Response Rehearsal

Before the room opens

Write one decision-centered objective, not a broad topic. "Practice business email compromise" is a subject. "Decide when Finance pauses a payment, who validates the request out of band, and when leadership receives a verified update" is an exercise objective. Select one interactive rehearsal that supports the objective and read all of its injects, facilitator notes, and consequences before the meeting.

• Set boundaries: identify systems, details, and real events that must stay outside the discussion.
• Choose the decision authorities: invite roles that can explain or exercise the actual handoffs being tested.
• Prepare the record: give the scribe fields for facts, assumptions, decisions, owners, deadlines, and revisit triggers.
• Define success: name two or three observable behaviors, such as assigning an incident lead within five minutes or separating a verified fact from an assumption before notifying leadership.

Assign four room functions

Titles vary by organization, but the functions should be explicit. One person may cover more than one function in a small team. The facilitator should not also be the primary decision-maker; that makes it too easy to steer participants toward a preferred answer.

• Facilitator: reads injects, protects the objective and clock, asks neutral follow-ups, and decides when the group has made a sufficiently clear decision to continue.
• Participants: speak from their assigned operational roles, identify authorities and constraints, make decisions, and state what evidence could change those decisions.
• Observer: watches handoffs, authority, evidence use, communication discipline, and business tradeoffs. The observer records behavior without interrupting or scoring personalities.
• Scribe: creates the decision record in real time. The scribe asks for clarification when an owner, deadline, fact, or assumption is missing.

Name one exercise incident lead as part of the opening. That person coordinates the response discussion, but does not replace functional authorities. Legal, communications, operations, security, and executive roles still own decisions that belong to them.

Minute-by-minute 60-minute agenda

1. 0-5 minutes - Open and bound the exercise. State the objective, roles, stop condition, privacy boundary, and rule that assumptions must be spoken aloud. Confirm the incident lead and scribe.
2. 5-10 minutes - Establish the starting picture. Read the scenario summary. Ask the incident lead to separate known facts, working assumptions, and immediate unknowns. Capture the first update time.
3. 10-20 minutes - Inject 1: recognition and authority. Force a decision about declaration, ownership, evidence preservation, or an immediate business hold. Record who can authorize it.
4. 20-30 minutes - Inject 2: scope and containment. Add evidence that changes the suspected scope. Ask for a proportionate action, its operational cost, and the fact that would reverse it.
5. 30-40 minutes - Inject 3: coordination and communication. Introduce a leadership, employee, customer, vendor, or legal question. Require an audience, owner, approved facts, and next-update time.
6. 40-48 minutes - Inject 4: recovery or escalation pressure. Add a deadline, unavailable dependency, or conflicting business priority. Ask what can safely resume, what remains blocked, and who accepts residual risk.
7. 48-55 minutes - Reconstruct the decision trail. Stop scenario play. Have the scribe read back key decisions, evidence, assumptions, and open risks. Correct the record before discussing improvements.
8. 55-60 minutes - Score the AAR and assign actions. Use the rubric below. Select no more than three high-value improvements, each with one owner, target date, and verification method.

Announce the remaining time at minutes 20, 40, and 48. If discussion runs long, shorten fact-finding rather than consuming the AAR. A tabletop without an owned closeout is a conversation, not a completed rehearsal.

Use a repeatable inject pacing loop

Give each major inject roughly ten minutes. The facilitator can use a 1-2-4-2-1 rhythm: one minute to read, two minutes for clarifying questions, four minutes to decide, two minutes to capture the decision, and one minute to state the changed conditions before moving on.

1. Read: deliver only the information in the inject. Do not add an explanation that points toward a preferred choice.
2. Clarify: answer facts the scenario provides. When the answer is intentionally unavailable, say so and ask what the team will do under that uncertainty.
3. Decide: ask, "What are you doing now, who owns it, and by when?" If several actions are proposed, ask the incident lead to sequence them.
4. Capture: have the scribe read the decision back with its evidence, assumption, tradeoff, and revisit trigger.
5. Advance: reveal the consequence or next inject. Do not relitigate the previous choice unless new evidence justifies changing it.

Use one neutral rescue prompt when the room stalls: "What must happen before the next update?", "Who has authority to accept that risk?", or "Which fact would change this decision?" If the group still cannot decide, record the unclear authority as an observation and continue. The gap is useful exercise evidence.

Capture evidence without collecting sensitive data

The exercise record should explain why a reasonable team made a decision at that moment. It should not become a transcript or a repository for real incident artifacts. For every significant choice, capture:

• Exercise time and inject: where the decision occurred in the scenario.
• Known facts: statements provided by the inject or confirmed within the fictional scenario.
• Assumptions: conditions the team treated as true because evidence was not available.
• Decision and owner: the action, hold, escalation, or communication and the accountable role.
• Evidence requested: the generic artifact or confirmation needed next, such as sign-in history, payment approval records, endpoint status, or vendor confirmation.
• Tradeoff and revisit trigger: the cost accepted now and the event or deadline that requires the decision to be reviewed.
• Communication commitment: audience, message owner, verified facts allowed in the update, and next-update time.

Observers should also note the source of claimed authority. "The incident lead can pause access under the response plan" is stronger evidence than "Security usually handles that." Record the missing plan, contact, approval path, or tool as a gap without turning the exercise into a document hunt.

Observe decision quality, not whether the room guessed the facilitator's answer

More than one response may be defensible. Judge the process by what participants could reasonably know at the time and whether they made the tradeoff explicit. Useful observer notes answer these questions:

• Timeliness: did the team make a bounded decision before uncertainty became an excuse for inaction?
• Authority: was an accountable role named, and did participants know who could approve exceptions or accept risk?
• Evidence discipline: did the team distinguish facts from assumptions and request evidence that could change the decision?
• Proportionality: did containment match the suspected impact while considering evidence preservation and business continuity?
• Communication discipline: did updates identify an audience, owner, verified facts, uncertainty, and next-update time?
• Adaptability: did the team revise its approach when new information changed the risk picture?

Write observations as behavior plus effect. "No one named the payment-hold authority, so Finance waited six exercise minutes" is actionable. "The team communicated poorly" is not.

Worked example: suspicious payment change becomes BEC

Objective: decide when to pause a payment, how to verify the request outside the suspected email channel, who owns identity and financial evidence, and when leadership receives an update. Roles are facilitator, incident lead, Finance participant, identity or security participant, communications or executive participant, observer, and scribe.

1. Inject 1, minute 10: Accounts Payable receives an urgent bank-change request in an existing executive email thread. The team pauses the change, names Finance as the hold owner, and requests out-of-band confirmation plus message-header and sign-in evidence. The assumption is that the email account may be compromised; the revisit trigger is verified voice contact through a known number.
2. Inject 2, minute 20: Sign-in history shows a new location and an unfamiliar inbox rule, but session activity is still being reviewed. The incident lead declares a suspected account compromise, Identity revokes active sessions and preserves relevant logs, and Finance checks for related payment requests. The team accepts short-term executive email disruption to reduce fraud risk.
3. Inject 3, minute 30: A supplier asks why payment has not arrived while an executive asks whether normal email can be used. The team assigns Finance to contact the supplier through a known channel, gives leadership a cause-neutral update, and moves sensitive coordination to an approved alternate channel. The next update is due in 15 minutes.
4. Inject 4, minute 40: Evidence suggests a second mailbox may have forwarded invoice data. The team expands the evidence request without claiming confirmed data theft, identifies who will assess notification obligations, keeps payment changes blocked, and defines the evidence required before normal processing resumes.

A strong decision record for Inject 2 would read: "At exercise minute 23, the incident lead declared a suspected executive-account compromise based on a new-location sign-in and unauthorized inbox rule. Identity owns session revocation and log preservation by minute 28. The team accepts temporary email disruption. Reassess scope when sign-in and forwarding-rule review is complete." That note preserves the reasoning without storing real account names, addresses, or log data.

Run this example in the Interactive BEC Rehearsal. The generated AAR summarizes selected choices; add the room's evidence, assumptions, owners, and timing to explain how those decisions were reached.

After-action rubric

Score the rehearsal process, not individual performance. Use four behavior anchors for each dimension: 0 - not observed, 1 - improvised, 2 - defined but inconsistent, and 3 - clear and repeatable. Record one sentence of evidence beside each score.

• Leadership and ownership: 0 means no lead or owner emerged; 1 means ownership was assumed; 2 means roles were named after prompting; 3 means the lead, functional owners, and risk authorities were clear at each handoff.
• Facts, assumptions, and evidence: 0 means claims were not separated; 1 means evidence requests were vague; 2 means the team named facts and useful evidence with prompting; 3 means decisions consistently included evidence and a trigger for reassessment.
• Containment and continuity: 0 means no bounded action was chosen; 1 means action ignored evidence or business impact; 2 means tradeoffs were discussed; 3 means proportionate, reversible actions included preservation, continuity, and recovery conditions.
• Coordination and communication: 0 means handoffs or audiences were absent; 1 means updates had no owner or timing; 2 means most updates had an audience and owner; 3 means internal and external updates consistently used verified facts, uncertainty, owner, and next-update time.
• Adaptation under pressure: 0 means the team remained stuck or ignored new facts; 1 means it changed direction without explaining why; 2 means it revised some decisions; 3 means it explicitly connected each material change to new evidence or risk.
• Improvement ownership: 0 means no follow-up was captured; 1 means actions were vague; 2 means actions had owners but weak verification; 3 means each priority action had one owner, date, expected evidence, and scheduled review.

A total score can help compare repeated runs of the same exercise, but it is not a compliance result or a maturity certification. The useful output is the evidence behind low or inconsistent dimensions and the small set of improvements the organization will verify.

Close with three kinds of output

1. Decision record: what the team decided, based on which facts and assumptions, with what owner and revisit trigger.
2. Observations: specific behaviors that helped or slowed response, without assigning blame.
3. Improvement actions: no more than three priority changes with accountable owners, target dates, and evidence that will demonstrate completion.

Save or copy the Interactive Rehearsal AAR only after the room verifies that it reflects the discussion. The site runs in the browser and does not upload the exercise. Follow your organization's approved storage, retention, and handling rules for any notes you keep.