Cyber Incident Response Tabletop Exercises: exercise kit
========================================================

Free templates for readers of the book. Editable in Microsoft Word and Excel, Google Docs and Sheets, Apple Pages and Numbers, or LibreOffice.

- scenarios/01 - Ransomware on a Friday Night - Facilitator Guide.docx and Inject Cards.docx
- scenarios/02 - The Fake Invoice - Facilitator Guide.docx and Inject Cards.docx
- scenarios/03 - Microsoft 365 Account Takeover - Facilitator Guide.docx and Inject Cards.docx
- scenarios/04 - The Lost Laptop - Facilitator Guide.docx and Inject Cards.docx
- scenarios/05 - The Departing Employee - Facilitator Guide.docx and Inject Cards.docx
- scenarios/06 - Your IT Provider Is Breached - Facilitator Guide.docx and Inject Cards.docx
- scenarios/07 - Card Skimming on Your Online Shop - Facilitator Guide.docx and Inject Cards.docx
- scenarios/08 - The Deepfake CEO - Facilitator Guide.docx and Inject Cards.docx
- scenarios/09 - Customer Data Exposed - Facilitator Guide.docx and Inject Cards.docx
- scenarios/10 - Peak-Season Outage and Extortion - Facilitator Guide.docx and Inject Cards.docx
- scenarios/11 - The AI Chatbot Goes Wrong - Facilitator Guide.docx and Inject Cards.docx
- scenarios/12 - The Worst Day Backups Gone - Facilitator Guide.docx and Inject Cards.docx
- templates/A - Facilitator Checklist.docx
- templates/B - Exercise Plan.docx
- templates/C - Participant Briefing.docx
- templates/D - Inject Card Format.docx
- templates/E - Observer and Scribe Log.docx
- templates/F - Hot-Wash Questions.docx
- templates/G - After-Action Report.docx
- templates/H - Improvement Plan.docx
- templates/I - Incident Response Plan.docx
- templates/J - Decision and Contact Sheet.docx

Replace everything in [square brackets] with your own details, delete what doesn't apply, and make sure every statement is true for your company.
These templates are general information, not legal advice. Have HR or a lawyer review policies before adoption.

Updates: thecciedesk.com/tabletop
© 2026 Simson Lubin, The CCIE Desk. You may use and adapt these templates inside your own organisation. Please don't resell or republish them.
