Response Rehearsal

An incident response drill is a structured practice session where a team responds to a plausible security condition and makes the decisions it would face during a real incident. The team rehearses whether to escalate, what evidence to protect, who owns the next action, and what it can communicate without overstating the facts.

A 15-minute decision drill narrows that practice to one early incident moment. It gives a facilitator enough time to present a condition, press for three decisions, and record one improvement. Use it as a readiness check between larger exercises, not as proof that the complete incident response plan works.

Run the 15-minute Interactive Rehearsal

How a 15-minute drill differs from a tabletop

• 15-minute decision drill: One condition, three early decisions, a small group, and one owned follow-up. It tests whether people can move from an uncertain alert to a defensible next action.
• Full tabletop exercise: Multiple injects across detection, response, communications, continuity, and recovery. It brings more roles into the room and produces a broader after-action record.

Choose the short format when the question is specific, such as "Who can disable an account after hours?" Choose a full tabletop when you need to examine handoffs across teams, vendors, executives, and later recovery decisions.

When to use this format

Use this drill when the goal is rhythm, not completeness. It fits a weekly security meeting, a new-team onboarding session, a post-policy-change check, or a quick practice run before a longer exercise. Keep the scenario defensive, generic, and narrow enough that participants can make useful decisions without needing sensitive system details.

15-minute drill card

If someone asks for incident response drills and not a full exercise, start with this compact card. Read it as written, keep the timer visible, and stop when the team has one clear follow-up.

• Scenario: "A credible alert suggests one account, system, vendor, or business process may be affected."
• Team objective: Decide whether to escalate, what evidence to preserve, who owns the next action, and what can be said safely.
• Facilitator rule: Do not solve the incident for the group. Ask for the decision, owner, assumption, and next fact.
• Output: One owner, one unanswered question, and one improvement to the response process.

Actionable 15-minute facilitator sequence

1. 0-1 minute - set the contract: Name the facilitator and scribe, state the time box, and say that participants should answer from current practice. The output is a decision record, not a perfect technical solution.
2. 1-3 minutes - present the condition: Give one alert, one affected account or service, one business pressure, and one important unknown. Ask the scribe to separate confirmed facts from assumptions.
3. 3-7 minutes - decide whether to escalate: Ask whether the condition is an incident, a suspicious event that needs more evidence, or a false positive candidate. Record who has declaration authority and what fact would change the answer.
4. 7-11 minutes - choose the next safe action: Ask what the team will do in the next 30 minutes. Require an owner, evidence source, and boundary that prevents a containment action from creating avoidable business or evidence loss.
5. 11-13 minutes - communicate: Decide who needs an update now, who approves it, and which statements remain explicitly unconfirmed. Do not turn a reasonable suspicion into a claim of compromise.
6. 13-15 minutes - close: Read back the decision, owner, assumption, open question, and follow-up. Assign one improvement with a due date or review point, then stop the exercise.

Three decision points

• Declare or monitor: Is this an incident, a suspicious event, or an alert that needs more facts before escalation?
• Contain or preserve: What action reduces immediate risk without destroying evidence, breaking business operations, or hiding the real scope?
• Notify or wait: Who needs to know now, what can be said safely, and what must wait until the team has verified facts?

Facilitator script

Use a plain script so the drill stays practical and does not drift into a lecture.

1. Open: "We have 15 minutes. Treat this as an early response decision, not a full investigation."
2. Prompt: "What do we know, what are we assuming, and what fact would change our decision?"
3. Decision: "Who owns the next action, and what should they do in the next 30 minutes?"
4. Communication: "Who needs a status update now, and what wording avoids overclaiming?"
5. Close: "What one thing should we fix before this happens for real?"

Example starting prompts

• Credential phishing: A user reports approving an unexpected MFA prompt after clicking a payroll-themed link.
• Ransomware concern: A shared folder shows renamed files and several users report access errors.
• Vendor outage: A critical SaaS vendor dashboard is unavailable and support has not posted a clear incident notice.
• Business email compromise: Finance receives an urgent payment-change request that appears to come from a senior leader.

Worked decision record: unexpected MFA approval

At minute one, the facilitator says: "A payroll employee reports approving an unexpected MFA prompt shortly after opening a payroll-themed link. The identity console shows a successful sign-in from an unfamiliar network. It is not yet known whether the sign-in belongs to the employee, a mobile carrier, or another party. Payroll processing begins in 40 minutes."

• Confirmed facts: The user approved an unexpected prompt; a successful sign-in is logged; the network is unfamiliar; payroll has a near-term business deadline.
• Assumptions: The sign-in may be unauthorized and the account may be at risk. Neither statement is recorded as confirmed compromise.
• Decision: Treat the event as a suspected account compromise, revoke active sessions, require credential reset and fresh MFA registration, and preserve the identity and mailbox audit records before making broader claims.
• Owner and authority: The on-call identity administrator performs the action under the documented incident lead's authority. If that authority is unclear, the gap becomes the follow-up rather than being silently invented during the drill.
• Communication: Tell the payroll lead that access is temporarily restricted while the team validates an identity event. Do not say that payroll data was stolen or that an attacker accessed the account without evidence.
• Revisit trigger: Reassess scope if audit logs show mailbox-rule creation, payroll-record access, additional unfamiliar sessions, or similar reports from other users.
• Improvement: The incident lead owns a seven-day review of after-hours account-disablement authority and the identity-log preservation checklist.

This record is intentionally small. It shows the reasoning behind the action, preserves uncertainty, and leaves the next person enough context to continue. A list that says only "reset password" would hide the authority, evidence, communication, and follow-up questions the drill is meant to expose.

Common mistakes

• Trying to solve the whole incident: The drill is about the first decisions, not complete recovery.
• Letting one person lecture: Ask each role what decision they own or what fact they need.
• Skipping assumptions: Many bad incident decisions come from unstated assumptions that no one validates.
• Ending without an owner: One assigned improvement is better than ten vague observations.

After-action notes

Capture five things only: the decision made, the owner, the strongest assumption, the unanswered question, and one follow-up action. This keeps the drill fast while still creating evidence that the team is practicing real response judgment.

Useful follow-ups sound like: "Confirm who can approve account disablement after hours," "Add vendor status-page checks to the outage checklist," or "Create a one-paragraph holding statement for suspected payment fraud."

Move from drill to interactive rehearsal

A short drill is best for one decision moment. When the team is ready to work through injects, consequences, facilitator notes, and after-action capture, open the focused Interactive Rehearsal workspace instead of adding more agenda items to the 15-minute format.

For a practical next step, open the 15-minute business email compromise decision rehearsal. The direct link sets the incident family, focused scenario, standard difficulty, and 15-minute timer while keeping the group in the distraction-reduced decision workspace.

When the team needs a complete one-hour room plan, continue with the 60-minute facilitator field guide for role assignments, inject pacing, evidence capture, and an AAR rubric.

Method and primary sources

Response Rehearsal grew from the creator's need to prepare an incident response exercise for a small software organization where a sole cyber practitioner may need a credible, meeting-ready structure without a large exercise staff. That practical constraint shapes this guide: short prompts, explicit authority questions, fact-versus-assumption discipline, and an owned after-action item. The guide is an independent educational aid; it is not produced, approved, or certified by CISA or NIST, and it does not establish compliance.

• CISA Tabletop Exercise Packages provide tools, scenarios, question sets, and guidance for discussion-based exercises. They are a useful primary reference when expanding this short drill into a full tabletop.
• NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities covers designing, conducting, and evaluating exercise events. It informs the separation between a bounded decision drill and a fuller exercise program.
• NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management frames incident response as part of broader cybersecurity risk management and supports practicing preparation, response, recovery, and improvement.

Apply your organization's own incident response plan, legal obligations, contracts, escalation roster, and technical procedures. Sanitize exercise details before entering them into any browser tool or shared notes.

FAQ

What is an incident response drill?

It is a short practice session for one response decision, handoff, or communication moment. It should be narrow enough that the group can make a decision and name a follow-up in minutes.

Can a 15-minute drill replace a tabletop?

No. It complements a tabletop by keeping incident decision practice fresh between larger exercises.

How many people should attend?

Keep it small enough for decisions to move. A facilitator, scribe, technical owner, business owner, and communications or leadership representative is often enough.

Should we use real incident details?

Use plausible, sanitized details. Do not put secrets, regulated data, confidential incident history, or sensitive architecture details into the drill notes.