Layer8 practical exercise
Incident readiness discussion guide
Practice how your team would make decisions, communicate and keep essential work going during a security incident.
Make the first discussion useful.
Use a 45-60 minute facilitated discussion to find decision and coordination gaps. The scenario is a suspected account compromise followed by a critical service becoming unavailable; no attack simulation or technical intrusion is required.
Prepare before the discussion
- Leadership, IT, the service owner and the relevant program or operations representative.
- Protected incident contacts, provider responsibilities and the current continuity plan.
- A facilitator, a note taker and an agreed discussion boundary.
Work through the prompts.
Set the exercise boundary
Use an invented organization and synthetic records. Confirm this is a discussion exercise, not a production change, and name the facilitator and decision owner.
Introduce the first report
A staff member reports an unexpected sign-in notice. Who receives the report, records the facts and decides whether to escalate?
Agree who can act
Who may restrict access or pause a service? Identify what requires leadership approval, what the provider can do and how business impact is considered.
Introduce the service outage
A critical application is unavailable. Which work must continue, which approved alternate process is used and who confirms that the alternate is safe?
Protect people and sensitive records
Where children's programs or sensitive services are involved, who owns safeguarding decisions and the protected record-access process during the outage?
Preserve useful evidence
Agree who preserves relevant logs and records without altering or broadly sharing them. Identify the protected evidence location and specialist escalation route.
Coordinate external responsibilities
Identify provider, insurer, legal and other required notification decisions. Confirm responsibilities and applicable deadlines with qualified advisers rather than improvising them in the exercise.
Plan communication
Who approves messages to staff, volunteers, affected people and the public? Establish an alternate contact route if normal email is unavailable.
Agree recovery acceptance
Who confirms a service is ready to resume? Consider authorized access, useful data, important dependencies and the approved recovery plan.
Close with owned actions
Record decisions, unknowns and the three most useful improvements. Assign an owner, a due date and a check that shows the coordination gap has been addressed.
Agree the result and the next action.
Use these outputs to judge whether the preparation is useful:
- An exercise record separating hypothetical discussion from observed operating evidence.
- Named decision makers, backup contacts and clear responsibilities for keeping essential work going.
- A small action register and a date to verify the improvements.
Review prompt: Repeat after significant team, provider or critical-service changes and on an agreed exercise cadence.
Record the next decision
Use your secure workspace to record the issue, what you know, who is responsible and what happens next. Add a due date and a way to check completion. The PDF includes a printable worksheet.
Use the guide within an agreed scope.
Edition 1.0 · Updated October 4, 2026
This discussion does not authorize containment or changes in a live environment. Specialist incident response, legal notification and continuous response coverage require their own agreed scope.
Primary references for further reading
These are original Layer8 preparation prompts. The linked organizations do not endorse this guide.
Bring the question. Agree the work.
Cybersecurity can help scope this work. Assess the authorized scope, prioritize improvements and verify agreed safeguards.