Ultimate TTX
Notes on running tabletop exercises that find things.
-
Which roles to put in the room
Every role added to an exercise improves coverage of the incident and costs half a day or more of somebody's working time. The scenario should decide the roster, and the library shows how much it varies.
-
"How long would this take you?"
Everyone estimates assuming things go well, and an incident is the situation where things are not going well. The exercise cannot produce the true number, but it can show that nobody has one.