# Incident-exercise planner

Crestcon — Serallo Domains Ltd
Published 2 November 2026. Source: https://crestcon.co.uk/resources/incident-exercise-planner/

You may copy and adapt this original template for your organisation’s planning and learning. Retain the source link when sharing an adapted copy. Keep fictional examples separate from your own facts.


Use this planner for a discussion exercise about a defined part of your incident-response plan. It helps the facilitator connect each fictional prompt to a decision, record the reasoning and turn the debrief into assigned improvements.

NCSC guidance recommends clear objectives, appropriate participants, meaningful observations and follow-up ownership. It also distinguishes exercising an existing response plan from creating one. If your team cannot identify its basic response arrangements yet, start with the [planning guide](https://crestcon.co.uk/incident-response/preparing-a-plan/) and a planning workshop.

## Download or print

- [Editable planner, blank records and fictional exercise — Markdown](https://crestcon.co.uk/downloads/crestcon-incident-exercise-planner.md)
- [Planning, prompt and action fields with worked examples — CSV](https://crestcon.co.uk/downloads/crestcon-incident-exercise-planner.csv)

Print the page or edit a downloaded copy in your own approved storage. Nothing you complete is submitted to this website. The exercise below is fictional and discussion-only: participants do not send real incident messages, disable accounts or change live systems.

## Blank planning brief

| Field | Prompt | Your response |
|---|---|---|
| Exercise name and version | Give the exercise an unmistakable name and document version | |
| Objective | Name the decision or process you want to examine | |
| Existing plan | Identify the plan and contact list participants should consult | |
| Sponsor and facilitator | Record who supports the exercise and who controls the discussion | |
| Participants and deputies | Include the roles needed to make or advise on the decisions | |
| Observer | Assign someone to capture evidence without directing the answers | |
| Format and duration | State discussion-only or another explicitly agreed format, and the time available | |
| Scenario assumptions | Describe the fictional service, event and facts available at the start | |
| Boundaries | Define what participants must not do and what is outside scope | |
| Exercise marking | Agree how every prompt and communication will be identified as exercise material | |
| Real incident interruption | State who pauses or ends the exercise if a real event occurs | |
| Success evidence | Describe what an observer should be able to record | |

## Blank prompt and observation record

Create one row per prompt. A prompt is new information introduced by the facilitator, often called an inject. Keep its intended learning purpose separate from the information given to participants.

| Time | Information given | Decision to observe | What participants did and why | Gap or next check |
|---|---|---|---|---|
| | | | | |
| | | | | |
| | | | | |

## Blank action register

| Observation | Improvement | Owner | Due date | Evidence needed for closure | Follow-up check |
|---|---|---|---|---|---|
| | | | | | |
| | | | | | |

Record observations in plain language. “No participant could identify the deputy approver in the supplied plan” is more useful than “communications were poor”. Ask participants to distinguish what they know from what they would need to establish during a real incident.

## Completed fictional exercise: Paper Lantern

**Fictional scenario and organisation.** Merefield Supply has a small order-processing team. The exercise examines who can authorise restrictions on a shared business mailbox while keeping order handling organised. It is not based on a reported incident or a particular software product.

| Planning field | Completed example |
|---|---|
| Name and version | Paper Lantern, version 1 |
| Objective | Identify the decision owner, deputy and continuity arrangements when mailbox access may need restricting |
| Existing plan | Fictional incident plan IR-01 and its role-based contact list, supplied to all participants |
| Sponsor and facilitator | Operations manager sponsors; a facilitator who is not playing the decision owner controls the prompts |
| Participants | IT lead, order-team lead, business decision owner and communications adviser; deputies attend if the primary is unavailable |
| Observer | A colleague records decisions, evidence requests, assumptions and references to the plan |
| Format and duration | 60-minute discussion: 5-minute briefing, 35-minute scenario, 15-minute debrief and 5-minute action assignment |
| Starting assumptions | It is an ordinary working morning. The mailbox handles orders. An approved alternate order channel exists but its activation requires a named owner |
| Boundaries | No live account changes, no contact with customers or suppliers, no external messages and no malware or offensive testing |
| Exercise marking | Begin every prompt with “EXERCISE — Paper Lantern”; label all written material the same way |
| Real event interruption | Any participant may request a pause; the facilitator stops play and uses the real incident route if a genuine event is raised |
| Success evidence | The observer can identify a decision owner or a documented gap, a continuity choice, an evidence request and an assigned follow-up |

## Timed prompts and facilitator notes

Times below are elapsed minutes, not response deadlines for a real incident. Allow the discussion to expose a gap before introducing the next prompt.

| Minute | Prompt to read | What to observe |
|---|---|---|
| 5 | “EXERCISE — Paper Lantern. A colleague reports that a supplier received an unexpected payment-instruction message apparently from the order mailbox. The original message has not yet been inspected.” | Does the team record this as a report requiring verification? Who starts triage and what evidence is requested? |
| 15 | “EXERCISE — Paper Lantern. The IT lead finds a mailbox rule that is absent from the team's approval record. Its purpose and creator are not yet established.” | Does the team separate an unexpected configuration from proof of compromise? Who decides whether access or forwarding should be restricted? |
| 25 | “EXERCISE — Paper Lantern. The usual business approver is unavailable. Orders are arriving, and the team asks whether to activate the alternate order channel.” | Can the deputy be identified? Is the operational consequence considered and recorded? |
| 35 | “EXERCISE — Paper Lantern. A colleague asks for an update to send to the sales team. The cause and extent remain uncertain.” | Does the message distinguish confirmed facts, current action and the next update point? Who approves it? |

The facilitator should answer unplanned factual questions with a clear exercise assumption or “not yet known”. Avoid improvising a surprise outcome merely to force a preferred answer. If participants identify a missing role, record the gap and let them explain how they would escalate it.

The observer should capture the evidence requested and the reasoning behind choices. Do not score success solely by speed; an unexplained fast decision may reveal less capability than a careful decision with a clearly recorded uncertainty.

## Example debrief and improvement record

The observations below are invented outcomes showing the level of detail to aim for.

| Observation | Improvement | Owner | Due | Closure evidence |
|---|---|---|---|---|
| The contact list named the primary approver but no deputy | Add a deputy and agree their authority for this decision | Operations manager | Within five working days of the fictional exercise | Revised plan section acknowledged by both roles |
| Participants could name the alternate order channel but not its activation steps | Write and check a short activation procedure | Order-team lead | Within ten working days | Walk-through record using synthetic orders |
| The proposed update treated the cause as confirmed before evidence was reviewed | Add fact, uncertainty and next-update fields to the message template | Communications adviser | Within five working days | Revised example message reviewed against this scenario |

Close with three questions: what worked, what did the scenario expose, and what should the next exercise test after improvements are made? Record feedback about the exercise itself as well as the response plan.

An action is complete when its agreed evidence exists and the owner has checked it. Put an unverified draft in a visible “awaiting check” state. Use the [post-incident review guide](https://crestcon.co.uk/incident-response/post-incident-review/) for a fuller approach to evidence and improvement ownership, and the [tabletop guide](https://crestcon.co.uk/incident-response/tabletop-exercises/) for exercise design choices.

## Primary references

- [NCSC: Effective steps to cyber exercise creation](https://www.ncsc.gov.uk/guidance/effective-steps-to-cyber-exercise-creation) — accessed 2026-11-02.