Cyber security · Facilitated tabletop

The Incident Response Tabletop

The worst time to design your incident response is during an incident. This is a facilitated drill: a ransomware scenario unfolds through timed injects across the five phases of response — detect, contain, eradicate, recover, learn. Gather the team, assign the roles below, and work each inject together. Capture the decision, watch the clock, and print the retro at the end.

Before you start

Best run with 3–8 people and a facilitator (you). Assign these roles so the room has to coordinate — the friction between them is the exercise.

Incident Commander — makes the call, owns the timeline
Technical Lead — containment and eradication actions
Comms / Legal — customers, regulators, press, disclosure clock
Executive Sponsor — pay/don't-pay, business trade-offs
Scribe — fills the decision box each round (that's this tool)