Incident Response Tabletop Writeup
Part of the Cybersecurity Roadmap
In short
Teams that practise incidents on paper respond far better on the real day. Designing and writing up a tabletop shows you understand people, decisions and process, not just tools.
Design and document a full tabletop exercise scenario, including the discussion questions and expected response actions — showcasing Phase 8's incident response planning skills.
Think of it like this
The school fire drill
In a fire drill nobody is in danger, yet everyone learns: which stairs to use, who counts students, where to gather. The teacher times it and notes what went wrong. A tabletop exercise is a fire drill for a cyber incident, done around a table.
Watch it happen
One inject, four roles
Inject: files encrypted
1/69:05 am. Staff report a ransom note on the shared file server. What do you do first?
The big ideas
What you need to know
Injects drive the story
Release new facts every few minutes. Each one forces a decision, which is where gaps appear.
Bring non tech roles
Legal, comms, leadership and support make the hardest calls in real incidents. Include them.
A scribe captures gaps
Someone notes every "we do not know who decides that". Those become action items.
End with owners
Each gap gets an owner and a due date. A tabletop without follow up is just a chat.
Save yourself the pain
Common mistakes
Oops
Making the scenario so wild nobody takes it seriously.
Do this instead
Base it on common incidents like ransomware or a phished admin, tuned to the organisation.
Oops
Turning it into a test where people are graded and blamed.
Do this instead
Keep it a safe learning space. The goal is finding process gaps, not catching people out.
Your mission
First milestone: write the scenario
Quick check
What is the most important output of a tabletop exercise?
Go deeper
- 1Design a realistic incident scenario for a hypothetical organization.
- 2Write the full exercise script: injects (scenario updates), discussion questions, and expected actions.
- 3Include a post-exercise summary of gaps the exercise would likely reveal.
More projects at this stop
Home Lab Setup & Network Segmentation Project
CTF (Capture the Flag) Writeups
Vulnerability Assessment Report
Security Automation Script Project
SIEM Dashboard & Detection Rules Project
Portfolio Website or GitHub Showcase
Stuck on this topic? Ask an Insider
Get 1:1 guidance from people who've walked this exact path — on the InsideEdge app.
