Drilling the first hour of an incident

A written incident-response policy tells you what should happen. A tabletop exercise shows you who actually picks up the phone, who has authority to disconnect a system, and how long it takes to find the contact list. This article shares patterns observed across exercises with leadership and technical teams.