Advanced level · Module 6: Capstone: Organisational Security Programme · Lesson 3 of 5
Testing the Incident Response Plan
Run a tabletop exercise with the organisation's team.
In this lesson you will
- Facilitate a tabletop exercise
- Improve the plan from findings
Key concepts
tabletopinjectsobservationsplan updates
The lesson
Use a realistic scenario from the risk register, such as ransomware during donor reporting week.
Facilitate with injects, observe decisions and communication, and time-box the exercise.
Hold a blameless debrief and update the plan.
Step by step
- Prepare the scenario.
- Run the exercise.
- Debrief.
- Update the plan.
Practice activity
Run and report the capstone tabletop exercise.
Expected result: An exercise report and an updated plan.
Check your understanding
-
Where should the tabletop scenario come from?
Show answer
The organisation's risk register.
-
What follows the exercise?
Show answer
A blameless debrief and plan updates.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.