The decision at the center

Who makes the next critical decision when the facts are incomplete and the business is affected?

The conversation

The session makes the leadership side of incident response concrete. It follows the handoffs from technical signals to business impact, containment authority, external communication, and acceptance of recovery.

What to consider

  • Identify decisions that need named owners and alternates.
  • Separate confirmed facts from working hypotheses in updates.
  • Use scenario changes to expose handoff failures.
  • Turn exercise findings into owned, testable improvements.

How to use this guide

Use these questions for a reading group, team discussion, or event-planning conversation. Choose examples that fit the audience and avoid sharing confidential information. This guide describes a topic, not a program offered by a particular speaker.

Questions to explore

  • What decision or handoff has not been exercised recently?
  • Which business services matter most to the scenario?
  • Who needs to participate for the exercise to be realistic?

Read before the conversation