The decision in context.
In a fictional 90-minute tabletop, participants recognized the simulated role-loss incident but did not immediately identify who could authorize platform reporting. The group produced a usable situation summary, while the evidence-transfer route and deputy coverage remained unclear. Scores reflect observed exercise behaviors, not certification or real-incident performance.
Decision requested
Appoint reporting authority and deputies, approve a secure evidence route, and repeat the two incomplete decisions in a shorter follow-up exercise.
What was reviewed.
Facilitated tabletop for six role representatives using a social-account takeover scenario. Evaluate escalation, authorization, evidence handling, communications and recovery readiness. No live phishing, access changes or customer messages.
Outside this assessment
Employee performance ranking, certification, technical penetration testing, production response-time commitments and conclusions about behavior outside the exercise.
| Asset / record | Owner | Coverage |
|---|---|---|
| AS-01 / Exercise group | Sponsor | Six role representatives; no personal scores |
| AS-02 / Playbook | Operations lead | Draft escalation and reporting process |
| AS-03 / Scenario injects | Facilitator | Three fictional developments over 90 minutes |
Method and confidence
Define authority and scope; register supplied material; separate direct observations from statements; assess alternative explanations; review limitations; and assign actions with acceptance evidence.
High confidence: cited material directly supports the narrow observation. Moderate: support exists but an important gap remains. Low: a lead or statement needs corroboration. Confidence does not establish identity, intent or legal liability.
Priority reflects potential impact and dependencies, not a CVSS score. High-priority items need prompt attention; medium-priority items need a near-term owner; low-priority items follow the agreed review cycle. All timestamps are UTC.
Findings, with their limits.
Reporting authority is ambiguous
- Observation
- At minute 25, marketing and IT each assumed the other could approve a platform report. The playbook did not resolve the question.
- Why it matters
- An actual incident could be delayed or produce conflicting submissions.
- Alternative / uncertainty
- Existing informal practice may work for experienced staff but was not evident to the exercise group.
- Recommended action
- Name one accountable role, a deputy and a written approval record for reporting.
- Evidence references
- E-01, E-02
Evidence transfer route is not operationally clear
- Observation
- Two participants proposed sending captures through ordinary email. No approved secure upload destination could be identified during the exercise.
- Why it matters
- Sensitive material could be dispersed across channels without controlled access or retention.
- Alternative / uncertainty
- A secure tool may already exist but lack a clear owner or onboarding instructions.
- Recommended action
- Select the authorized channel and rehearse access using harmless sample files.
- Evidence references
- E-01, E-03
Situation summaries separate facts from unknowns
- Observation
- The final group summary explicitly separated role loss from unconfirmed attacker identity and did not promise restoration.
- Why it matters
- This behavior supports clearer decisions and reduces misleading communications.
- Alternative / uncertainty
- Performance under a scripted scenario may not generalize to an unplanned event.
- Recommended action
- Retain the summary structure in the playbook and include it in the follow-up exercise.
- Evidence references
- E-03
Evidence & chronology.
| ID | Source | Received (UTC) | Limitation |
|---|---|---|---|
| E-01 | Fictional facilitator observation log | 2026-10-05 10:30 UTC | Observations, not a recording or individual appraisal |
| E-02 | Fictional draft escalation playbook | 2026-10-04 12:00 UTC | Version used in exercise only |
| E-03 | Fictional group outputs and debrief | 2026-10-05 11:00 UTC | Self-reported confidence is not measured competence |
| Event time (UTC) | Event | Source |
|---|---|---|
| 05 Oct / 09:00 | Role-loss scenario introduced | E-01 |
| 05 Oct / 09:25 | Reporting authority decision stalled | E-01 |
| 05 Oct / 10:30 | Exercise ended; improvements agreed in debrief | E-03 |
Handling and provenance
These are invented descriptions, not evidence attachments. A live engagement records authority, collector, source, collection and receipt times, method and limitations. Originals stay in approved storage; access, transformations and transfers are logged. Digests, where appropriate, are calculated on actual files.
A screenshot supports what was visible in that copy. It does not establish origin, completeness, authorship or the full history of an event. Client-reported events remain distinct from independently verified observations.
Owners, actions & acceptance.
| When | Owner | Completion evidence | State |
|---|---|---|---|
| Within 7 days | Executive sponsor | Approve reporting owner and deputy | Open |
| Within 14 days | IT + privacy lead | Demonstrate approved evidence transfer with test data | Open |
| Within 21 days | Operations lead | Issue playbook revision and record acknowledgement | Planned |
| Within 30 days | Facilitator | Retest incomplete decisions with changed scenario | Planned |
| Capability | Score / 2 | Observed basis |
|---|---|---|
| Escalation | 2 | Correct internal lead identified |
| Authorization | 0 | No decision owner established |
| Evidence handling | 1 | Need recognized; route not demonstrated |
| Communications | 2 | Facts and uncertainty separated |
| Deputy coverage | 0 | Absent role had no agreed alternate |
0 = not demonstrated; 1 = partial; 2 = demonstrated in this exercise. The 5/10 total is a local exercise result, not an industry benchmark.
Closing an action
Record the actual completion time, responsible person and evidence reference. A recommendation, request or submission is not completion. Keep dependencies visible and agree the next review date.
Limitations & handover.
A single facilitated session cannot prove operational readiness. Follow-up closure requires observable evidence, not attendance alone.
Release checklist for a live engagement
- Approved instruction, scope and authorized assets.
- Named preparer and reviewer, review date and corrections.
- Client decision owner, accepted actions and unresolved objections.
- Approved recipients, secure transfer receipt and acceptance date.
- Next review, retention basis and disposal responsibility.
These fields remain unsigned in this example. No actual approval, instruction or evidence transfer is represented. A live report needs an agreed distribution and retention plan. Real evidence and personal data must not be published in website assets.
Method references
Background guidance only. These publications do not validate fictional findings or certify the report. Apply current platform procedures and engagement-specific legal advice separately.