environment used, the observed result, limitations and agreed follow-up. Platform results, instructor observations and external-tool evidence contribute different parts of that record.
These documents are references for developing learning, tests and exercises in Labshock. Coverage must be checked against the specific guide, scenario and evidence; using the platform alone does not establish compliance or NIST certification.
Our published OT reference is SP 800-82 Rev. 3. Rev. 4 is an Initial Public Draft as of 29 October 2026; check the current publication status.
