Advanced lesson
Practice the First Decisions in a Security Incident
Run a short tabletop that connects a suspicious sign-in, video records and business continuity without changing live systems.
Reviewed September 2026 · 3 minute read
A suspicious sign-in and a missing recording
Worked example
Practice scenario: the office and warehouse
At 8:15, a staff member reports an MFA prompt they did not start. A provider alert shows an unusual administrative sign-in. The warehouse manager also cannot find an expected recording.
These are observations, not proof that the events share one cause. Run this as a discussion exercise with an incident lead, technical lead, business decision maker and note taker.
Make the decision record useful
| Question | Record before moving on |
|---|---|
| What do we know? | Source, time, affected identity/system and the evidence behind each observation. |
| Who can contain? | The authorized lead and the effect of isolating a device, revoking sessions or limiting an account. |
| What must be preserved? | Relevant logs, time offsets, recordings and an accountable record of access or export. |
| How do we communicate? | Approved contacts and a known-good channel; escalation and notification decisions belong to named owners. |
| How do we recover? | A trusted recovery point, security checks, business validation and a monitored return to service. |
Do not erase logs, reimage systems or reboot devices reflexively. Use the approved response procedure to balance evidence preservation with stopping active harm. A suspected safety issue at a door follows the site’s emergency procedure immediately.
Add one complication
The normal administrator account is unavailable. The recorder and a cloud service show different time zones. The team needs to preserve one clip before routine overwrite.
Identify the controlled emergency-access route, retain each system’s time context and have the authorized owner preserve the relevant records. Never post private clips or credentials in a public support thread.
Finish with one improvement
Spend ten minutes discussing the case. Save a decision log with assumptions, owners and open questions. Choose one change to the contact list, alert routing, recovery process or access policy; give it an owner and a validation date.
What counts as success?
The team can explain who decides, what evidence is needed, how containment affects the business and how recovery will be verified. A fast answer unsupported by evidence is not the objective.
Put it into practice
Check what you learned
Choose an answer for each question, then check your understanding. Your answers stay in this browser.
Read the answers and explanations
- Keep them as observations and compare timestamps, accounts and system evidence.
Timing is a lead, not proof. Check the relationship without merging or dismissing evidence prematurely.
- Use the approved response authority, assess the impact and record the containment decision.
Containment needs a decision owner, a record and awareness of business dependencies.
- A named owner, an action deadline and a recovery test to verify the fix.
The exercise is useful when the gap becomes an owned action with a verified result.
Sources and further reading
- NIST SP 800-61 Rev. 3: incident response
The current incident-response publication links preparation, response and recovery with ongoing risk management. Our tabletop uses an original fictional scenario.
Keep your momentum
Ready for the next step?
If you can explain the example and your answer, try the next lesson. Revisit the feedback whenever you need it.
FryAVSI · Updated September 10, 2026
Reference this lesson or use a section’s direct link for a particular chart or example. How to cite an example.
FryAVSI · Northeast Ohio and beyond
Turn the learning into a working result.
Share the site, the requirement and the next step with our team.