NIST SP 800-61 REV. 3 · CSF 2.0

TableTop

Ten guided, fictional incident-response exercises. Choose a case, make each decision before opening the worked team response, and compare what, how and why.

NIST SP 800-61 Rev. 3 aligns incident response with CSF 2.0. Govern, Identify and Protect support preparation; Detect, Respond and Recover form the response cycle; Identify/Improvement captures lessons. The decisions below are an educational application of this framework.

Fictional training scenario; no real system or person is described.

01Hospital ransomwareA regional hospital loses access to appointment scheduling and a shared imaging folder; bedside systems remain functional but their dependency is unverified.
02Vendor invoice fraudA finance mailbox receives a plausible request to replace the bank account for a critical supplier hours before payment.
03Cloud credential exposureA deployment token appears in a public source commit and may authorize changes to a production cloud project.
04Compromised supplier updateA signed update from a software supplier reaches several endpoints before the supplier warns of a possible build compromise.
05Suspicious data exportA staff account exports a large customer dataset outside its normal schedule; the account owner says the task may be authorized.
06Public portal disruptionA public service portal slows sharply during a traffic surge; some legitimate users cannot complete submissions.
07Water-system controller anomalyA municipal water plant sees a chemical dosing setpoint change that differs from the operator's approved work order.
08Lost field laptopAn engineer reports a missing laptop used for site visits; asset records say encryption is enabled, but the latest check is old.
09Web application compromiseA customer portal begins returning unexpected database errors after an unreviewed change to a search endpoint.
10Domain routing hijackA nonprofit's public domain intermittently resolves to an unfamiliar address while donation pages remain reachable for some users.