An Incident Response Tabletop With Real Tickets

The binder named an incident commander who had left the company. Last quarter’s tickets named who actually picks up the phone.

A regional manufacturer in Chatsworth asked Secure Techies for an incident response tabletop after a cyber-insurance application asked when the plan was last tested. The honest answer was never. They had EDR on office endpoints, backups, and a consultant PDF. They did not have a rehearsal.

This case study records how we read the binder against the queue, ran ninety minutes on three real tickets, and left a contact sheet that matches the living. Client identifiers stay out. The method does not.

Why the plant called

The company sits in the same pattern as other manufacturing accounts we support: an office that can stop if mail dies, a floor that should not share Wi-Fi with accounting, and a controls vendor who owns the PLCs. We do not casually reprogram those. The tabletop had to say so or it would become a dangerous paragraph.

NIST’s SP 800-61 Revision 3 is the public incident-handling handbook. We did not implement every control in that document. We used it as a completeness check: prepare, detect, contain, eradicate, recover, learn. CISA publishes tabletop exercise packages for a reason. A plan nobody has spoken out loud is a plan that fails the first night. CIS Incident Response Management is the same idea in control language: know who does what before the ticket becomes a crisis.

Two facts forced the issue:

1. Insurance asked for a test date. The FTC’s small-business cybersecurity guidance is not an insurance form, but it is the same point: headcount is not a plan.
2. The named lead in the binder was gone. Help desk tickets from last quarter already showed who filled the gap in practice.

What an incident response tabletop is, and is not

A tabletop is a facilitated conversation with a clock. People sit. A scenario is read. Decisions are written. You find the empty seat before 2 a.m. finds it.

This was not:

• A live incident. Nobody restored ransomware. CISA’s I’ve been hit by ransomware page is for that day. We did not invent that day for this page.
• The CrowdStrike outage response. That study is a real 2024 event in a clinic. This study is a rehearsal in a plant office.
• Co-managed IT after the internal admin left. That is a standup. This is a practice.
• PLC or OT engineering.

Microsoft publishes incident response playbooks for identity and mailbox events. We used those as prompts, then replaced the Hollywood details with last quarter’s ticket titles. A mailbox lockout the office already survived is a better prompt than a nation-state.

Our public explainer is how to build an incident response plan. This page is the project record of testing one.

What this engagement was not

We wrote the non-goals down. If you do not say “this is not a live IR” in the statement of work, someone will read a tabletop log as if you contained a breach.

Out of scope on purpose:

• Touching controllers
• A red-team
• Rewriting every policy
• Staffing a 24/7 SOC they did not buy

In scope:

• Binder versus tickets
• Named roles
• One 90-minute session
• Contact sheet and decision log
• A test call to after-hours numbers

How we ran the three weeks

Week 1: binder, tickets, empty seats

We read the plan. We pulled last quarter’s help desk queue with names removed from this page. Three tickets were enough:

1. A mailbox that looked taken over: forwarding rule, impossible travel, password reset.
2. A backup job that had been green and a restore that had not been tested when someone asked.
3. A vendor VPN account that was still live after the project ended.

Those three already covered identity, recoverability, and vendor access. We did not need a cinematic plant shutdown.

We also called the numbers on the contact sheet during business hours. Two rang people who no longer worked there. That finding paid for the week.

Week 2: the session

Ninety minutes in a conference room. Attendees: operations, the office manager, a plant supervisor who does not touch IT, our engineer. We read each scenario. We asked who decides, who talks, who isolates, who does not walk onto the floor with a laptop.

Decisions went on a log: time, question, answer, owner. Arguments were allowed. Unowned answers were marked unowned. That mark is the point.

When the vendor-VPN scenario reached “who disables the account,” the room discovered it was still a ticket to the old MSP. That is a tabletop working.

When the restore scenario reached “who says the backup is good,” nobody wanted the pen. We wrote that down. Later backup and disaster recovery work can own the test. The tabletop’s job was to make the gap visible.

We kept the clock visible. Each scenario had a fifteen-minute box. When time ended, we forced a decision or marked “no owner.” Stretching a tabletop into a three-hour workshop is how people stop arguing and start agreeing with whoever is loudest. Short boxes keep the empty seat obvious.

The plant supervisor’s job in the room was to say when a proposed isolation would stop a line. Twice the office-side instinct was “just pull the switch.” Twice the supervisor said that switch was not ours. That is why they were in the chair. An IR plan written only by IT will invent access it does not have.

We also asked who talks to employees on the floor if mail is frozen. The first answer was “we’ll email.” The scenario had already taken mail. The second answer was a supervisor walk-down. We wrote that as the comms path for a plant, not a press release.

Week 3: rewrite and the test call

We rewrote the contact sheet: incident lead, backup lead, comms, insurance, legal on retainer, Secure Techies after-hours, who does not touch PLCs. We dated the cover.

We placed one after-hours test call to the new primary. It was answered. We logged it. Insurance can have that line.

Chatsworth context for ongoing support lives on the Chatsworth location page. Help desk remains the front door: managed help desk.

What we found

We are not going to invent a “mean time to contain dropped 47 percent” graphic. The useful story is the empty seat.

The binder was literature. It was well written and aimed at a company that no longer existed.

Tickets are better scenarios than movies. People argue about work they recognize. They check out of fiction.

OT in one paragraph is a hazard. “Isolate the plant” without a named controls vendor is how someone improvises on a line.

Insurance wanted a date, not a novel. Attendees plus decisions plus a cover date is the artifact.

After-hours numbers go stale quietly. Calling them is part of the test, not extra.

Help desk first response is not declaring an incident. A mailbox lockout can be a ticket for twenty minutes and an incident at minute twenty-one. The plan has to say who upgrades it. Otherwise every phishing mail becomes a war room, or none do.

Legal and insurance are roles, not decorations. If counsel is “we’ll find someone,” you will find them after the notification clock has started. We listed the retainer contact or marked the seat empty. Empty is honest. “We’ll see” is not.

A second tabletop is cheaper than a first incident. We said so without inventing a savings percentage. The log from this session is the homework list for the next one.

We left a one-page “if this is happening now” sheet in front of the binder: declare, isolate office, call us, call insurance, do not touch the floor. The binder can stay for lawyers. The sheet is for 2 a.m. If the sheet and the binder disagree, the sheet wins until the next tabletop. Print two copies. One in the office, one with the night supervisor. Laminate if the shop is dusty. That rule was written down so a well-meaning supervisor does not improvise on a controller because page 19 said isolate the plant.

How we ranked what to rehearse first

A plant with one office and one floor does not need a 12-scenario day.

First session: identity, restore, vendor access. Those three already hurt.

Later, if they ask: a second tabletop after the restore test is on a calendar, a comms drill with a customer-facing script, a session that includes the controls vendor in the room. Not day one.

We pointed them at cybersecurity for the monitoring that should feed identification, and at the ransomware cost calculator so a downtime conversation had a number attached, not adjectives. CISA’s ransomware guide stayed in the appendix as “if this becomes real,” next to the hit-already page. Neither is a tabletop. Both belong in the packet so nobody confuses a rehearsal with a recovery.

What the manufacturer received

1. A contact sheet with people who still work there.
2. Named roles and backups, including empty seats marked empty until filled.
3. A 90-minute tabletop log from three real tickets.
4. An after-hours test call that was answered.
5. A dated cover for the insurance packet.

What they still did not have, and should not claim:

• A live incident we contained
• A SOC we did not staff
• PLC coverage
• A passing score from a carrier

Lessons we would repeat on the next one

Use real tickets. Pride will show up for work people remember.

Call the numbers. A sheet that does not ring is not a sheet.

Write the OT line. If you will not touch a controller, say so before someone asks you to at 2 a.m.

Ninety minutes is enough. Longer becomes a workshop nobody finishes.

Date the cover. That is the artifact the application asked for.

Planning your own incident response tabletop

If insurance asked when you last tested the plan and the honest answer is never, start with the binder and last quarter’s queue. Bring operations, the office manager, and whoever actually answers after hours. We will tell you what belongs in a 90-minute tabletop and what belongs in later monitoring or restore work.

Secure Techies works from Canoga Park with plants and offices across Los Angeles and Southern California. Schedule a consultation if you want the same kind of rehearsal this client left with.

For the explainer, read how to build an incident response plan. For a live event record, see CrowdStrike outage response for a healthcare practice.