Plan a Small Incident Tabletop with a Real Decision Owner

Why revisit this now?

CISA’s October 2026 Cybersecurity Awareness Month campaign has just ended. November is a practical time to turn its recommendations into a documented operating habit. The campaign names both individual protections and organizational recovery practices; this guide handles one narrow follow-through job.

The source is a dated snapshot, not a live monitoring feed. Return by 2027-01-30, or earlier if your evidence changes. A source published in an earlier year is identified as such below; its retrieval date is not a claim that the underlying rule is new.

The useful distinction

CISA recommends realistic incident-response exercises that include leadership, legal, and technical stakeholders.

A short exercise is easier to schedule, but it must still involve the people who can make decisions.

This guide separates a statement from the evidence that supports it. The companion tool turns your three answers into a short, ordered action brief. It does not replace the source, contact anyone, or turn uncertainty into a confident prediction.

Three questions to resolve

1. Is the harmless scenario and exercise scope defined?

   The exercise should test decisions rather than create a real incident.

   If No or Not sure: Choose a paper scenario and make clear that no live systems will be attacked.

2. Are decision-making stakeholders invited?

   CISA explicitly calls for more than a technical-only drill.

   If No or Not sure: Include the relevant leadership, technical, and legal or policy owners.

3. Is a follow-up owner assigned to identified gaps?

   A drill creates value when findings change the operational plan.

   If No or Not sure: Record actions and a review date after the exercise.

Answer Yes only when you have supporting evidence. Choose Not sure when the information is missing or unclear. No and Not sure both keep the relevant action in the brief, but the exported record preserves the difference.

A worked example

Suppose the first check is No, the second is Yes, and the third is Not sure. These are illustrative choices, not facts about you. The App evaluates all three checks, records one confirmation, and returns two evidence gaps: checks 1 and 3.

The first next step is: Choose a paper scenario and make clear that no live systems will be attacked. The brief also keeps this follow-up: Record actions and a review date after the exercise.

Now change only the first answer to Yes. The result has one remaining gap, check 3, and its action becomes the next step. If all answers are Yes, the result records three confirmations without declaring the situation safe, compliant, or eligible.

What can go wrong?

Do not turn a tabletop into an unauthorized live attack or public accusation.

A polished brief can still contain mistaken inputs. Before acting, compare it with the original evidence and the current official instructions. If two sources conflict, ask the responsible authority or professional to resolve the conflict rather than selecting the answer you prefer.

Use the brief somewhere useful

Copy or download the incident tabletop agenda for your own records or a focused conversation. It includes your answers, unresolved actions, the rule explanations, source links, and the review date. Printing is also free; no account or payment is required.

Keep sensitive supporting documents outside this tool. A result link contains only the three status choices, but even those can reveal context. Share only after reading the warning, and do not add private identifiers to a public message.

General information only. This is not medical, legal, financial, or emergency advice. A completed checklist is not independent verification and does not submit an application, complaint, or request.

Sources, dates, and limits

1. CISA — Secure Your Business

   CISA recommends phishing-resistant MFA where available, timely patches, logging, backups aligned with recovery objectives, encryption, and practiced incident and continuity plans. This is a baseline, not a security guarantee.

   Publication/effective date: Undated guidance; retrieved 2026-11-01. Checked 2026-11-01.

2. CISA — Cybersecurity Awareness Month

   The October 2026 campaign names phishing reporting, strong passwords, MFA, and software updates, plus logging, backups, encryption, incident response, and disruption preparation for organizations.

   Publication/effective date: October 2026 campaign; retrieved 2026-11-01. Checked 2026-11-01.