Handbook for cyber stress tests

In this handbook, we define a cyber stress test as 'a targeted assessment of the resilience of individual organisations and their ability to withstand and recover from significant cybersecurity incidents, ensuring the provision of critical services, in different risk scenarios.' Stress tests focus on resilience, use resilience metrics and can be used to test both preparedness measures and responsive recovery measures. This handbook contains a simple, five step guide to cyber stress testing (see illustration): 1. defining the test scope and objectives, engaging with stakeholders; 2. designing the test, choosing the methodology, refining the scenarios; 3. execution of the cyber stress test; 4. analysing results and identifying gaps; 5. following up on gaps and issues identified in the stress test. This handbook is aimed at national or sectorial cybersecurity authorities and national cybersecurity agencies overseeing cybersecurity and resilience of critical sectors, at the national level, regional or EU level, under NIS2, the revised EU NIS Directive. The handbook could also be useful for supervisory authorities under the Digital Operational Resilience Act (DORA), the EU regulation for operational resilience of the EU's finance sector, or national authorities under the CER Directive. The handbook could also be useful for other authorities, agencies and policy makers, at both the national and EU level.