based on current risk assessments, including credible threats, vulnerabilities, and consequences;

designed, to the extent practicable, to simulate the partial or complete incapacitation of a government or critical infrastructure network resulting from a cyber incident;

designed to provide for the systematic evaluation of cyber readiness and enhance operational understanding of the cyber incident response system and relevant information sharing agreements; and

designed to promptly develop after-action reports and plans that can quickly incorporate lessons learned into future operations.

include a selection of model exercises that government and private entities can readily adapt for use; and

conform to the requirements described in subparagraph (A);

are consistent with any applicable national, State, local, or Tribal strategy or plan; and

provide for systematic evaluation of readiness.