Compliance roleplays, ready to run against 30 frameworks

Each framework below carries a legal or regulator-enforced duty to train or exercise. Maitris has roleplays built for it and a compliance report that maps every criterion to the clause it comes from. No set-up project: pick the framework, run the roleplay, get the report.

The library

Grouped by legal weight. Entries are added as roleplays are released; anything still in passage is held back until it is law.

Qualifications

  • SFJ Awards Incident Command qualifications (Levels 3 to 7)

    SFJ Awards · UK

    Training or exercising duty
    Qualification handbooks, assessment criteria per level
    Evidence expected
    Portfolio evidence per assessment criterion, assessor sign-off, IQA sampling
    Recurrence
    Revalidation per service policy
    Duty holder
    Individual commander; fire and rescue service as centre

UK statutory duties

  • Civil Contingencies Act 2004 + Contingency Planning Regs 2005

    Cabinet Office / COBR; LRF assurance; ministerial enforcement via s.10 orders · UK

    Training or exercising duty
    CCA s.2(1); CP Regs 2005 reg 24 (plans must include training of staff & exercising); statutory guidance 'Emergency Preparedness' ch.5
    Evidence expected
    Exercise records, training attendance, plan validation, LRF assurance returns
    Recurrence
    Ongoing; plans reviewed regularly, exercised periodically
    Duty holder
    Organisation (Cat 1 / Cat 2 responders)

  • Fire and Rescue Services Act 2004 s.21 + Fire & Rescue National Framework (England)

    Home Office; HMICFRS inspection · England (W/S equivalents)

    Training or exercising duty
    FRSA 2004 s.21 (must have regard); National Framework 2018 (national resilience, training)
    Evidence expected
    Operational competence records, NOG alignment, HMICFRS evidence
    Recurrence
    Ongoing
    Duty holder
    Organisation (FRA)

  • Police Act 1996 s.37A: Strategic Policing Requirement

    Home Office; HMICFRS · England & Wales

    Training or exercising duty
    SPR 2023 — civil emergencies, CT, cyber; College of Policing APP Civil Emergencies
    Evidence expected
    Command cadre accreditation, exercise participation, APP compliance
    Recurrence
    Ongoing; SPR refreshed periodically
    Duty holder
    Organisation (PCC / Chief Constable)

  • NHS EPRR: NHS Act 2006 s.252A (via Health & Care Act 2022) + NHS England EPRR Framework + EPRR Core Standards

    NHS England (regional EPRR leads); ICBs · England

    Training or exercising duty
    EPRR Core Standards domain 'Training and exercising' (standards on TNA, exercise programme: live every 3y, table-top annual, comms every 6 months)
    Evidence expected
    Annual EPRR assurance self-assessment (graded Full/Substantial/Partial/Non-compliant), exercise logs, TNA
    Recurrence
    Annual return; exercise cadence per standards
    Duty holder
    Organisation (trusts, ICBs, NHSE); AEO accountable individual

  • Health and Safety at Work Act 1974 + MHSWR 1999 (regs 8, 13) + Corporate Manslaughter Act 2007

    HSE; local authorities; CPS/Crown Office · UK

    Training or exercising duty
    MHSWR reg 8 (serious & imminent danger procedures), reg 13 (capabilities & training); HSWA s.2(2)(c)
    Evidence expected
    Risk assessments, emergency procedures, training records
    Recurrence
    Ongoing; on change of risk
    Duty holder
    Organisation (employer) + individuals (s.7/37 HSWA)

  • COMAH 2015 (Control of Major Accident Hazards)

    HSE / EA / SEPA / NRW (Competent Authority) · UK

    Training or exercising duty
    COMAH regs 12–14 (on-site & off-site emergency plans), reg 15 (review & test at least every 3 years)
    Evidence expected
    Plan test reports, exercise records, SMS documentation
    Recurrence
    Test ≥ every 3 years
    Duty holder
    Organisation (operator) + LA (off-site plans)

  • REPPIR 2019 (Radiation Emergency Preparedness & Public Information)

    ONR; HSE; LAs · UK

    Training or exercising duty
    REPPIR reg 12 (review & test of emergency plans), reg 10–11 (plans)
    Evidence expected
    Plan test records, exercise reports
    Recurrence
    Test ≥ every 3 years
    Duty holder
    Organisation (operator) + LA

  • Terrorism (Protection of Premises) Act 2025 ('Martyn's Law')

    Security Industry Authority (regulator) · UK

    Training or exercising duty
    s.5–6 (standard duty: public protection procedures), s.7–8 (enhanced: measures + document + training), s.11 (training)
    Evidence expected
    Documented procedures, training records, annual review, SIA registration
    Recurrence
    Ongoing; enhanced document reviewed on material change
    Duty holder
    Organisation (responsible person); premises/events

    Status: Royal Assent Apr 2025; ~24-month implementation — obligations expected from ~2027

  • NIS Regulations 2018

    Sector competent authorities (DHSC, Ofgem, DfT, ICO for RDSPs etc.) · UK

    Training or exercising duty
    NIS regs 10–12; NCSC Cyber Assessment Framework (CAF) objectives B6 (staff awareness & training), D1 (response & recovery planning), D1.b (response & recovery capability — exercising)
    Evidence expected
    CAF self-assessment, incident reports, exercise evidence
    Recurrence
    Ongoing; CAF assessed periodically
    Duty holder
    Organisation (OES / RDSP)

UK regulator-enforced and assurance frameworks

  • JESIP Joint Doctrine (Joint Emergency Services Interoperability Principles)

    JESIP Interoperability Board; HMICFRS; NHSE · UK

    Training or exercising duty
    Joint Doctrine 3rd ed. 2021; Manchester Arena Inquiry Vol 2 recs; Grenfell Phase 2 recs
    Evidence expected
    JESIP training completion, refresher, exercise records, JOL
    Recurrence
    Refresher expected (typically annual/biennial per service)
    Duty holder
    Organisation + commanders

  • National Resilience Standards for LRFs (Cabinet Office)

    Cabinet Office / DLUHC resilience · England

    Training or exercising duty
    NRS 2024 — maturity levels (Good / Leading)
    Evidence expected
    LRF self-assessment, exercise programme
    Recurrence
    Annual
    Duty holder
    LRF (collective)

  • HMICFRS inspection frameworks (police PEEL; fire effectiveness/efficiency/people)

    HMICFRS · England & Wales

    Training or exercising duty
    PEEL; FRS inspection judgements
    Evidence expected
    Inspection evidence packs
    Recurrence
    Cyclical (~2 years)
    Duty holder
    Organisation

  • CQC Regulation 17 (good governance) / Reg 12 (safe care)

    CQC · England

    Training or exercising duty
    HSCA (Regulated Activities) Regs 2014 regs 12, 17
    Evidence expected
    Governance & BC evidence, training
    Recurrence
    Ongoing
    Duty holder
    Organisation (registered provider)

  • UK Corporate Governance Code 2024: Provision 29

    FRC · UK (premium-listed)

    Training or exercising duty
    Provision 29 effective for periods from 1 Jan 2026
    Evidence expected
    Board declaration in annual report
    Recurrence
    Annual
    Duty holder
    Board

  • Sector regulators: ONR (nuclear), CAA (aviation), ORR/RAIB (rail), Ofgem/Ofwat licence conditions

    ONR, CAA, ORR, Ofgem, Ofwat · UK

    Training or exercising duty
    SEMD 2022; Nuclear Site Licence Condition 11; CAP 168
    Evidence expected
    Plan test records, licence compliance returns
    Recurrence
    Periodic
    Duty holder
    Organisation (licensee)

EU and national law

  • NIS2 Directive (EU) 2022/2555

    National competent authorities (ANSSI in FR) · EU (member-state transposition)

    Training or exercising duty
    Art 20(2) (management body training), Art 21(2)(g) (basic cyber hygiene & training), Art 23 (24h/72h/1-month reporting)
    Evidence expected
    Training records, incident reports, risk-management measures
    Recurrence
    Regular (undefined); reporting per incident
    Duty holder
    Organisation (essential / important entities) + management body

    Status: In force; FR transposition (loi Résilience) still in passage

  • DORA (EU) 2022/2554

    ESAs + national FSAs (ACPR/AMF in FR) · EU

    Training or exercising duty
    Art 13(6) (ICT security awareness & training incl. management), Art 11 (response & recovery plans, tested annually), Art 17–19 (incident mgmt & reporting), Art 26 (TLPT)
    Evidence expected
    Test reports, training records, incident reports
    Recurrence
    Annual testing; TLPT every 3 years
    Duty holder
    Organisation (financial entities) + management body

  • CER Directive (EU) 2022/2557 (Critical Entities Resilience)

    National authorities · EU

    Training or exercising duty
    Art 13 (resilience measures incl. employee training), Art 15 (incident notification)
    Evidence expected
    Resilience plans, training records
    Recurrence
    Ongoing
    Duty holder
    Organisation (critical entities)

  • Seveso III Directive 2012/18/EU

    National authorities (DREAL in FR) · EU

    Training or exercising duty
    Art 12 (emergency plans, test ≥ every 3 years)
    Evidence expected
    Plan test reports
    Recurrence
    ≥ every 3 years
    Duty holder
    Organisation (operator) + LA

  • France: Code de la sécurité intérieure: ORSEC; Plan Communal de Sauvegarde (PCS) / PICS; Loi Matras 2021

    Préfectures; DGSCGC · France

    Training or exercising duty
    CSI L.731-3; Loi Matras 2021 art. 11 (extension of PCS obligation; exercise every 5 years)
    Evidence expected
    PCS, exercise reports
    Recurrence
    Exercise ≥ every 5 years
    Duty holder
    Communes / EPCI / préfets

US law

  • NIMS / ICS (HSPD-5, PPD-8): condition of federal preparedness grants

    FEMA · US

    Training or exercising duty
    NIMS Implementation Objectives; ICS-100/200/300/400, IS-700/800 training levels
    Evidence expected
    Training completion, exercise (HSEEP) records
    Recurrence
    Ongoing; HSEEP exercise cycles
    Duty holder
    Organisation (state/local/tribal, grant recipients)

  • OSHA 29 CFR 1910.38 (EAP) / 1910.120(q) (HAZWOPER incident command)

    OSHA · US

    Training or exercising duty
    1910.38(e) training; 1910.120(q)(6) ICS training levels
    Evidence expected
    Training records, EAP
    Recurrence
    Initial + refresher (annual for HAZWOPER)
    Duty holder
    Organisation (employer)

International standards

  • ISO 22301 (Business Continuity Management Systems)

    Certification bodies · International

    Training or exercising duty
    cl. 7.2 competence, 7.3 awareness, 8.5 exercise programme
    Evidence expected
    Certificate, exercise records, competence records
    Recurrence
    Exercise programme; 3-year cert cycle
    Duty holder
    Organisation

  • ISO 22320 (Emergency management: incident management guidelines)

    — · International

    Training or exercising duty
    cl. 6–8 command & control, training
    Evidence expected
    —
    Duty holder
    Organisation

  • ISO 22361:2022 (Crisis management guidelines; superseded BS 11200)

    — · International

    Training or exercising duty
    cl. 8 (developing crisis leadership), cl. 9 (training, validation)
    Evidence expected
    —
    Duty holder
    Organisation / crisis team

  • ISO 22398 (Guidelines for exercises)

    — · International

    Training or exercising duty
    Whole standard
    Evidence expected
    Exercise programme docs
    Duty holder
    Organisation

  • ISO/IEC 27001:2022 (A.5.24–5.28) + ISO/IEC 27035 (info-sec incident mgmt)

    Certification bodies · International

    Training or exercising duty
    27001:2022 Annex A 5.24–5.28, 6.3
    Evidence expected
    Certificate, training & incident records
    Recurrence
    3-year cert cycle
    Duty holder
    Organisation

  • NIST SP 800-61 Rev 3 (Incident Response Recommendations)

    — · US/International

    Training or exercising duty
    § Govern/Identify/Protect; training & exercises
    Evidence expected
    —
    Duty holder
    Organisation

  • NFPA 1660 (2024 consolidation of NFPA 1600/1616/1620)

    — · US/International

    Training or exercising duty
    Ch. on training & education; exercises & tests
    Evidence expected
    —
    Duty holder
    Organisation

See the report for your framework

A walkthrough runs one short roleplay against a framework you choose and shows you the compliance report it produces.

Book a walkthrough