Incident Readiness Tabletop
Moderated scenario exercise (ransomware or data leak) with role cards and an evidence record.
TT-01Duration: 1 day + debriefSecurity
Outcome
A rehearsed incident plan with a gap list and escalation path, documented before the real event.
Who it is for
Leadership + IT/ops team (4–12 people) who have never structured their incident roles.
Deliverables
- Scenario brief (ransomware or data leak)
- Role card per participant
- 2-hour exercise with timeline
- Gap list: decision, communication, evidence gaps
- 30-day remediation roadmap
- Debrief record (evidence)
In scope
- 1 scenario
- up to 12 participants
Out of scope
- Red-team execution
- Technical forensics
Prerequisites
- Team calendar window
- roles named in advance
Acceptance
- Acceptance via debrief record and 30-day roadmap.
Human approvals
- Leadership confirms scenario choice
- Owner reviews gap list before rollout
Frequently asked questions
Remote possible?
Yes — video conference with shared roles; the evidence record is identical.