Incident Response Planning
Aims
Goal: brief leadership during a live security incident — headline first, the response phase named, actions with times, honest unknowns — and lead the no-blame review after.
The lesson, stage by stage
- Warm up5 min
Warm-up: Brief the manager mid-incident
2 warm-up questions
- Reading10 min
Reading: What leadership needs from an incident briefing
Read a 238-word text about What leadership needs from an incident briefing
- Vocabulary8 min
Vocabulary: Incident Response Vocabulary
7 items
- Framework6 min
Framework: The Incident Briefing
Headline – Phase – Actions – Next + Time, 4 steps
- Reading10 min
Reading: Three model performances
Read a 353-word text about Three model performances
- Practice7 min
Practice: Incident Response Phases
Gap-fill exercise, 5 items
- Practice7 min
Practice: Fix the Incident Response Mistakes
Error-correction exercise, 5 items
- Dialogue10 min
Dialogue: Post-Incident Review Meeting
Role-play: You're leading a lessons-learned meeting after a ransomware incident that was successfully contained (8 lines)
- Discussion10 min
Discussion: Take command of the briefing
3 discussion questions
Open the full lesson
The remaining 8 stages of this lesson, with the procedure, the examples and the exercises, are included with Starter, along with the interactive version you can teach from. Lesson 1 of this course is free: the full plan is on this site, and a free account opens it in the interactive player.
Target vocabulary
In a Tuton account these words become your student's vocabulary deck, so they come back in practice between lessons.
This plan comes from the Cybersecurity Essentials course in the Tuton library. Browse all free lesson plans.