IR010Exercising the response

The rehearsal of the playbooks against a scenario, with the people who would run them.

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
IR010/EUMandatory	European Union	Commission Implementing Regulation (EU) 2024/2690European Commission · read 29 Aug 2026Regulation (EU) 2022/2554, articles 11, 13, 17, 18 and 24European Parliament and Council · read 23 Sep 2026	What the directive’s categories hold, in an annex setting out asset classification, the inventory, access control, privileged accounts, and removable media as requirements rather than as headings.	For the digital infrastructure and service providers it reaches, the incident response procedures are tested at planned intervals. Under the financial sector’s own regulation the testing programme is established, maintained and reviewed, and it exists to assess preparedness for handling incidents and to identify weaknesses and gaps.