Your incident lead is unavailable. Who can make the next decision?

An incident response plan may name the person who can authorize a disruptive action. The harder question is what happens when that person cannot be reached.

For a CISO and the leadership team, this is a useful starting point for a tabletop exercise. Choose one business decision, make the primary decision-maker unavailable, and see whether the team can work through the situation using the authority it actually has.

Start with a decision the business recognizes

Consider this fictional scenario. Security identifies suspicious activity in a customer portal. The investigation is still underway. Temporarily restricting access could limit exposure, but it would also prevent customers from using the service. The executive named in the incident plan is on a flight and cannot be reached.

The exercise is discussion-only. Nobody disables a production system. Participants describe what they would recommend, what they know, and who could authorize the next step.

Do not tell the group that a full shutdown is the correct answer. The point is to examine how it reaches a decision with incomplete information, not to reward a predetermined response.

Ask the deputy to use the current plan

Invite the security lead, the business owner of the affected service, and the people responsible for operations and communications. Include legal counsel where the scenario raises legal questions. The exact participants should reflect the organization's response model.

Then ask the proposed deputy to find the authority they would rely on. Can they approve a temporary restriction? Is their authority limited by duration, financial impact, or the type of service? Does someone else need to agree? Who takes over if the deputy is also unavailable?

If the answer depends on an unwritten understanding, record that gap. During the exercise, avoid giving someone new authority simply to keep the discussion moving. The organization can resolve the delegation afterward through its normal approval process.

Keep facts and assumptions separate

Before making the simulated decision, ask the group to explain what has been confirmed and what remains uncertain. A report of suspicious activity does not, by itself, establish which data was accessed or whether the activity is still continuing.

Next, compare the available options. What harm could follow from waiting? What would a temporary restriction interrupt? Is a narrower action feasible? What evidence should be preserved, and who can advise on that? The technical team should explain the constraints, while the business owner explains the operational consequences.

A short decision note can keep that discussion usable:

• Confirmed facts and the time they were checked.
• Unanswered questions that could change the decision.
• Options considered and the expected business impact.
• Decision-maker and the basis for their authority.
• Chosen action, responsible owner, and next review point.

This is a suggested working format, not a regulatory reporting template. Its value is that another person can understand the reasoning without having attended the discussion.

Change one fact and revisit the decision

Once the team has made its initial decision, add a new piece of information. For example, the technical team now believes a narrower restriction is possible, but has not yet verified it. Ask who will validate that option and when the group will reconsider its decision.

Also test how the team would coordinate if its normal communication channel were unavailable. Use a safe exercise arrangement rather than moving sensitive information into an unapproved channel.

The Australian Signals Directorate describes tabletop exercises as hypothetical discussions focused on communication, decision-making, and role clarity without affecting actual systems. NIST's incident response guidance similarly recognizes exercises as a way to prepare participants and identify improvements. [1][2]

Leave with a change that can be checked

The result might be a missing delegation, an outdated contact route, or a business impact question nobody could answer. Give each relevant gap an owner and a review date. After the organization approves a change, revisit the same decision in a short follow-up exercise.

Record what the discussion demonstrated and what still needs a different test. A tabletop does not validate that a containment control works, that a backup can be restored, or that every legal obligation has been met.

Before your next exercise, try this question: if the person named in the plan is unavailable, can the team show who is authorized to decide and how that decision will be reviewed?

Cybecs supports incident readiness assessments, playbook development, and tabletop facilitation. Talk with our team about a decision your leadership group needs to rehearse. [3]