ID.IM-02 test and exercise improvements: evidence

What ID.IM-02 asks for after a test or exercise

ID.IM-02 asks that an organization identifies improvements from its security tests and exercises, including those run with suppliers and other relevant third parties. In plain terms, when a tabletop exercise, penetration test or supplier continuity exercise produces findings, the outcome is that those findings are turned into identified improvements to the program. It is an outcome, not a checklist item, so the question an assessor will ask is whether the lessons from testing actually changed how the organization operates. The risk it addresses is familiar: a tabletop produces a useful debate about who calls the regulator, a penetration test lists an unpatched management interface, and a supplier exercise exposes a recovery time nobody expected, yet none of it reaches a plan, a configuration or a contract. The findings stay in a meeting room or a slide deck and the program repeats the same gap the next time it is tested.

The difficulty is mostly administrative. Findings from one exercise land in several places: a PDF from the penetration tester, a whiteboard photo from the tabletop, an email thread with the cloud provider, and a scanner queue owned by another team. Each item has a different owner, severity scale and due date, so some are fixed, some are duplicated and some quietly disappear. Before you plan any remediation, decide where the findings of record will live, who owns the decision to accept, change or defer each one, and how a supplier's findings enter the same register as your own. Confirm with each testing provider in writing what format and detail you will receive, because that determines how much translation your team must do.

A practical first check is to pick one recent exercise and trace each finding to a closed or accepted outcome. If you cannot show the change, the link from test to improvement is missing, and an assessor will likely find the same gap. Keep the record of that trace, since it is the kind of evidence that shows ID.IM-02 is working. Consider how the findings relate to incident response plans and supplier contracts, which other ID.IM Subcategories cover in more detail.

Which tests, exercises, suppliers and systems fall under ID.IM-02

ID.IM-02 asks whether an organization learns from its security tests and exercises, including those run with suppliers and relevant third parties. The cards below set the boundaries: which test types count, who must take part, which systems and plans are covered, and who acts on the findings.

Tabletop exercises and incident response plans

Tabletop exercises walk decision makers through a simulated incident against the organization's response plans. NIST's Implementation Examples for ID.IM-02 use these exercises to improve incident response, so each plan in scope should have a dated exercise record, a list of gaps and an owner for each fix. Check that every plan named in your incident response program has been exercised at least once and that the outcomes feed back into the plan text.

Penetration tests of high-risk systems

The Implementation Examples point to penetration testing of high-risk systems as a source of improvements. Scope the tests to systems whose compromise would affect critical services, customer data or regulated operations, and record which findings led to changes in configuration, architecture or monitoring. Ask testers to state retest results so you can show that a fix worked, not only that a finding was raised.

Continuity and recovery exercises with critical suppliers

ID.IM-02 covers exercises of continuity and recovery run with critical suppliers and service providers, not only internal teams. Identify which suppliers would stop a critical service if they failed, agree in writing how they will take part, and log what the exercise showed about recovery time, communication and dependencies. A supplier that refuses to participate is itself a finding to record and manage.

Audits and internal control tests

Audits and tests of controls are a further source of improvement under ID.IM-02. The reader should confirm which audit reports, internal reviews and control tests are in scope, and whether their findings enter the same tracking system as exercise findings. Findings from an audit that never reach an owner or a due date do not show that improvement has happened.

Executives, legal and HR in exercises

NIST's Implementation Examples include involving executives, legal and HR in exercises. Decisions on public statements, regulator notification, staff communication and disciplinary or access actions often sit outside the security team. Confirm that these roles have a seat in the exercise, a named decision they must make, and a follow-up action when the exercise shows that a decision path was unclear.

Security tool metrics as test input

Metrics from security tools can show where tests and exercises should look next and whether earlier fixes held. For example, vulnerability detection output from an agent-based tool such as Wazuh, or host software inventories from Fleet, can show whether a finding from a penetration test has recurred on endpoints. Decide which metrics feed the improvement log, who reviews them, and how often they are compared with the findings from each test.

How an assessor tests ID.IM-02 improvements from tests and exercises

This table compares what an assessor samples, what evidence they request and the findings they most often raise for ID.IM-02. Read each row as a test step: the approach says what to check, the evidence column says what to have ready, and the findings column shows where programs usually fall short.

Test area	Assessor approach	Evidence requested	Common findings
Sampling recent exercises and pen tests	Select a sample of tabletop exercises, penetration tests and continuity exercises from the review period and check each one end to end, not only the summary.	Exercise plans, scenarios, attendance records, penetration test reports and the dated schedule of tests that shows the sample frame.	Exercises run but no written after-action report exists, or the schedule is kept informally so the assessor cannot confirm completeness.
Tracing a finding to an accepted improvement	Pick findings from the sampled exercises and follow each one to a logged improvement, an accepted risk decision or a documented reason for not acting.	Findings register, improvement tickets, risk acceptance records and the approver's name and date for each decision.	Findings are recorded in a report but never appear in a tracker, so no improvement can be traced from the test that produced it.
Checking ownership and due dates	Confirm each improvement has a named owner with authority over the affected process or system and a target date that reflects agreed priority.	Assignment records, owner acknowledgment, prioritization criteria and any escalation notes for overdue items.	Findings with no owner, owners who lack authority to act, or target dates that were never set or quietly extended.
Closure and retesting	Check that closed improvements were verified against the original weakness, typically by retesting, re-running the exercise step or inspecting the changed configuration.	Closure evidence, retest results, change records and the verifier's identity separate from the person who made the change.	Improvements marked closed without retesting, or closed on a ticket comment alone with no evidence the weakness is gone.
Supplier and third-party exercises	Confirm that continuity or incident exercises involving critical suppliers actually included the supplier and that the supplier's own findings were captured.	Joint exercise plans, supplier participation records, supplier after-action input and contract clauses that allow participation.	Exercises described as supplier-inclusive where the supplier only received a notice, or supplier findings kept outside the organization's register.
Executive, legal and HR participation	Where the program states that executives, legal or HR take part in exercises, verify attendance and their role in decisions taken during the exercise.	Attendance lists, decision logs, communication plans and records showing legal or HR input on notification or personnel actions.	Program documents claim executive or legal involvement, but the attendance records or decision logs show only technical staff.
Consistency between plans and test outcomes	Compare exercise outcomes with the incident response, continuity and recovery plans to see whether plan updates followed the findings.	Plan version history, change logs showing updates, and the mapping between each finding and the plan section it changed.	Plans remain at the version used before the exercise, so the same gap reappears in the next test.
Metrics from security tools	Check whether results from exercises and tests feed into metrics that management reviews, such as open findings, overdue items and time to closure.	Metric definitions, dated reports to leadership and the source data behind each reported figure.	Metrics are reported as totals with no link to specific tests, so the assessor cannot verify what was improved.

Implementing ID.IM-02 in six steps

This sequence turns test and exercise results into a tracked set of improvements that owners close and that feed back into the incident response and continuity plans. Each step names the record an assessor can inspect at the end of it.

Define the test and exercise calendar
Set out which tests and exercises will run over the year: tabletop exercises on incident response, penetration tests of high-risk systems, continuity and recovery exercises, and any audits that examine them. Name the business owner for each, the systems or processes in scope, and the suppliers who must take part, including critical suppliers whose services would be needed in a recovery. The output is an approved calendar that the leadership sponsor has signed off. Auditors will ask for it first, and then compare it with the exercises that actually ran.
Set a single findings register
Record every finding from every test and exercise in one register, with a unique identifier, the source exercise, the date, a plain description, and the affected asset or process. Keep the register under change control and restrict edits to named maintainers so that entries cannot quietly disappear. Where tools generate findings, such as vulnerability scanners or case management platforms, the register should link to the originating record rather than retype it. The check at the end of this step is that a sample of exercise reports can be traced to register entries, and that no entry lacks a source.
Define severity and ownership rules
Write the rules that rate each finding's severity, using criteria tied to business impact and exposure, and state which severity levels need escalation and to whom. Assign each finding to one accountable owner with a documented role, and separate the owner who fixes the issue from the person who verifies the fix. Agree these rules with risk management and with the leaders who accept residual risk. The output is an approved severity scheme and an ownership matrix. Without them, the register holds findings that nobody is accountable for closing.
Run after-action reviews with named owners
After each exercise or test, hold a structured review with the participants, including the responsible executives, legal and HR where the scenario called for them, and representatives of suppliers who took part. Record what happened, what was decided, which gaps were found, and the improvement actions, each with a named owner. Circulate the written review to participants and load the actions into the register. The output is a signed-off report for each exercise. Assessors commonly sample these reports to check that the improvements came from real results and were not written afterward.
Tie improvements to plan updates
Trace each improvement that affects how an incident would be handled, or how service would be restored, to the specific section of the incident response, business continuity or disaster recovery plan it changes. Make the edit, record the version and approval, and note which exercise prompted it. Communicate the change to the people who use the plan, and to suppliers where their role changed. The output is a set of versioned plan revisions with a clear link from each one back to a register entry. This linkage is what shows the improvement cycle is closed rather than informal.
Schedule retests with supplier participation
For each closed finding, schedule a retest or a targeted check that shows the fix works, and include suppliers in the retest where the original gap involved them. Record the retest method, the date, the tester, and the result, then update the register status only on evidence. Reopen any finding that fails the retest, and carry overdue items into the next leadership review. The output is a register in which every closed item has retest evidence attached. Ask your implementation partner or assessor to confirm the retest method is sufficient for the risk, because the choice of method is an organizational decision.

Evidence that shows ID.IM-02 is working between audits

ID.IM-02 asks whether tests and exercises actually produce improvements, so the evidence has to show a chain from planned exercise to closed finding to revised plan. The cards below cover the artifacts that form that chain, and each one needs a named owner and a fixed review cadence so the record stays current between formal assessments.

Exercise plans and scenarios

Each tabletop, continuity or technical test needs a written plan that states its objective, scope, participants, injected events and success criteria before it runs. Keep plans in version control with the date and approver recorded. Review the scenario library on a fixed cadence, for example each quarter, so that scenarios reflect current threats, recent incidents and systems added since the last exercise. Ask the exercise owner to confirm that each scenario still matches a critical service.

After-action reports

An after-action report records what was tested, what happened, where people or procedures fell short and who agreed to act. It is the document an assessor will sample first when testing ID.IM-02. Assign the exercise lead to issue the report within a set window after each exercise and require sign-off from the control owner. Keep the report separate from the plan so that the record shows what was learned rather than what was intended.

Penetration test reports with remediation tracking

Penetration test reports identify exploitable weaknesses in high-risk systems, and the evidence that matters is what happened after the report was delivered. Track each finding from report to retest, with the fix, the retest result and the date of closure. Confirm with the testing provider which retest is included in scope, since the fee and timing depend on it. Name the system owner who accepts residual risk when a finding is deferred.

Findings register with owners and dates

A single findings register consolidates observations from exercises, penetration tests and audits, so no improvement depends on someone remembering it. Each entry needs an owner, a target date, a status and a link to the source report. Review overdue items at a fixed governance meeting, typically monthly, and record decisions to extend or accept risk. The register is the simplest proof that improvements are identified and tracked to closure.

Plan revision records

Improvements are only shown to have been made when the incident response, continuity or recovery plan changes after a test. Keep version history for each plan, with a change log that links each revision to the exercise or finding that prompted it. Assign the plan owner to approve revisions and to confirm that the updated contact lists, escalation paths and recovery steps match the environment. Review the revision log at each planned exercise cycle.

Supplier exercise participation records

ID.IM-02 expects exercises to involve suppliers and relevant third parties where they support critical services. Keep attendance records, agreed roles, contact details and the outcomes of joint continuity or recovery exercises with each critical supplier. Assign the supplier manager to request these records annually and confirm that contract terms still allow participation. Gaps in supplier participation should appear in the findings register like any other finding.

What ID.IM-02 costs in money and effort

This table compares the cost components of acting on ID.IM-02 findings from tests and exercises, showing who is paid, whether each cost is one-time or recurring, and what pushes it up or down. No prices or durations are stated because none are supplied, so use the rows to build the scope and quote request. Read the drivers column first, since test frequency, supplier count and system count set most of the spend.

Cost component	One-time or recurring	Who is paid or who carries effort, and what drives cost
Tabletop and continuity exercise facilitation	Recurring	Facilitator time and internal participants per exercise. Drivers: exercise frequency, number of scenarios, and whether executives, legal and HR join. Ask for facilitation hours per exercise in the quote.
Penetration testing of high-risk systems	Recurring	Tester fees per engagement, usually fixed-scope. Drivers: number of high-risk systems, test depth, and retest scope. Ask whether retests after fixes are priced separately.
Supplier participation effort	Recurring	Staff time from your team and from critical suppliers for joint continuity tests. Drivers: number of critical suppliers and whether contracts already allow joint exercises. Confirm supplier obligations before scoping.
Findings tracking tooling and licenses	One-time setup, recurring license or hosting	Commercial case or ticketing licenses, or self-hosted open-source tools such as DFIR-IRIS (LGPL-3.0-or-later) for case records and audit trails. Open source can remove license spend, but hosting, patching and administration remain internal or partner effort.
Monitoring tooling for metrics and vulnerability findings	One-time setup, recurring operation	Self-hosted options such as Wazuh (GPL-2.0-only) and Fleet (MIT) can remove license spend for vulnerability detection. Drivers: endpoint count, feed hosting and analyst time. Confirm supported platforms and feed options with each vendor.
Engineering time to close technical findings	Recurring	Internal engineers or an implementation partner fixing configuration, patching and architecture gaps. Drivers: number and severity of findings, and system count. Ask the partner for a findings triage estimate before work starts.
Evidence upkeep	Recurring	Staff time to record exercise reports, test results, corrective action records and closure dates. Drivers: number of exercises and tests per year, and how well the records are kept in one system.
Auditor sampling and assessor support	Recurring per assessment cycle	Fees paid to the independent auditor or assessor, who issues any report. Drivers: sample size, number of exercises in the period, and quality of the evidence. DeployOpen prepares evidence but does not issue reports.

Which self-hosted tools produce ID.IM-02 evidence

Wazuh's vulnerability detection correlates the software inventory that each agent collects with a vulnerability repository, either Wazuh's CTI repository or a locally hosted offline copy. It identifies vulnerabilities in the operating system and installed applications of monitored endpoints. For ID.IM-02, this helps show whether a weakness found in a penetration test or exercise was actually remediated, because the same endpoints can be checked again after the fix.

Retest evidence: Compare findings on the same endpoints before and after remediation, and keep the dated results with the test report.
Offline operation: A locally hosted copy of the vulnerability data can support networks where agents cannot reach external sources. Confirm the update process for that copy.
Endpoint scope: Coverage follows the agents deployed. Check that the systems named in the test scope have agents and a software inventory.
Licensing: Wazuh is licensed under GPL-2.0-only. Have counsel confirm that the license fits how you distribute or modify it.
Limits: Detection depends on the repository data and inventory accuracy. Document these limits so an assessor does not read a clean result as proof of no weakness.

Confirm with your environment whether the agents, inventory scope and offline repository update process meet the systems and retest cadence your exercise plan requires.

Where organizations fall short on ID.IM-02 and how to close each gap

Most ID.IM-02 failures are not failures to test. They happen after the test, when findings lose an owner, a deadline or a retest. The cards below cover the gaps assessors most often find and the practical fix for each.

Exercises with no after-action report

A tabletop or continuity exercise often ends with a debrief and no written record of what failed, who attended and which decisions were wrong. Without that record, ID.IM-02 has nothing to feed into improvement. Write the after-action report within an agreed window, list each gap as a numbered finding, and file it with the exercise plan so an assessor can trace test to outcome.

Findings without a named owner

Penetration test and exercise findings frequently sit in a shared spreadsheet with no accountable person. Each finding needs one owner with authority to change the system or process, plus a target date agreed with that owner. Check the findings register monthly for any item without an owner, because unowned items are the ones that never close.

Supplier exercises that exclude the supplier

Organizations often run recovery exercises internally and assume critical suppliers would behave the same way. ID.IM-02 expects improvements to come from tests run with suppliers and relevant third parties. Invite the provider to the exercise, agree its role in writing, and record the supplier's own findings alongside yours. Confirm the contract gives you the right to test or to receive the supplier's test results.

Closed findings that are never retested

A ticket marked done is not evidence that the weakness is gone. Teams often close a penetration test finding after a patch is applied and never confirm the fix worked. Set a retest step for every high-risk finding, record the date and method of verification, and reopen the item if the retest fails. Assessors look for this verification step specifically.

Plan updates not traced to test results

Incident response and recovery plans are sometimes revised after a test, but nobody can show which finding caused which change. Keep a change log that links each plan revision to the exercise or test finding that prompted it, with the version and approval date. This traceability is what links ID.IM-02 to ID.IM-04, which covers maintaining the plans themselves.

Who does what: your team, an implementation partner and the auditor

Your organization owns ID.IM-02. NIST's CSF is voluntary and NIST does not certify, so no outside body grants you the outcome. Your security, IT, business continuity and legal staff decide which tests and exercises matter, accept or reject findings, assign owners and fund the fixes. Those decisions are what the Subcategory asks you to show: that improvements are actually identified from tests and exercises and then acted on.

Exercise ownership: Set the annual test and exercise calendar, including tabletop exercises and continuity exercises that involve critical suppliers.
Risk decisions: Decide which findings are accepted, mitigated or transferred, and record the reason for each decision.
Remediation: Assign owners and due dates for each improvement and track them to closure in your own system of record.
Supplier involvement: Invite critical service providers into exercises and agree in contracts how they share results.
Lessons learned: Update incident response plans, runbooks and continuity plans after each exercise.

Before engaging anyone, confirm that a named executive owns the exercise program and that your findings register is the document of record.

Questions buyers ask before hiring outside help for ID.IM-02

How much effort does an ID.IM-02 improvement program take?

The effort depends on how many tests, exercises and supplier engagements the program covers, how many systems are in scope, and how much remediation follows each finding. No researched figure for hours or duration is available for this work, so ask for a written breakdown in your scope. A useful quote separates the work into four parts: planning the exercise calendar, running or coordinating each test, triaging and tracking findings, and reporting improvements back into plans. Ask the provider to state which of these parts are fixed-scope deliverables and which are retainer work.

How long does it take to get a findings loop working?

A findings loop is working when a test finding becomes a tracked improvement with an owner, a due date and a closure check. No supplied timeline exists for this, so confirm the schedule in writing rather than relying on a generic estimate. Ask the provider to show the first exercise date, the first report, the date remediation items enter your ticketing system, and how the next test verifies that earlier fixes held. Timelines depend heavily on how quickly your teams can get access to systems and suppliers.

What does the organization need to provide for this work?

The organization must name owners for each test, each finding and each improvement action, because a partner cannot accept business risk decisions on your behalf. Expect to commit executive time for tabletop exercises, which NIST's Implementation Examples for ID.IM-02 tie to involving leadership, legal and HR. Supplier access is often the constraint: continuity exercises with critical suppliers require contract rights, contacts and test windows. Ask the partner to list these dependencies in the scope document before work starts.

Can our own team run ID.IM-02 without outside help?

Yes, many organizations run tabletop exercises and track improvements internally, and NIST's CSF 2.0 does not require outside delivery. The practical test is whether someone can plan exercises, record results against the Subcategory outcome, and keep improvements moving after the exercise ends. External help is most useful for penetration testing of high-risk systems, independent facilitation, and building the evidence trail an assessor will review. Compare the cost of hiring those skills against the cost of staff time and the risk of gaps in coverage.

Does NIST certify ID.IM-02 or any CSF implementation?

No. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services, and has no plans for a conformity assessment program. Any vendor or consultant who claims to certify CSF 2.0 compliance is making a claim NIST does not support. Ask for the exact wording of any deliverable so that it describes an assessment or alignment review, not a certificate.

What will an auditor ask to see for ID.IM-02?

An assessor will typically ask for the exercise plan, the scenarios tested, the attendee lists, the test reports and the list of findings, together with proof that each improvement was assigned, implemented and checked. For supplier-involved exercises, expect requests for the agreements that allow testing and the notes from the joint sessions. If your environment is also mapped to ISO/IEC 27001:2022 or to CIS Safeguard 17.7, the same records may serve more than one framework, but confirm that mapping with the assessor because it is not a certification result.

What can an implementation partner sign off, and what can it not?

A partner can prepare exercise designs, run tests, document findings, configure tooling that records evidence, and report on the state of the program. A partner cannot issue an audit report, attestation or certificate, and cannot accept the risk of an improvement being left open. Only an independent auditor or assessor issues an assessment result, and the organization owns its controls. Confirm in the written scope which deliverables are the partner's, which are yours, and which belong to your assessor.

Which open-source tools can feed the findings loop?

Vulnerability detection tools can supply inputs to ID.IM-02 by showing which known vulnerabilities remain on monitored hosts after a test. Wazuh correlates agent software inventories with its vulnerability repository, and Fleet matches installed software against sources including the NVD and OSV. DFIR-IRIS can hold each incident case as one record with timeline, evidence and audit trail, which helps when exercise findings must be traced to actions. Confirm each tool's coverage for your operating systems and applications before relying on it as evidence.

How DeployOpen scopes, implements and prepares ID.IM-02 evidence

DeployOpen works on ID.IM-02 by setting up the systems that run security tests, exercises and supplier continuity drills, then preparing the records that show improvements were identified and tracked. The organization keeps ownership of its controls, and an independent auditor or certification body is the only party that issues reports or certificates.

How we scope

Agree in writing which tests, tabletop exercises and supplier continuity drills fall inside the engagement before work starts.
Confirm which high-risk systems and critical suppliers are in scope, and who owns the findings from each exercise.
Define the evidence the organization needs, such as findings registers, remediation tickets and after-action records.

How we build

Deploy and configure self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks.
Connect vulnerability detection and case management tools so test findings flow into tracked, owned improvement actions.
Set up case records with timelines, task lists and audit trails so exercise outcomes can be traced to later changes.

How we hand over

Document configuration, data flows, roles and the procedures that turn test results into improvement actions.
Deliver an evidence map linking each exercise, test and remediation record to the ID.IM-02 Subcategory.
Walk the client's staff through the platforms and records so they can run the next exercise without outside help.

How we support

Fixed-scope engagements have deliverables and timelines agreed in writing before work starts, and a quote follows from that scope.
Ongoing support, upgrades and continuous testing are available as retainers for organizations that run exercises every year.
Ask your auditor which evidence they expect for ID.IM-02 before the build starts, so the records match their testing approach.