Non-CPNI private and third-sector organisations do not have a government body looking after them, although there are a number of WARPs which focus on these areas.

There is a clear distinction in vision between the original CERT-CC construction – a largely passive, best-practice and warning body, and the more active “Information Security Incident Response” elements of the ENISA vision.

As for exercises, my personal experience has been that there is often a great deal of wishful thinking on the part of high-level policy making types, which tends to divorce them from reality. The operational folk who are given the task of making exercises happen are then left to cobble together something that (with a bit of creative PR speak) meets the naive pledges of the policy types. As operational folk tend tend to be practical types they will extract as much learning and other benefits for participants as they can, but the bottom line is that the benefits of exercises (useful as they may be) are not necessarily what policy makers believe them to be.