Incident Response Tabletop

---
name: incident-response-tabletop
enabled: true
description: |
  Use when performing incident response tabletop — plans and facilitates a
  tabletop exercise to test incident response procedures without impacting
  production systems. Covers scenario design, participant preparation, exercise
  facilitation, response evaluation, and after-action review to identify gaps in
  incident readiness.
required_connections:
  - prefix: incident-mgmt
    label: "Incident Management Platform"
config_fields:
  - key: scenario_type
    label: "Incident Scenario Type"
    required: true
    placeholder: "e.g., security breach, major outage, data loss, ransomware"
  - key: participants
    label: "Participant Teams"
    required: true
    placeholder: "e.g., engineering, security, communications, leadership"
  - key: exercise_duration
    label: "Exercise Duration"
    required: false
    placeholder: "e.g., 2 hours"
features:
  - TEAM_PRODUCTIVITY
  - INCIDENT_RESPONSE
  - EXERCISE
---

# Incident Response Tabletop Exercise

## Phase 1: Exercise Planning
1. Define exercise objectives
   - [ ] Test incident detection and escalation procedures
   - [ ] Validate communication channels and templates
   - [ ] Evaluate decision-making under pressure
   - [ ] Identify gaps in runbooks and documentation
   - [ ] Test coordination between teams
   - [ ] Verify compliance with notification requirements
2. Select scenario type and scope
3. Identify participants and assign roles
4. Schedule exercise and send calendar invitations

### Exercise Configuration

| Element | Details |
|---------|---------|
| Scenario | |
| Date/Time | |
| Duration | hours |
| Facilitator | |
| Observer/Scribe | |
| Participants | |
| Objectives | |

## Phase 2: Scenario Design
1. Create a realistic incident scenario
   - [ ] Initial detection signal (alert, customer report, security tool)
   - [ ] Escalating injects at timed intervals
   - [ ] Ambiguous information requiring investigation
   - [ ] Decisions points requiring trade-offs
   - [ ] External stakeholder communication triggers
   - [ ] Resolution path (but do not share with participants)
2. Prepare injects (new information introduced during exercise)

### Scenario Timeline

| Time (min) | Inject | Information Provided | Expected Response | Evaluation Criteria |
|-----------|--------|---------------------|-------------------|-------------------|
| 0 | Initial alert | | | Detection & triage |
| 15 | Escalation | | | Severity assessment |
| 30 | Scope expansion | | | Communication |
| 45 | Customer impact | | | External comms |
| 60 | Root cause clue | | | Investigation |
| 75 | Resolution option | | | Decision-making |
| 90 | Recovery | | | Recovery procedures |

## Phase 3: Participant Preparation
1. Prepare participants
   - [ ] Send pre-exercise briefing (objectives, not scenario details)
   - [ ] Remind participants to bring laptops, access to tools
   - [ ] Share ground rules (no real system changes, time compression)
   - [ ] Assign exercise roles (IC, communications, technical leads)
   - [ ] Provide reference materials (runbooks, escalation paths, contact lists)
2. Brief observers on evaluation criteria
3. Set up exercise communication channels (separate from production)

### Role Assignments

| Role | Participant | Responsibilities During Exercise |
|------|-----------|--------------------------------|
| Incident Commander | | Overall coordination, decision-making |
| Technical Lead | | Investigation, mitigation |
| Communications Lead | | Internal/external communications |
| Security Lead | | Security assessment (if applicable) |
| Executive Sponsor | | Business decisions, customer escalation |
| Observer/Scribe | | Document responses, timing, gaps |

## Phase 4: Exercise Facilitation
1. Run the tabletop exercise
   - [ ] Set the scene and deliver initial inject
   - [ ] Allow participants to discuss and respond naturally
   - [ ] Introduce injects at planned intervals
   - [ ] Ask probing questions to test depth of response
   - [ ] Observe but do not lead (let gaps surface naturally)
   - [ ] Track decisions made and rationale
   - [ ] Note areas of confusion or disagreement
   - [ ] Time-compress as needed to cover full scenario
2. Capture observations in real-time

### Facilitator Probing Questions
- "Who needs to be notified at this point?"
- "What would you communicate to customers?"
- "Where would you find the runbook for this?"
- "What is your rollback plan?"
- "How do you confirm the incident is fully resolved?"
- "What regulatory notifications are required?"

## Phase 5: After-Action Review
1. Conduct debrief immediately after exercise
   - [ ] What went well?
   - [ ] What surprised participants?
   - [ ] Where did confusion or delays occur?
   - [ ] Were runbooks and documentation adequate?
   - [ ] Were the right people in the room?
   - [ ] Were communication templates effective?
   - [ ] What would participants do differently?
2. Document all findings

### Gap Analysis

| Category | Finding | Severity | Root Cause | Remediation |
|----------|---------|----------|-----------|-------------|
| Detection | | High/Med/Low | | |
| Escalation | | | | |
| Communication | | | | |
| Technical response | | | | |
| Documentation | | | | |
| Decision-making | | | | |

## Phase 6: Improvement Plan
1. Prioritize identified gaps
2. Assign remediation actions with owners and deadlines
3. Update runbooks and procedures based on findings
4. Schedule follow-up exercises to validate improvements
5. Share lessons learned with broader organization

### Improvement Actions

| Priority | Action | Owner | Deadline | Status |
|----------|--------|-------|----------|--------|
| 1 | | | | |

## Counter-Rationalizations

| Shortcut | Counter | Why |
|----------|---------|-----|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |

## Output Format
- **Exercise Summary**: Scenario, participants, and timeline
- **Response Evaluation**: How well teams performed at each phase
- **Gap Analysis**: Identified weaknesses with severity
- **Improvement Plan**: Remediation actions with owners and deadlines
- **Lessons Learned**: Key takeaways for the organization

## Action Items
- [ ] Design realistic scenario with timed injects
- [ ] Prepare participants and assign roles
- [ ] Facilitate exercise and capture observations
- [ ] Conduct after-action review
- [ ] Document gaps and assign remediation actions
- [ ] Update runbooks and procedures based on findings
- [ ] Schedule next tabletop exercise (quarterly recommended)