Runbook Drill
Test whether a documented procedure works before an emergency requires it.
Purpose
Runbooks should be written for stressful execution: prerequisites, exact checks, warnings, rollback/restore path, validation, and escalation. A runbook that has never been drilled is an assumption.
Operating record
| Cadence | Set a normal review interval and event-driven trigger. |
|---|---|
| Owner | Identify the role accountable for keeping runbook drill current. |
| Source data | List the systems, logs, reports, tickets, or records used during review. |
| Findings | Record exceptions, decisions, blockers, risk changes, and follow-up actions. |
| Evidence | Keep the smallest durable proof that the review occurred and produced a result. |
When to use
- When the work repeats often enough that memory is no longer reliable.
- When more than one person may request, perform, review, or inherit the work.
- When risk, approval, evidence, or handoff needs to be visible later.
Common failure modes
- Steps require undocumented local knowledge.
- Validation is missing.
- Emergency contacts are stale.
Review guidance
Review this page after a material incident, after a role or system change, and on a normal cadence appropriate to its risk. During review, check whether the owner is still correct, whether inputs are still complete, whether the output is still useful, and whether related pages need updates.
External guidance
These resources are references for terminology, control thinking, or review design. DailyWF adapts the ideas into lightweight operating pages rather than reproducing full standards.
- NIST SP 800-34 Rev. 1 Contingency Planning GuideContingency planning concepts useful for recovery and continuity workflows.
- CISA Cybersecurity Incident and Vulnerability Response PlaybooksPractical incident and vulnerability response sequencing for structured response work.