# Incident tabletop worksheet

Plan a fictional identity-compromise exercise with your team.

**Original community working document · Version 1.0 · 16 October 2026**

Use placeholders below for a scoped discussion. Do not store credentials, private client records or sensitive evidence in this document. Reference an approved private location instead. This is a starting point, not an official framework document, audit opinion, certification or legal advice.

## Fictional scenario

- **A user reports unexpected MFA prompts. No real account or incident is involved.**
  - [Complete with scoped, non-sensitive information.]

- **An administrator sees an unfamiliar session in a synthetic log.**
  - [Complete with scoped, non-sensitive information.]

- **A critical service may be affected by account revocation.**
  - [Complete with scoped, non-sensitive information.]

## Facilitator prompts

- **Who owns triage and how is the report authenticated?**
  - [Complete with scoped, non-sensitive information.]

- **Who can authorize containment?**
  - [Complete with scoped, non-sensitive information.]

- **What evidence should be preserved before changing access?**
  - [Complete with scoped, non-sensitive information.]

- **Which business owner validates recovery?**
  - [Complete with scoped, non-sensitive information.]

## Debrief

- **Decisions that were unclear**
  - [Complete with scoped, non-sensitive information.]

- **Missing contacts or dependencies**
  - [Complete with scoped, non-sensitive information.]

- **Actions with owners and review dates**
  - [Complete with scoped, non-sensitive information.]

- **Evidence that the improvements were later exercised**
  - [Complete with scoped, non-sensitive information.]

## Review and ownership

- Prepared by: [Name / role]
- Reviewed by: [Name / role]
- Version and review date: [Version / date]
- Adaptation notes: [What changed and why]

## Use and attribution

Original draft prepared for Abdullah Bin Zarshaid’s personal community library. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/ . You may adapt this original document with attribution. No third-party standard text or employer/client material is included. Assess suitability for your own scope.