Back to the speaker directory · Use this resource to clarify a session brief. Confirm facilitation scope directly.
A small tabletop can expose a meaningful gap if the objective is specific and the discussion ends with accountable work.
Prepare before the room meets
Choose one objective, such as identifying who can suspend an AI connector without disrupting critical work. Invite the people who own the affected service, security response, business process and communications. Include legal or privacy expertise where the scenario requires it. Name a facilitator and a separate note-taker.
State that this is a discussion-only exercise. Do not disable production services, contact real customers or send simulated incident notices outside the room. Use fictional names and synthetic records. Agree how to pause if an actual incident arises.
A suggested 60-minute agenda
| Time | Activity | Evidence to capture |
|---|---|---|
| 0–10 minutes | Objective, roles and ground rules | Named decision authority |
| 10–25 minutes | Initial scenario and first decisions | Known facts versus assumptions |
| 25–40 minutes | New evidence and changed impact | Escalation and containment rationale |
| 40–50 minutes | Recovery discussion | Validation required before restoration |
| 50–60 minutes | Debrief and next actions | Owner, due date and verification method |
Ask for a decision, not a perfect answer
When someone says “we would investigate,” ask who initiates it, which evidence is available and what would change the next decision. Distinguish actions already authorized by a plan from proposals that require approval. A facilitator should surface uncertainty without punishing participants for acknowledging it.
Close the loop
Choose a small set of corrective actions. Each should name an owner, due date and observable completion test. “Improve communication” is vague; “verify the after-hours escalation path with the service owner” is testable. Rehearse the corrected handoff later rather than marking the gap closed because a document was edited.
Use the hypothetical AI assistant scenario and record agreed decisions in your approved event notes.
Source grounding
NIST SP 800-61 Revision 3, published April 2025, integrates incident response with cybersecurity risk management. These exercises and templates are original editorial aids, not official NIST exercises, certification or assurance of readiness.