The first requirement of responding to a cyber security attack is to have an incident response plan. However, a plan is no good unless you put it into practice. Just as with physical fitness, cyber fitness requires exercise.
Cyber security exercises should simulate real world cyber attacks and test an organization's response. An exercise should identify what's working and what needs to be corrected.
The benefits of a cyber security exercise are training on dealing with attacks, improved security awareness and providing practical experience. All employees should participate.