# Incident tabletop and decision log

Run this as a discussion with fictional data. Assign roles before introducing the scenario. Do not simulate a real compromise against live systems.

## Roles and preparation

**Coordinator / alternate:** ____________________

**Technical lead / business decision owner:** ____________________

**Communications and legal contacts:** ____________________

**Outside help on call (incident response retainer, insurer's hotline, key providers) and how they are reached without firm systems:** ____________________

**Approved alternate coordination location:** ____________________

**Severity scale used (rate functional impact, information impact, and recoverability separately; state who can declare each level):** ____________________

**Who may authorize external statements, law-enforcement contact, and provider escalation:** ____________________

**Notification obligations the advisers have identified, with their clocks (regulatory, contractual, investor, insurance, law enforcement):** ____________________

## Scenario prompts

1. A user reports an unfamiliar sign-in. What facts are needed, and who begins the record?
2. The usual coordinator is unavailable. Who assumes authority?
3. The identity also owns a critical workflow. How is containment coordinated with continuity?
4. A provider has only partial evidence. What remains uncertain?
5. Access has been restricted. What must be checked before restoration?
6. A payment or wire instruction arrived from a mailbox now suspected compromised. Who stops it, and how is the counterparty warned?
7. Files across a shared workspace have been encrypted or deleted. When does recovery start, and what evidence must be kept first?
8. A vendor reports that its own environment was breached. What does the firm decide, and what does it ask the vendor for?

## Decision log

| Time / timezone | Known fact / evidence | Uncertainty | Decision and reason | Owner | Action / observed result |
| --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |

**Evidence preservation reference (what is kept, where, who can access it, chain of custody):** ____________________

**Notification workstream owner / advice required / clocks started:** ____________________

**Internal communication: who is told what, when, and through which channel:** ____________________

**Restoration acceptance conditions:** ____________________

**Third parties notified, by whom, and when:** ____________________

**All-clear declared by / time / what evidence supported it:** ____________________

## Timing observed

| Measure | Exercise result | Target if one exists |
| --- | --- | --- |
| Report to coordinator assigned |  |  |
| Coordinator assigned to containment decision |  |  |
| Containment decision to action confirmed |  |  |
| First notification decision made |  |  |

## Lessons and follow-up

| Exercise finding | Improvement | Owner | Due date / retest |
| --- | --- | --- | --- |
|  |  |  |  |

- [ ] Plan, contact lists, and alternates updated with what was learned; version and date recorded.
- [ ] Findings that require budget or a vendor change are placed on the leadership review agenda.
- [ ] The next exercise uses a different scenario or a different unavailable person.

## Common failure modes

- Everyone investigates and nobody coordinates.
- Containment destroys the only evidence of how access was gained.
- Notification clocks start at detection, but nobody recorded the detection time.
- The exercise is run with the same people every time and the alternates never practise.

**Exercise conclusion:** ____________________

**Exercise cadence / next date:** ____________________

This log records preparation and decisions. It does not replace the written incident response plan, and it does not determine which notification obligations apply; the advisers do.