INCIDENT READINESS / EXERCISE WORKSPACE
Practice the decision.
Run an original tabletop scenario, pause at each inject, capture what the team would do, then turn gaps into owned actions.
Your exercise stays in this tab
No entries are sent to a server or saved in browser storage. Export JSON before closing, refreshing, or switching scenarios. Use fictional or sanitized details; avoid secrets and personal data.
Define the exercise
Choose a fictional situation and assign the people who will make and record decisions.
Facilitator console
Reveal one inject at a time. The team should state its decision, evidence, communications, and next verification before moving on.
Decision and evidence log
Capture what the team would do at the current inject. Use concrete owners and the evidence needed to revisit the choice.
- No decisions recorded yet.
Playbook stress test
Mark what your actual playbook and authority model can support. A “Ready” mark is a discussion note, not proof of operational readiness.
After-action register
Convert a playbook gap or exercise observation into a specific follow-up with an owner and target date.
No follow-up actions recorded yet.
FACILITATOR GUIDE
Run a useful drill
- Agree the scope, participants, and assumed facts.
- Reveal one inject. Allow discussion before advancing.
- Capture a decision, owner, evidence, communications, and verification point.
- Challenge the real playbook and note gaps.
- Close with named actions and export the record.
Exercise inject times are illustrative, not required response deadlines.
RESPONSE LENS
Check each decision
- PeopleWho can authorize and act?
- EvidenceWhat should be preserved, by whom, and how?
- ContainmentWhat stops harm without destroying the investigation?
- CommunicationWho needs timely, approved facts?
- RecoveryWhat validates a safe return?
HISTORICAL CASE REVIEW · 2023 EVENT
Microsoft Exchange Online intrusion
The Cyber Safety Review Board reviewed the summer 2023 intrusion into Microsoft Exchange Online. Its report examined identity-system security, signing-key protection, forensic visibility, and cloud-provider accountability. This is a historical learning prompt, not a live incident feed or a claim about your environment.
Discussion prompts
- Could your team determine which identities and services were affected?
- What access to identity logs and provider evidence would you have?
- Who owns escalation when the provider itself is part of the investigation?
HANDOFF / EXPORT
Keep the exercise record
Download JSON for a later import. Download the after-action CSV for a planning register. Neither export is transmitted by this site.
METHOD / SOURCES
Source-backed structure
Scenario stories and prompts are original examples. The workflow draws on incident response as part of cyber risk management and on facilitated tabletop discussion.
NIST SP 800-61 Rev. 3 ↗CISA Tabletop Exercise Packages (PDF) ↗Adapt to your own policies, legal obligations, sector requirements, and environment. This aid does not certify readiness.