Run this as a discussion with fictional data. Assign roles before introducing the scenario. Do not simulate a real compromise against live systems.
Roles and preparation
Coordinator / alternate:
Technical lead / business decision owner:
Communications and legal contacts:
Outside help on call (incident response retainer, insurer's hotline, key providers) and how they are reached without firm systems:
Approved alternate coordination location:
Severity scale used (rate functional impact, information impact, and recoverability separately; state who can declare each level):
Who may authorize external statements, law-enforcement contact, and provider escalation:
Notification obligations the advisers have identified, with their clocks (regulatory, contractual, investor, insurance, law enforcement):
Scenario prompts
- A user reports an unfamiliar sign-in. What facts are needed, and who begins the record?
- The usual coordinator is unavailable. Who assumes authority?
- The identity also owns a critical workflow. How is containment coordinated with continuity?
- A provider has only partial evidence. What remains uncertain?
- Access has been restricted. What must be checked before restoration?
- A payment or wire instruction arrived from a mailbox now suspected compromised. Who stops it, and how is the counterparty warned?
- Files across a shared workspace have been encrypted or deleted. When does recovery start, and what evidence must be kept first?
- A vendor reports that its own environment was breached. What does the firm decide, and what does it ask the vendor for?
Decision log
| Time / timezone | Known fact / evidence | Uncertainty | Decision and reason | Owner | Action / observed result |
|---|---|---|---|---|---|
Evidence preservation reference (what is kept, where, who can access it, chain of custody):
Notification workstream owner / advice required / clocks started:
Internal communication: who is told what, when, and through which channel:
Restoration acceptance conditions:
Third parties notified, by whom, and when:
All-clear declared by / time / what evidence supported it:
Timing observed
| Measure | Exercise result | Target if one exists |
|---|---|---|
| Report to coordinator assigned | ||
| Coordinator assigned to containment decision | ||
| Containment decision to action confirmed | ||
| First notification decision made |
Lessons and follow-up
| Exercise finding | Improvement | Owner | Due date / retest |
|---|---|---|---|
- [ ] Plan, contact lists, and alternates updated with what was learned; version and date recorded.
- [ ] Findings that require budget or a vendor change are placed on the leadership review agenda.
- [ ] The next exercise uses a different scenario or a different unavailable person.
Common failure modes
- Everyone investigates and nobody coordinates.
- Containment destroys the only evidence of how access was gained.
- Notification clocks start at detection, but nobody recorded the detection time.
- The exercise is run with the same people every time and the alternates never practise.
Exercise conclusion:
Exercise cadence / next date:
This log records preparation and decisions. It does not replace the written incident response plan, and it does not determine which notification obligations apply; the advisers do.