Choose one business scenario and a small group of decision makers. The useful output is a record of the decisions your team could and could not make.

Choose a business consequence

Start with an interrupted service, an inaccessible account, or an uncertain data exposure. Decide what the exercise should reveal about your organization, then give participants a clear starting situation.

Bring the decision makers

Include people who can explain technical options and people who own customer, operational, and communications decisions. Confirm who stands in when the primary owner is unavailable.

Record uncertainty

Ask which facts are known, which are assumptions, and which evidence is still needed. Note the decisions delayed by missing contacts, access, authority, or information.

Give the debrief an owner

Turn observations into a short action list with dates. Revisit the most important unresolved decision after the team has changed the plan or gathered the missing information.

TAKE IT INTO YOUR NEXT MEETING

A starting checklist.

  • Business scenario and exercise objective
  • Participants and decision authority
  • Evidence and escalation questions
  • Observer notes and unresolved decisions
  • Action owners and follow-up date
FURTHER READINGNIST incident response guidance, SP 800-61 Rev. 3

This guide provides general planning questions. Adapt them to your environment and agreed assessment requirements.

Back to resources