Run a useful incident exercise
Use a complete 60-minute fictional discussion exercise to test incident authority, alternative communications, evidence decisions and recovery criteria.
A tabletop exercise gives people a safe place to practise decisions using the plan they actually have. Choose what you want to learn, present enough uncertainty to make the discussion realistic and record the changes the organisation needs afterwards.
The NCSC's exercise-creation guidance recommends clear objectives and an existing response plan to test. If the team has no agreed arrangements yet, use a planning workshop first. You can then exercise the decisions it produces.
Objective and boundaries
The original scenario below is designed for a 60-minute discussion. It tests three questions:
- Can the team identify who coordinates and who can approve service restrictions?
- Can it communicate if the ordinary account system is unreliable?
- Can it define the evidence and business checks required before normal operation resumes?
It does not test a real technical exploit, send simulated malicious messages or touch production systems. Label every scenario message clearly as an exercise. Use the existing incident plan and a local copy of the exercise planner to record decisions.
People and preparation
Invite an incident lead or deputy, technical responder, service owner, communications representative and someone familiar with affected data. One facilitator controls the scenario; a separate observer records decisions and evidence. In a small team, combine roles deliberately and note the limitations.
Before the session, agree the exercise channel, start and end announcements, participants' responsibilities and a stop phrase for a real incident. Do not call real emergency contacts or send external notifications as part of the scenario. Any desired verification of contact details should be a separately agreed, clearly identified check.
Scenario: an account concern during a busy morning
Fictional organisation: Harbour Workshop uses cloud email and a customer portal. A staff member reports an unexpected account-setting change. Some staff are having trouble signing in. Customer bookings are continuing, and the cause is unknown.
The facilitator supplies information progressively. Participants should state what they would do, who would do it and which part of the plan supports the decision. If an answer depends on facts not supplied, record the question instead of inventing certainty.
A complete 60-minute running order
| Time | Facilitator prompt | Decisions to observe |
|---|---|---|
| 0–5 minutes | Brief the objectives, boundaries and real-incident stop rule | Does everyone understand the exercise and their role? |
| 5–15 minutes | A staff member reports an unexpected forwarding-rule notification; technical confirmation is pending | Who opens the record, coordinates the response and decides what evidence to obtain? |
| 15–25 minutes | The usual incident lead is unavailable; an unfamiliar sign-in appears in an audit record | Does the deputy take authority? Do participants distinguish an observation from proof of compromise? |
| 25–35 minutes | The normal meeting channel depends on the same identity service; staff cannot all access it | Which approved alternative is available, who can join it, and how is the current situation shared? |
| 35–45 minutes | The supplier proposes restricting the affected account; a booking workflow may be interrupted; a customer asks whether their records are safe | Who approves the restriction, what is the operational fallback, and what can communications truthfully say? |
| 45–60 minutes | Assume the approved restriction is in place; the cause and extent are still being investigated | Agree recovery criteria, capture lessons and assign improvement owners |
The times are facilitation targets for this example, not response-time requirements for real incidents.
Facilitator notes
If the team immediately declares that all customer records were stolen, ask what evidence supports that conclusion. If it dismisses the issue because the service still works, ask whether confidentiality and account access have been assessed separately from availability.
When participants suggest a technical action, ask who can authorise it and what effect they expect. Do not turn the session into a competition to name the most tools. Record an unresolved specialist question and continue the decision sequence.
If someone says “we would restore from backup”, ask which service is being restored, what makes the restore trustworthy and who confirms the business process works. A verbal answer does not demonstrate a working recovery capability. It may identify a separate test to schedule.
Keep the exercise psychologically safe: challenge assumptions and gaps in the system, not individuals' confidence or performance. Let participants explain constraints that the written plan missed.
Record evidence of the discussion
| Observation | What it establishes | Follow-up |
|---|---|---|
| Participants locate the deputy's authority in the plan | The written delegation can be found in this setting | Confirm the deputy has agreed and can exercise it |
| The alternate channel is named but nobody knows its access method | A practical communication gap remains | Assign the owner to arrange and verify access |
| The team drafts a cautious customer holding statement | It can distinguish confirmed facts from uncertainty during the discussion | Have the appropriate owner review the approval process |
| Recovery is approved without checking the affected workflow | The acceptance criteria need improvement | Add a business validation step and test it separately |
Avoid giving the organisation a pass certificate based on discussion alone. Record the scenario, participants, limitations and what was actually demonstrated.
Debrief and follow through
Ask what helped, where decisions stalled, what information was missing and which change would improve the next response. Turn each useful observation into an action with an owner, target and evidence of completion. Schedule a focused follow-up exercise for the most important change.
The NCSC's Exercise in a Box is another source of free exercise material. The scenario on this page is independently written. Use the post-incident review guide to manage the actions after either an exercise or a real event.
Sources and further reading
- NCSC: Effective steps to cyber exercise creation — checked 2 November 2026
- NCSC: Exercise in a Box — checked 2 November 2026