During a security incident, uncertainty can become a second problem. Employees may not know whom to call, managers may disagree about disconnecting a system, and important contact information may be stored inside the network that is unavailable.
A short discussion exercise can expose those gaps without interrupting production. Choose one realistic scenario, such as a suspicious workstation alert or a compromised email account. Tell participants that it is a discussion, and do not disable real systems or send deceptive messages as part of the exercise.
Include the people who will make decisions. IT should participate, but so should the business owner or delegate, operational leadership, and the person responsible for customer communication. Add other advisers where relevant to your organization and contractual obligations.
Begin with the first report. Ask how an employee alerts the team, what information is recorded, and who evaluates urgency. Then discuss containment authority. If isolating a computer interrupts shipping or accounting, the responsible people should understand how that decision will be made.
Review communication when normal tools are unavailable. Keep an accessible contact list and an approved alternate channel. Decide who can speak for the company and how facts will be verified before messages are shared. Early communication should distinguish confirmed information from questions still being investigated.
Walk through recovery priorities. Identify which business functions must resume first and what evidence supports the safety of restoring service. A clean backup is useful, but the team still needs to understand the cause and scope of the incident before reconnecting affected systems.
Record decisions that require specialist guidance, including notification duties and any insurer requirements. Those depend on the circumstances, contracts, and applicable rules. The exercise should identify who obtains that guidance rather than inventing a universal deadline.
Close with a few assigned improvements and a date to revisit them. The value comes from fixing unclear responsibilities, missing contacts, and untested assumptions. Contact InnerDigital to help turn your incident response plan into a process the team has actually practiced.