Defensive exercise example
Incident response
tabletop template.
Practice how a small IT team coordinates when staff lose access to a shared drive. The exercise uses simulated updates and discussion.
Run the shared drive outage exercise
- T+00 · Files stop opening. Identify who leads the response and who records the timeline.
- T+12 · Scope widens. Decide who can isolate an affected workstation, what evidence to preserve, and how to protect backups.
- T+25 · Staff want an update. Assign a communications owner and agree on what can be said before recovery is confirmed.
- T+40 · Recovery checkpoint. Name whoever can approve reopening and agree on the remaining checks.
Start with your incident lead, an IT or operations representative, someone who communicates with staff, and a note taker. Read one update at a time and keep the expected decisions in the facilitator’s notes.
Turn observations into actions
Capture what the group actually decided. If the team disagreed about who could approve a staff update, record the missing responsibility, assign an owner, and write the next concrete action. The after-action CSV keeps those decisions and owners beside the original prompts.
CISA’s facilitator and evaluator handbook