Lab ID: TABLETOP-IR-01 Outcome: Coordinate technical, operational, privacy, legal, and communication decisions during a fictional incident. Environment: Scenario packet and role cards. Time: 60-120 minutes.
Roles
- Incident coordinator
- Security analyst
- IT or service owner
- Privacy or records lead
- Legal or compliance advisor
- Communications lead
- Executive sponsor
- User or community representative
Scenario Design
The starting packet should include:
- Mission and critical services
- Known and unknown facts
- Initial technical indicators
- Affected users or data categories
- Recovery dependencies
- Contact and authority structure
Injects may include new evidence, a service outage, media inquiry, unavailable backup, third-party notification, or accessibility concern.
Decision Log
- Time
- Complete in the editable or printed copy.
- New information
- Complete in the editable or printed copy.
- Decision
- Complete in the editable or printed copy.
- Reason
- Complete in the editable or printed copy.
- Dissent or unresolved issue
- Complete in the editable or printed copy.
- Owner
- Complete in the editable or printed copy.
- Next review
- Complete in the editable or printed copy.
Evaluation
Assess prioritization, evidence, coordination, communication, protection of people and mission, recovery thinking, and documentation. Do not score one predetermined response as the only acceptable answer when multiple defensible options exist.