Chapter 30 — Laboratory: multi-team incident simulation
Lesson map
Lesson 30 published. Map, example, EX088.
flowchart TD
N0["Learning outcomes and connection"]
N1["30.1 Exercise design"]
N2["30.2 Injects"]
N3["30.3 Observation"]
N4["30.4 After-action note"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX088"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["30.1 Exercise design"]
N2["30.2 Injects"]
N3["30.3 Observation"]
N4["30.4 After-action note"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX088"]
[Learning outcomes and connection]
|
v
[30.1 Exercise design]
|
v
[30.2 Injects]
|
v
[30.3 Observation]
|
v
[30.4 After-action note]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX088]
Learning outcomes and connection
You will be able to (1) design a supervised tabletop exercise with objectives and pre-announced evaluation criteria; (2) write injects that test escalation, communication and approval; (3) observe with a rubric; and (4) write an after-action note that compares observed decisions with the criteria. This laboratory exercises the coordination ideas of Chapter 21 and the operations of Chapter 29. NIST SP 800-84 (2006) describes tabletop and functional exercises; its structure remains useful, though details should be checked against current practice.
30.1 Exercise design
Start with objectives that can be observed: "the incident lead makes a containment decision within 20 minutes of the inject", "the first external statement contains no unverified claims". Set the scope (teams, systems, time), the rules (no real systems touched; facilitator controls information), and stop conditions (a real incident, participant distress, overrun). Pre-announce the evaluation criteria so that the exercise tests the process, not participants' ability to guess what the facilitator wants.
In Harbourline Night Shift, each objective names a time limit and an observable act.
30.2 Injects
An inject is a piece of scenario information delivered at a time: an alert, a phone call, a journalist's email. Design injects to force decisions at known friction points: an owner who refuses containment, a missing deputy, an ambiguous privacy question, a shift change.
In Harbourline Night Shift, the injects at T+15 and T+25 deliberately combine a refusal by the pharmacy owner with an unavailable incident lead, recreating the friction of the earlier pharmacy-server case. The reporter's email at T+40 tests whether communication waits for the privacy officer. Each inject is tied to an objective so the observers know what to watch for.
30.3 Observation
Observers record times, decisions, who decided, information used and communication paths, against the rubric. They do not intervene. Each observer covers one team or role.
In Harbourline Night Shift, two observers cover the teams: for O2 they record when escalation reached the decider and when the decision was made, giving the 31 minutes in the observations. They also capture what information was used, which is how the unsupported claim about patient data in the O3 update came to light. Observers should timestamp from one shared clock and record quotations exactly, because the after-action note depends on their notes rather than on participants' memory.
30.4 After-action note
The note compares criteria with observations, identifies strengths and gaps, and proposes corrective actions in the measurable form of Chapter 28. It is a process review, not a personal evaluation; reported individual errors should be framed as system findings unless policy requires otherwise.
For Harbourline Night Shift, the note would record O1 met at seven minutes, O2 partly met because no deputy was named, and O3 and O4 in conflict because the update claimed no patient data was affected before the privacy officer was consulted. The corrective actions name owners and a re-test in three months.
30.5 Worked example (synthetic): exercise plan
Fictional exercise "Harbourline Night Shift", 90 minutes, participants: SOC (2), IT operations (1), incident lead (1), communications (1), privacy officer (1), pharmacy service owner (1). Facilitator and two observers.
Objectives and criteria: - O1 Escalation: SOC escalates a suspected admin-account compromise to the incident lead within 10 minutes of inject 2. - O2 Decision: containment decision (with option comparison) within 20 minutes of escalation. - O3 Communication: internal status update to clinic managers within 30 minutes, containing facts, unknowns and next update time. - O4 Privacy: privacy officer consulted before any statement about patient data.
Injects: T+0 alert on admin sign-in from unknown address; T+8 a second alert showing an export of patient appointments; T+15 pharmacy owner refuses downtime; T+25 incident lead "becomes unavailable" (deputy test); T+40 a reporter's email asking about "a data breach"; T+60 shift change for SOC.
Observer rubric: for each objective, time achieved, met/partly/not met, evidence (notes, messages), comment.
Fictional observations: O1 met (7 min); O2 partly (decision at 31 min because the deputy was not named); O3 met but the update said "no patient data affected" without evidence — conflicts with O4; O4 not met (privacy officer not consulted before the update). Shift change: handoff lacked the list of pending decisions.
After-action corrective actions: name deputies per shift in the roster (owner: security manager, by next month); status-update template with "unknown" section and privacy check box (owner: communications lead); handoff checklist including pending decisions (owner: SOC lead). Re-test in three months with a different scenario covering the same objectives.
30.6 Common errors and limits
- Objectives that cannot be observed.
- Facilitators steering participants to the "right" answer.
- Exercises that only test technical steps, not decisions.
-
Results of one tabletop are anecdotes; repeated exercises with stable criteria show trends.
-
Debriefing only on what went wrong, so participants learn to fear exercises rather than use them.
- Running the same scenario repeatedly until participants memorise the injects instead of exercising judgement.
- Changing the objectives between exercises, which makes it impossible to see whether corrective actions worked.
- Letting observers score participants they manage or work with daily.
Exercises — chapter 30
Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.
EX088 — Write criteria. Steps: write two additional observable criteria for the exercise (one for evidence preservation, one for the reporter's email). Rubric: 3 = observable, timed, with evidence source; 2 = observable but untimed; 1 = vague; 0 = none.
EX089 — Design an inject. Steps: write an inject that tests whether the team distinguishes access from exfiltration. Rubric: 3 = specific inject (e.g., log showing records viewed but no export or outbound transfer evidence) and the expected good response; 2 = inject without expected response; 1 = generic; 0 = none.
EX090 — After-action entry. Steps: write the after-action entry for O3/O4 in the observer format with a corrective action. Rubric: 3 = facts, criteria comparison, system cause, measurable action; 2 = missing action; 1 = blame; 0 = none.
Chapter synthesis
Design exercises around observable, pre-announced criteria; use injects to force decisions at friction points; observe without steering; and convert gaps into measurable corrective actions that the next exercise re-tests.
Continue studying — chapter 30 of 40
← Chapter 29 · Course chapter index · Chapter 31 →
Continue to the next authored lesson.