An incident response exercise is scheduled for next month. The scenario and participants have been chosen, but no one has documented what the exercise is meant to demonstrate. What should the security manager do FIRST?

Exercise design starts with objectives because every later choice depends on them. Objectives state which capabilities are being evaluated, such as escalation within agreed timeframes, decision authority for containment, or coordination with legal counsel, and success criteria make the outcome measurable so that gaps can be identified and assigned for remediation. Agreement with stakeholders ensures the exercise tests what the business actually needs assured and that results will be accepted. Making the scenario harder does not help when no one knows what is being measured; complexity should be chosen to fit the objectives, not set in place of them. External observers can add independence, but they need criteria to grade against, and best practice in general is not a substitute for the organization's own plan and requirements. Postponing in favour of a full interruption test assumes that more realism equals more value, while ignoring disruption, cost and the fact that objectives are still undefined. Exam caveat: on questions asking what to do FIRST in planning, the answer is usually the step that defines scope and purpose. Operational check: confirm the exercise plan lists objectives, evaluation criteria, evaluators and how findings will be tracked.