Release-aware tabletop and scored handoff

Week 4, day 1. Work through the teaching and the worked checkpoint before attempting the assigned exercise(s). Compare your artifact with the final worked result only afterward.

4.1 Exercise purpose and boundaries

This is a tabletop simulation, not an instruction to touch a real account. It uses the fictional Harbor Library records in Chapters 1–3. Learners may write notes, compare options and role-play approvals. They may not contact a real library or use a production system. A solo learner can fill every role; a group should assign an incident lead, analyst, service owner, recovery lead and communications contact. Each role must identify what it can decide and what needs another owner's approval.

NIST SP 800-84 describes designing, conducting and evaluating IT plan exercises. This course uses that general idea to evaluate reasoning and coordination. The exercise does not test actual organizational readiness, because the people, data, systems and consequences are invented.

Inputs: R1–R24, the service map, a case-note template from Module 1, the decision/collection fields from Chapters 2–3, and the Module 3 P1/C1 and V1 cards when the facilitator releases them. Timebox: four rounds of ten to fifteen minutes, then a twenty-minute review. Outputs: one case timeline, one hypothesis table, one approved-action record, one recovery test plan, one internal status message and one improvement ticket. Each output may fit on one page; completeness and reasoning matter more than length.

4.2 Release the injects in order

Lesson table; scroll horizontally to read all columns →

The facilitator should not reveal later records early. In a solo session, cover the later rows until each round is complete. If a learner chooses a different defensible action than the worked example, continue with the corresponding branch and state the assumptions rather than forcing the reference answer.

Branch S: session revocation. At 09:45 UTC, the identity administrator reports that the current desk-a session was revoked under the fictional incident lead's approval. A narrow booking query shows no later edits in its queried range. The staff member must sign in again. B19 still shows an incorrect room until an owner-approved correction is made. This branch does not establish who used the prior session or that another access path is absent.

Branch P: staff-write pause. At 09:45 UTC, the service owner reports that staff writes were paused for fifteen minutes under the fictional approval. The manual queue has two pending booking requests. The booking audit shows no writes in the pause interval, but the cause of B19 and B20 remains unresolved. This branch does not prove the account is safe when writes resume.

For either branch, R23 still says the last documented restore test was thirty days earlier. After discussing the branch result, reveal P1/C1 and then V1 as later exercise cards. P1/C1 shows two booking mismatches that require owner-reviewed correction; V1's isolated-copy test supports the two tested access claims but fails actor attribution in the test audit. Neither card proves that production corrections ran. The recovery lead should propose an isolated check of the booking state and a narrow audit check before declaring normal service. The privacy contact should review any new evidence of personal-data access; R24 alone is not clearance.

4.3 Worked tabletop: one acceptable path

Round A. The learner opens HL-IR-001, notes that R1 precedes booking edits, names the service owner as pending, records compromise as a hypothesis and asks whether the edits were training work. Round B. R9–R16 add an unexplained B19 edit and a time-sensitive source-preservation risk; R15 states a 24-hour duration without its deletion-clock anchor, so an exact deadline is unknown. In this worked path the analyst proposes a bounded preservation request for the application custodian. A separately recorded classroom approval may authorize the request, but neither approval nor request establishes that a source hold or collection occurred. Set a 09:35 review to check receipt and expiry semantics. Round C. R17–R18 add an unplanned B20 edit. The analyst proposes narrow session revocation; the lead and identity owner are the required approvers and may record a separate classroom role-play decision, not a supplied R-series approval. Without that decision receipt, approval is pending. The service owner stands by for a separate short write-pause decision if edits continue. Round D. Branch S reports the revocation and no later edits in a limited query. P1/C1 then reveals that B19 and B20 are still inconsistent with the approved target. V1's isolated-copy trial has a blank audit actor field. The learner requests owner-approved correction, a bounded restore test and audit remediation, keeps the cause unresolved, and proposes restricted or explicitly approved limited operation with monitoring rather than closing the case.

This is one acceptable path. A team that prefers Branch P can pass if it explains the service cost, establishes approval, plans for the two queued requests and states how it will decide when writes may resume. In either path the later P1/C1 and V1 cards prevent an unsupported “fully recovered” conclusion. The exercise assesses decision quality under incomplete information, not agreement with a preselected action.

4.4 Run a reproducible handoff drill

The facilitator or solo learner should keep a release ledger with three columns: time the fictional event occurred, time the learner received the card and the round in which the card became usable. For example, R9 describes an edit at 09:03 UTC but enters the learner's evidence set only in Round B; P1 describes an owner target at 09:40 and belongs to Round D, after the 09:37 containment proposal. This prevents a polished final answer from quietly using later evidence to justify an earlier decision. The ledger can be written in Markdown alongside the case note and should retain the original record IDs.

At each round, freeze a one-paragraph state snapshot before revealing the next card. It should contain (a) what is observed, (b) the current leading and alternative hypotheses, (c) a proposed action or reason to wait, (d) the owner whose approval is required, and (e) a time or event that will trigger review. A learner may revise a hypothesis as new records appear but should leave the earlier snapshot visible. Revisions show how the decision changed; replacing earlier text with hindsight hides a real response skill.

Receipt and release contract: Supplied R1–R24 records are immutable case cards, distinct from learner/facilitator role-play. At 09:37, they justify a proposal only: no incident-specific revocation approval, deployment or effect receipt has been supplied. A role-play decision such as C-approval-v1 must separately name the exact target, approving roles, time, scope, duration and observer; if it is not performed and recorded, approved = pending. Approval never authenticates execution. Branch S/P arrives only after the Round C snapshot and cannot repair a missing earlier receipt. A source-preservation request requires its own dispatch and custodian receipt; an effective source hold and a collected case copy each require further, independent evidence. Neither a positive acknowledgement nor a request creates a copy. Keep each status proposed / approved / executed / verified independently visible.

At Round D, write a claim ledger before an internal update. A sample for Branch S is:

Lesson table; scroll horizontally to read all columns →

This ledger separates supported, contradicted and untested claims. “No later edit appeared” is supported only for the branch's queried range. A missing actor field is an observed failed criterion, not simply an unknown. Those two states call for different follow-ups: broaden an authorized query for the former, repair and retest the audit for the latter.

The handoff must reach a person who was not in the tabletop. Give that person the case ID, last evidence snapshot, chosen branch, approvers, action actually reported by the branch card, checks that passed or failed, access location for the restricted synthetic artifacts, owner of each open item and the next checkpoint. The receiver should be able to answer, without guessing, whether staff writes are currently paused and who may change that status. If a real handoff omitted those two facts, it could cause both unnecessary outage and an unsafe restart.

Failure inject for review, not for the live round: suppose a team reports “all bookings correct” after seeing only the V1 access test. Ask which supplied card tests that sentence. V1 does not compare booking states; C1 contradicts the sentence for B19 and B20. A defensible revision is: “The isolated-copy access checks passed, while B19 and B20 remain pending owner-approved correction and the audit actor field failed its test.” This exercise in claim repair is as important as selecting the initial containment action.

4.5 Score the evidence and the handoff

Use this simple rubric for each of the six outputs: 0 = absent or unsupported; 1 = present but incomplete; 2 = specific, evidence-linked, authorized and clear about limits. Maximum score is 12. A passing classroom submission should score at least 9, with no zero for approval or evidence scope. This is an editorial practice rubric, not a credential or formal academic grade.

Lesson table; scroll horizontally to read all columns →

A learner should also note inaccessible evidence and why it was not collected. Do not award points for inventing device detail, a data breach, an attacker identity or a successful restore that the scenario never supplied.

Calibrate a score against the artifact that existed at the checkpoint

A rubric is useful only if two reviewers can apply it to the same submission, not to what they remember the learner saying later. NIST SP 800-84 describes exercise evaluation against criteria identified before the event. The six-output rubric above and the worked comparison below are original classroom choices. They evaluate a learner's records, not Harbor Library's real readiness.

Freeze each artifact at the end of its round. Give it a version ID such as A-intake-v1, B-hypotheses-v1 or C-action-v1, the release round and the source IDs actually available then. A later D-recovery-v2 may improve the final packet, but it does not rewrite C-action-v1. Store a one-line reason for every revision. This matters because the Branch S report of revocation arrives in Round D; it cannot make a Round C proposal into an action already performed at 09:37.

Consider this invented learner packet L2, prepared after all cards have been released. Its quoted excerpts are student answers in a separate classroom example, not new R-series observations. Two reviewers independently apply the 0–2 rubric before discussing their scores:

1. Six-row timeline — reviewers A/B: 2/2; reconciled: 2. The learner lists R1 08:40/A, R3 08:43/A, R5 08:48/A, R9 09:03/B (received at 09:20), R18 09:24/C and R21 09:29/C, all UTC, and writes: “This order does not identify the human operator.” Source IDs, event versus release times and a causal limit are explicit.
2. Round B hypotheses — reviewers A/B: 2/2; reconciled: 2. The learner writes: “R10 may support planned work; R9 leaves B19 unexplained. Misuse remains possible; R13 lacks device detail. Ask the identity owner for a bounded session association check.” Alternatives, limits and a discriminator are present without using R17.
3. C-action-v1 — reviewers A/B: 2/1; reconciled: 1. The learner writes: “Recommend revoking the current session; identity owner consulted; check again at 09:45.” This records a proposal and review, but “consulted” is not incident-lead approval. Staff cost, fallback and the test interval are missing. Branch S cannot repair this frozen Round C artifact.
4. D-recovery-v1 — reviewers A/B: 1/0; reconciled: 0. The learner writes: “V1 passed, so all bookings are correct and the audit identifies the editor.” C1 contradicts booking correctness for B19/B20, and V1's actor field is blank. The conclusion is unsupported, not merely incomplete.
5. Status — reviewers A/B: 2/2; reconciled: 2. The learner writes: “Branch S reports one session revoked at 09:45; B19/B20 and audit actor remain open. Service owner and audit owner review at 10:05; cause unknown.” The action, open criteria, owners and checkpoint are bounded.
6. Improvement — reviewers A/B: 1/1; reconciled: 1. The learner writes: “Fix the audit actor within 30 days.” A gap and proposed window exist, but no accountable owner, test artifact or interim observation is specified, so closure cannot be checked.

The reconciled sum is 8/12 (2 + 2 + 1 + 0 + 2 + 1). It is below the classroom threshold of 9 and has a zero in recovery evidence, so packet L2 does not pass. Reviewers should record their disagreement rather than average 2 and 1 into 1.5: the rubric permits only 0, 1 or 2. Reviewer A can show a source pointer that satisfies a missing field, or accept Reviewer B's score. Here no such pointer exists. A high total would not excuse an unsupported recovery claim, and a corrected final sentence would not retroactively justify the earlier Round C action.

Reconciled calibration ledger (original frozen submissions):

Lesson table; scroll horizontally to read all columns →

Two different evidence horizons: L2's status was written after all D cards and is not the same assignment as EX048, whose two-sentence 09:45 update must be frozen after Branch S or P but before P1/C1 and V1. A correct post-all-cards sentence that names V1's missing actor would contaminate EX048. Reject early use of R17 in B or P1 in C even if the later statement proves accurate; repair the subsequent version while retaining the earlier score. An improvement from D-recovery-v1 to D-recovery-v2 earns a new assessment only; it does not rewrite the first 0. A score of 2 in one artifact does not cancel another critical zero.

How to revise L2. In C-action-v2, keep the 09:37 proposal as a proposal; request the incident lead's approval, add the staff reauthentication cost, a fallback if a verified edit continues and a named 09:45 query with source and interval. If a separate fictional approval is later supplied, record when it arrived. In D-recovery-v2, list the P1/C1 comparison as two matches and two mismatches, and mark V1's tested access behavior separately from its failed actor-attribution criterion. Ask the service owner to authorize a correction and the audit owner to fix and retest the field; both remain planned until a result is supplied. In the improvement ticket, name the audit owner, an accepted due date, the interim restricted comparison and a controlled edit whose actor and UTC time a second reviewer can verify. The revised packet can earn a new score when its fields are actually present. It still cannot prove live-system containment or recovery.

Practice check: score the six L2 excerpts yourself before reading the reconciled column. For each disagreement, point to the missing or contradicting record and decide whether the correct label is absent/unsupported, incomplete or evidence-linked and bounded. Then write three one-sentence revision requests for the action, recovery and improvement artifacts. The worked comparison above supplies the target scores and the paragraph above supplies acceptable revisions; EX050 asks you to perform the same calibration on your own final handoff. No production system or real personal record is needed.

Worked checkpoint

At an early exercise checkpoint, score only the cards actually released and the learner artifact frozen at that time. A later worked solution may teach a better answer; it cannot retroactively improve the earlier artifact score.

Practice — Lesson 16

EX039 — Role and scope card

Objective: assign authority before observing the case outcome. Inputs: Round A, Module 1's role table and synthetic R1–R8. Output: a five-row role card for incident lead, analyst, service owner, recovery lead and communications contact; name each responsibility, one approval or escalation boundary and one verifiable output. Add a single sentence defining permitted objects, actions and exclusions. A score of 2 makes clear that neither a learner nor analyst can independently disrupt a real booking service.

DEL4 extension: In the same five-row card, add the role responsible for receiving and acknowledging each critical update. For one role, give the message ID/version and an expected read-back question. Keep an unknown alternate unknown; do not invent a working channel.

Worked answer: EX039 in the final appendix.

EX040 — Intake artifact

Objective: produce a reproducible first handoff without hindsight. Inputs: Round A only, R1–R8 and the 09:00 case-open time. Output: exactly four labeled lines covering case/time/service, at least two observed source events, current status and unknowns, and the owner question plus proposed 09:05 checkpoint. Cite record IDs and mark R5 as a patron report. A score of 2 does not cite R9, R17 or a later branch result and does not treat proposed preservation as already performed.

Worked answer: EX040 in the final appendix.

EX041 — Evidence chronology

Objective: separate source-event time from learner availability. Inputs: R1–R24 after Round C; no Round D card. Output: a six-row table with ID, UTC event time, source, release round and observation, using at least one item from each of Rounds A, B and C. Add one ordering fact and one causal or identity claim that the sequence cannot prove. A score of 2 retains that R9's 09:03 event reached the learner only in Round B, while R17–R18 could not guide the 09:20 decision.

Worked answer: EX041 in the final appendix.

EX042 — Competing explanations

Objective: maintain discriminating hypotheses at the 09:20 review. Inputs: R1–R16 only. Output: three rows for authorized training, unauthorized use of desk-a and display/state divergence, each with supporting record, contrary or limiting record, narrow authorized check and a result that would weaken it. Do not use R17–R18 or P1/C1; those arrive later. A score of 2 says B19 is unresolved rather than proving one explanation from the account label or a patron report.

Worked answer: EX042 in the final appendix.