Incident Response Tabletop Exercise Kit

Purpose

This kit helps teams rehearse responses to realistic incidents so people make predictable, tested decisions under stress. Use these tabletop exercises to find gaps, clarify roles, and shorten recovery time for critical functions.

Who this is for

Leaders, incident commanders, IT, security, operations, supply chain, legal, communications, and business-unit owners who must coordinate during outages, data incidents, or supply disruptions.

Primary Hungers

• Test response plans so teams respond predictably during real incidents.
• Clarify roles, communications, and decision points before an event occurs.
• Generate concrete remediation actions and owners through rehearsal.

Mal Hungers this kit addresses

Unpracticed plans that fail under stress, slow or chaotic responses that amplify impact and recovery time, unclear ownership and handoffs during incidents.

What's in the kit

• Three scenario templates: IT outage, data incident, supply disruption (each includes situation, timeline, and injects)
• Role scripts and participant briefings
• Facilitator play-by-play notes with suggested inject timing
• Facilitator checklist and timeboxed agenda templates (60, 90, and 120 minute formats)
• Decision log template and evidence collection prompts
• After-action report (AAR) template and prioritized recommendations worksheet
• Post-exercise improvement checklist and tracking suggestions

Before the exercise — Preparation checklist

• Identify objectives: e.g., validate communications, test escalation path, confirm recovery RTOs
• Pick participants (max 10–14 for effective discussion): incident commander, SRE/IT lead, operations lead, supply lead, legal, communications, business owner, facilitator, scribe
• Select format: discussion-only tabletop or role-play with observers
• Distribute participant briefings 48 hours in advance (include scope and non-technical pre-reads)
• Reserve a room or virtual meeting space and assign a timekeeper and scribe
• Print or provide digital copies of the decision log and AAR template

Facilitator’s quick guide — Runbook

1. Kickoff (5–10 min): Welcome, state objectives, confirm “rules of engagement” (no real-world changes, focus on decisions and communications).
2. Scenario brief (5 min): Present starting conditions and critical impacts. Confirm scope and which systems/functions are affected.
3. Initial response (15–25 min): Ask participants to describe first actions—who is called, who declares incident, initial communications and priorities. Scribe records decisions in decision log.
4. Injects and escalation (15–40 min): Deliver timed injects from the scenario template. After each inject, prompt for updated priorities, decisions, and why certain options were chosen.
5. Debrief mini-rounds (10–15 min): After major injects, pause for 2–3 minute reflections: what worked, what was confusing, what information was missing.
6. Close and AAR prep (10–15 min): Summarize key decisions and open actions. Explain how the AAR will be produced and next steps.

Scenario synopses & sample injects

1. IT outage — Critical application down

Synopsis: A primary customer-facing application becomes unavailable during peak hours. Root cause unclear; partial alerts indicate database connectivity failures.

• Inject: Monitoring reports cascading errors in dependent services.
• Inject: A vendor support SLA indicates 4–6 hour response time.
• Decision focus: Failover vs. mitigation vs. customer communications.

2. Data incident — Suspected breach

Synopsis: Anomalous data exports are observed; legal and privacy implications are possible.

• Inject: Forensic log gaps are discovered; uncertain if data exfiltration occurred.
• Inject: A key customer asks for immediate details publicly.
• Decision focus: Containment steps, regulatory notification timing, external communications.

3. Supply disruption — Critical component delayed

Synopsis: A supplier notifies a two-week delay on a component needed for production of a top-selling product.

• Inject: Alternative suppliers have long lead times or fail quality checks.
• Inject: Sales receive customer inquiries threatening churn.
• Decision focus: Prioritization, alternative sourcing, customer commitments.

Decision log & evidence prompts

Record for each decision: time, owner, rationale, alternatives considered, evidence used, communication actions, and expected follow-ups.

After-Action Report (AAR) template

1. Executive summary — what happened and primary impacts
2. Objectives of the exercise and scope
3. Timeline of major events and decisions (from decision log)
4. What went well — validated procedures and strengths
5. Gaps and failures — concrete examples where plans or tools were insufficient
6. Root causes or contributing factors
7. Prioritized recommendations (who, what, when) — use RACI and deadlines
8. Metrics to track (e.g., time to declare incident, time to restore, action closure rate)
9. Follow-up schedule (owner for AAR, re-test dates)

Measuring success

Suggested measures to improve over time:

• Time to decision: measure how long it takes to reach the first formal decision (minutes)
• Completeness of decision logs and assigned owners
• Proportion of AAR recommendations with clear owners and deadlines
• Follow-up compliance: percent actions closed on time
• Subjective readiness survey before/after exercises

Common pitfalls and how to avoid them

• Pitfall: Running a seminar, not a scenario. Fix: Use injects and require concrete decisions.
• Pitfall: Too many participants. Fix: Keep group focused with observers and role rotation.
• Pitfall: No follow-through on AAR. Fix: Publish prioritized actions with owners and follow-up checkpoints.

Tailoring and scaling

Adjust scenario complexity, inject frequency, and participant roles to match your organization’s size and risk profile. For regulated industries, add compliance-focused injects. For distributed teams, run a virtual exercise and test cross-site notifications.

Next steps — recommended cadence

Run at least one tabletop annually for each critical process; increase cadence to quarterly for the most critical systems or after major changes. After two exercises, consider a full-scale simulation for high-risk processes.

Included files and templates

• Scenario templates (IT outage, data incident, supply disruption)
• Facilitator playbook (detailed timed script)
• Participant briefings and role scripts
• Decision log and AAR templates (printable)
• Facilitator checklist and timeboxed agendas

Image search phrase

incident tabletop exercise kit