Ultimate TTX
Notes on running tabletop exercises that find things.
-
Ranking what you recommend
A report that orders its recommendations by severity alone buries the cheap important ones among the expensive structural ones. Grouping by what acting on them involves works better, severity has a known weakness when rated from outside, and a recommendation nobody acts on is a risk somebody accepted.
-
Every observation has to become a recommendation
The exercise produces observations. Every one has to be accounted for, most of them become recommendations, and the ones that resist are usually the findings worth the customer's attention. What that conversion actually involves, and what it costs.
-
Whether to record the exercise
A recording makes the report dramatically easier to write and makes some participants stop talking. Both are real, and the decision is not a preference about tooling.
-
Which roles to put in the room
Every role added to an exercise improves coverage of the incident and costs half a day or more of somebody's working time. The scenario should decide the roster, and the library shows how much it varies.
-
"How long would this take you?"
Everyone estimates assuming things go well, and an incident is the situation where things are not going well. The exercise cannot produce the true number, but it can show that nobody has one.