How Banks Can Prioritise Cybersecurity Exercises Using NIST CSF 2.0

At most banks, choosing the next cybersecurity exercise can become an exercise of its own. The SOC wants more detection practice, technology operations wants to test recovery procedures, and the risk team has outstanding findings that still need validation.

All three requests may be reasonable, but they won't necessarily address the bank's most pressing weaknesses.

The challenge is deciding which exercise deserves attention first and what the institution expects to learn from it.

The NIST Cybersecurity Framework (CSF) 2.0 offers a useful way to make that decision. By connecting cybersecurity outcomes to existing evidence, banks can identify capability gaps, prioritise exercises and demonstrate whether their teams are improving.

Use NIST CSF 2.0 to Find the Gaps Worth Testing

NIST CSF 2.0 organises cybersecurity risk management into six Functions: Govern, Identify, Protect, Detect, Respond and Recover.

Together, they describe outcomes an organisation should consider when managing cybersecurity risk. The framework doesn't prescribe how every outcome must be achieved or which training exercises an organisation must run.

For banks, that flexibility is useful. It allows security leaders to consider their existing controls, regulatory obligations and operational priorities without rebuilding their entire programme around a new checklist.

A financial institution might already use ISO 27001, internal control frameworks or regulatory requirements to assess its security posture. CSF 2.0 can provide an additional structure for identifying weaknesses and connecting them to improvement activities.

The framework's Organisational Profiles are particularly relevant.

• A Current Profile describes how the organisation is achieving selected cybersecurity outcomes today. 
• A Target Profile describes the outcomes it wants to achieve.

Comparing the two helps identify gaps and decide what needs attention.

NIST explains this approach in its guide to creating and using Organisational Profiles.

Begin With One Service and a Specific Weakness

Let's use a bank reviewing the security of its securities settlement operations.

During a previous exercise, the technology team successfully restored an affected application. However, the incident commander and settlement operations lead disagreed about what evidence was required before processing could resume.

The external provider responsible for part of the settlement workflow wasn't involved, leaving another important dependency untested.

The bank now has several possible areas to improve. It could practice incident investigation, review recovery procedures or run another technical restoration exercise.

Before choosing, the security leader needs to establish which capability gap matters most.

In this example, the immediate concern is whether the institution can make a justified decision about resuming settlement processing when transaction integrity remains uncertain.

That gives the exercise a clear business purpose.

Define the Current Position and the Target

A short Current and Target Profile can capture the problem.

The scope should identify the relevant systems, teams and dependencies, including the provider's responsibilities.

It should also reflect the bank's actual processing constraints. A settlement deadline or market cutoff may influence the decision window, but the exercise should use the institution's established requirements rather than an arbitrary performance target.

Turn CSF Outcomes Into Practical Exercises

Once the gap is clear, map it to the relevant CSF 2.0 outcomes. For the settlement example, five subcategories provide a useful starting point.

These are proposed exercises for the fictional bank, mapped to relevant NIST outcomes. They are not mandatory tests prescribed by NIST.

For example, DE.AE-04 concerns understanding the impact and scope of adverse events. The bank may choose to examine that outcome through an investigation involving suspicious changes to settlement records.

Another institution might use a different scenario because its critical services and existing weaknesses differ. The mapping should make the relationship between the capability gap and the exercise clear.

It should also prevent unnecessary training.

If an investigation reveals that the bank cannot retrieve essential records because the supplier's contract doesn't provide for them, repeating an analyst exercise won't resolve the underlying issue.

Decide Which Exercise Deserves Priority

A large institution may have dozens of unresolved findings and several teams requesting exercises. Running them in the order they were proposed is unlikely to be an effective prioritisation method.

Neither is choosing the scenario that maps to the greatest number of framework outcomes.

A broad exercise may cover several CSF categories while doing little to address a serious weakness affecting an important financial service.

Instead, assess each proposal against four considerations.

1. The Potential Business Consequence

Start with the service affected and the consequences of leaving the gap unresolved.

A weakness involving settlement integrity, privileged access to payment infrastructure or recovery of a critical customer service may warrant greater attention than a comparatively minor training gap.

Use the institution's established risk assessment and severity criteria to make that judgement.

2. What the Bank Already Knows

An observed failure deserves different treatment from a capability that has never been tested.

For example, a previous exercise may have demonstrated that analysts could not obtain the required evidence from a supplier.

Alternatively, the bank may simply lack recent evidence because the relevant system has changed.

Both situations warrant consideration, but the first provides a clearer basis for corrective action. Record the source, date and limitations of the available evidence.

3. Whether a Decision Is Approaching

Exercise timing matters when the result could influence an upcoming operational decision.

A bank revising its settlement recovery procedures may want to test the proposed authority model before approving the changes.

Likewise, a major system migration, new supplier integration or change to incident response responsibilities may justify earlier testing.

The exercise should produce useful information while the organisation can still act on it.

4. Whether the Exercise Can Answer the Question

Some exercises need preparation before they can produce meaningful results.

A technical investigation may require representative telemetry. A supplier coordination exercise may need agreement about participation and evidence sharing.

These requirements should influence scheduling without hiding the underlying risk.

If a high-priority exercise cannot proceed immediately, assign responsibility for resolving the prerequisite and agree when the decision will be reviewed.

What Prioritisation Looks Like

Returning to the settlement example, the bank has three proposed exercises.

The joint recovery exercise may involve greater technical complexity and a significant service consequence. Its dependency on the provider affects when it can be delivered, rather than making the underlying concern less important.

This is why prioritisation should consider urgency, evidence and feasibility separately.

The resulting plan should explain both what the bank will test and why other activities have been deferred.

An urgent unresolved exposure must still be handled through the bank's normal risk and escalation processes. Waiting for an exercise slot should not delay necessary risk treatment.

Choose an Exercise That Tests the Actual Weakness

Different exercises provide different kinds of evidence. For the settlement example, a tabletop can establish whether the incident commander and operations team understand their responsibilities.

Present the participants with a restored application, unresolved reconciliation exceptions and a provider assurance that doesn't fully address the bank's concerns.

Ask them to use the existing procedures to decide whether processing should resume.

The observer can examine the evidence considered, the authority used and how the team communicates its decision.

A technical investigation exercise would answer another question.

Give analysts representative security records and a synthetic set of settlement instructions containing both legitimate and suspicious changes.

Ask them to identify the affected records, establish the likely scope and prepare an evidence-based handoff to settlement operations.

This allows an assessor to observe the analysis rather than rely on participants describing how they would perform it.

A joint recovery rehearsal can then bring the work together.

Security analysts provide their findings, the recovery team demonstrates the relevant technical checks, and settlement operations evaluates whether the information supports resuming the service.

Where a provider controls an important dependency, include its authorised representatives or clearly identify which interactions are simulated.

A successful lab exercise provides evidence about the work completed in that environment. It doesn't automatically establish the performance of deployed production systems or the actual response time of an external supplier.

Choose the format according to the claim the institution needs to support.

Define Successful Performance Before the Exercise Begins

Exercise results become difficult to interpret when success is decided afterwards. Before the session, agree what participants must demonstrate and what evidence the assessor will use.

For the settlement investigation, the bank could prepare a reference dataset containing known affected and unaffected instructions. Participants would need to identify the affected records, explain their reasoning and document anything the available evidence cannot establish.

The assessor can then compare the findings with the reference dataset. For the recovery decision, the team should apply the agreed integrity checks and escalation process before deciding whether to resume processing.

A decision to continue holding the service may be appropriate if the evidence doesn't support restoration.

Performance should therefore be assessed against the quality of the decision and the agreed conditions, rather than whether the team chose the fastest route to recovery.

Record What Participants Did

A useful exercise record should establish:

• Which evidence and procedures were available to participants.
• What decisions or technical actions they performed.
• Whether the work was completed independently or required assistance.
• How long relevant stages took, where timing matters.
• Which teams, systems and dependencies were represented or excluded.

Keep the scope visible when reporting the result.

Build a More Focused Training Programme With TryHackMe

Once a bank identifies its priority capability gaps, the next challenge is making practical development manageable across teams, roles and working schedules.

TryHackMe's Management Dashboard gives security leaders a way to organise training around those needs.

Through framework alignment, organisations can map learning content to NIST, MITRE ATT&CK, ISO 27001 or their own frameworks.

Managers can create tailored learning paths, assign relevant modules and track participation and skill development.

For example, if a settlement exercise identifies weaknesses in identity investigation, analysts can be assigned targeted practical learning before returning to a more demanding scenario.

Where the issue concerns cross-team decision-making, TryHackMe Tabletop Exercises allow teams to build scenarios around their procedures and adjust the information participants receive.