plan-an-incident-exercise

name	plan-an-incident-exercise
category	start
description	Design a realistic, safe, and measurable incident exercise. Use when a team needs to test detection, decisions, escalation, containment, recovery, communication, or evidence without creating uncontrolled production risk.

plan-an-incident-exercise

Create a scenario that discriminates capability from confidence. Test a few important objectives deeply.

Procedure

1. Choose sponsor, exercise director, safety controller, participants, observers, and independent evaluator.
2. Define two to five measurable objectives and the evidence that would demonstrate each one.
3. Select a scenario tied to real services, dependencies, and known risk without reproducing active harm.
4. Set starting state, timeline, injects, expected decisions, branch conditions, and information available to each role.
5. Mark every artifact and channel as exercise-only and define the real-incident interruption protocol.
6. Establish production, privacy, personnel, customer, vendor, and physical-safety boundaries.
7. Prepare observation forms for decision time, authority, evidence, handoffs, tools, communications, and unmet assumptions.
8. Rehearse facilitation, inject delivery, technical simulation, stop conditions, and cleanup.
9. Brief participants on safety and purpose without revealing the expected path.
10. Define debrief, finding severity, action ownership, acceptance tests, and targeted retest timing.

Guardrails

• Never introduce uncontrolled load, malware, data loss, payment, customer contact, or emergency-service activity.
• Do not design the exercise to embarrass one person or reward memorized answers.
• Keep scenario data synthetic or approved and minimized.
• Pause when participants cannot distinguish exercise from reality.

Done

• Objectives map to observable evidence
• Scenario and injects test realistic decisions
• Safety, stop, real-incident, and cleanup controls are rehearsed
• Evaluation and remediation paths exist before execution