Advanced level · Module 3: Incident Response and Digital Evidence · Lesson 4 of 4
Lessons Learned and Tabletop Exercises
Improve after incidents and test plans before they are needed.
In this lesson you will
- Run a blameless post-incident review
- Facilitate a tabletop exercise
Key concepts
post-incident reviewblameless culturetabletop exerciseimprovement actions
The lesson
After an incident, a blameless review asks what happened, what went well, what did not and what to change — focusing on systems and processes, not individuals.
Tabletop exercises walk a team through a scenario with new information introduced over time, testing decisions, communication and the plan itself.
Both produce improvement actions with owners and dates.
Step by step
- Prepare a scenario with injects.
- Run the tabletop with roles.
- Hold a blameless review.
- Record improvement actions.
Practice activity
Run and report the business email compromise tabletop exercise.
Expected result: A report with findings and owned improvement actions.
Check your understanding
-
Why should reviews be blameless?
Show answer
So people share information openly and systems improve.
-
What is an inject in a tabletop exercise?
Show answer
New information introduced during the scenario.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.