A workable cadence (our suggestion, not a standard) is one tabletop each quarter, one short functional drill each month, and extra sessions when something changes, such as a new registry, a new CI platform or a real incident. There is no official standard for this, so pick a rhythm you can keep.
The honest answer on frequency
The sources we reviewed, CISA's tabletop packages and NIST SP 800-84, describe how to build exercise material and programs. The pages we read do not set a drill frequency for software supply chain scenarios, and we have not checked every regulation, so confirm any framework you answer to. The right number depends on your team size, change rate and risk. Consistency matters more than intensity.
A starting cadence
| Cadence | Activity | Time |
|---|---|---|
| Monthly | A short functional drill (find a component, rotate a sandbox secret, rebuild offline) | 20 to 30 minutes |
| Quarterly | A tabletop on a different scenario | 60 minutes plus debrief |
| Yearly | A larger game day or leadership session | Half a day |
| Triggered | See below | As needed |
Use a rotating scenario list. The scenario selection guide helps you cover each category in turn.
Triggers that justify an extra session
- A real incident or near miss. Run a drill within a few weeks while the lessons are fresh.
- A major tooling change, such as a new CI platform or a new registry.
- A significant staff change on the people who hold publish or revoke rights.
- Adoption of AI coding agents or new tool servers.
- A failed drill. Repeat the same inject after fixes to check they work.
Keep drills small enough to survive
Teams stop drilling when sessions feel heavy. Tactics that help:
- Fixed calendar slots that are hard to cancel.
- A reusable template and a report format. See the after-action report guide.
- A rotating facilitator so the load is shared.
- A one line goal for each session.
Signs you are drilling too little
- Nobody can name who revokes a registry token.
- The last drill is more than a year old.
- Findings from the last report are still open.
- New joiners have never seen the incident plan.
Signs you are drilling too much
- Participants say nothing new comes up.
- Actions pile up with no owners.
- The same scenario repeats with identical answers.
In that case, change the scenario, add a harder inject, or switch to a functional format.
Track it
Put drill dates and open actions on a visible tracker. Count completed corrective actions, not meetings. The metrics guide covers what to record.
Try it yourself
Click through it at your own pace, or open it full screen. Look at what changes between scans, which is a good prompt for deciding when an extra drill is warranted.
Safeguard provides continuous monitoring and compliance evidence automation, which can help keep drill records alongside other controls. A free scan is a quick start.
Quick check
Is quarterly too often for a small team?
Twice a year is still better than nothing. Keep sessions short and focus on one scenario.
Do audits require a specific frequency?
It depends on the framework and the auditor. Check the exact control language, and keep dated evidence of each session.
Sources
- CISA Tabletop Exercise Packages
- NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities
Last reviewed: 19 October 2026.
