# Incident tabletop: rehearse decisions while the systems are still healthy

Source: https://www.web3sec.news/blog/incident-tabletop-runbook
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Choose one operational decision and a measurable objective.
- [ ] Invite the people who can actually authorize containment.
- [ ] Introduce unavailable staff and suspect communications.
- [ ] Measure demonstrated actions rather than stated intentions.
- [ ] Assign observable fixes and retest the failed step.

## References
- [CISA: tabletop exercise planner handbook](https://www.cisa.gov/sites/default/files/2023-01/2_-_ctep_exercise_planner_handbook_2021_final_508.pdf)
- [NIST SP 800-61 Rev. 3: incident response and risk management](https://csrc.nist.gov/pubs/sp/800/61/r3/final)