Glossary

The same glossary is available in the application’s header.

Term	Stands for	Meaning
AAR	After-Action Report	The report written after the exercise: what happened, the findings and the improvement actions.
ATT&CK	MITRE ATT&CK	A public knowledge base of the tactics and techniques real attackers use.
BCP	Business Continuity Plan	The plan for keeping critical activities running during and after a disruption.
CER	Critical Entities Resilience Directive — Directive (EU) 2022/2557	EU rules on the resilience of critical entities against physical and cyber disruption.
CSIRT	Computer Security Incident Response Team	A team that handles security incidents; national CSIRTs receive regulatory incident reports.
DORA	Digital Operational Resilience Act — Regulation (EU) 2022/2554	EU rules on ICT risk and resilience testing for the financial sector.
EEG	Exercise Evaluation Guide	The guide evaluators follow during the exercise to observe and rate each objective.
ENS	Esquema Nacional de Seguridad (Royal Decree 311/2022)	Spain’s National Security Framework for public-sector information systems and their suppliers.
EPM	Exercise Program Manager	Leads the organization’s exercise programme as a whole: which exercises happen over the years, their resources and budget, and the follow-up of their improvements.
EPT	Exercise Planning Team	The organization’s Exercise Planners, who design and run its exercises; each exercise’s planning team is drawn from it.
FCA	Financial Conduct Authority	The UK’s financial conduct regulator; with the PRA it sets the operational resilience rules.
GDPR	General Data Protection Regulation — Regulation (EU) 2016/679	EU rules on personal data; breaches are notified within 72 h. The UK keeps an equivalent UK GDPR.
HIPAA	Health Insurance Portability and Accountability Act	US law protecting health information; its Security Rule covers incident response and contingency planning.
IRP	Incident Response Plan	The documented plan for detecting, handling and recovering from security incidents.
IT	Information Technology	Corporate systems and data: servers, networks, applications.
MSEL	Master Scenario Events List	Its purpose is to make every objective of the exercise evaluable: it plans the events that will prompt the decisions to observe, when they happen and what response is expected from each area. That turns the discussion into something measurable — who acted, how and how fast — and each inject’s expected actions become what Evaluators observe in the EEG. It’s the planning team’s document; players never see it, they only get the SitMan.
NCCS	Network Code on Cybersecurity — Regulation (EU) 2024/1366	EU cybersecurity rules for cross-border electricity flows (electricity sector only).
NIS2	Directive (EU) 2022/2555	The EU directive on cybersecurity for essential and important entities, including incident reporting.
NYDFS	New York State Department of Financial Services	Regulates banks and insurers licensed in New York; its Part 500 sets their cybersecurity requirements.
OT	Operational Technology	Systems that monitor and control physical processes, e.g. industrial control and SCADA.
PCI DSS	Payment Card Industry Data Security Standard	The contractual security standard for anyone that handles payment card data.
PRA	Prudential Regulation Authority	The UK’s prudential regulator of banks and insurers, part of the Bank of England.
RGPD	General Data Protection Regulation (Spanish acronym)	The Spanish name of the GDPR, Regulation (EU) 2016/679.
SEC	U.S. Securities and Exchange Commission	The US regulator of listed companies; material cybersecurity incidents must be disclosed within 4 business days.
SitMan	Situation Manual	The handbook Players get before the session: objectives, rules, roles and the scenario’s starting point — never the injects.
SMART	Specific, Measurable, Achievable, Relevant, Time-bound	The qualities every exercise objective should have.
TLP	Traffic Light Protocol (FIRST)	How widely this document may be shared: CLEAR, GREEN, AMBER, AMBER+STRICT or RED.
TTP	Tactics, techniques and procedures	How an attacker operates; the MSEL references them as ATT&CK techniques.
TTX	Tabletop exercise	A discussion-based exercise where players walk through a simulated incident without touching real systems.