The white team is responsible for refereeing an engagement between a Red Team (attackers) and a Blue Team (defenders) in an enterprise set up with information and systems. The white team acts as a judge by enforcing rules during the exercise and scoring the other groups. Besides, the team ensures that the activities of Red and Blue Teams run fairly without causing operational problems. The group has prior knowledge of unannounced Red Team missions and acts as observers during the exercise to maintain the defined testing threshold. Finally, the White Team derives lesson-learned, conducts post engagement assessment, and documents and shares the results.