Practice incident decisions before the real day
About the creator and the method
Response Rehearsal is a static web tool for creating incident response tabletop exercise materials. It helps facilitators assemble defensive practice scenarios, timed injects, participant handouts, slide-style prompts, worksheets, evidence questions, and after-action material without opening an account or uploading organizational information.
Why this project exists
The idea began while the creator was preparing an incident response exercise for work. Building a useful tabletop required more than a dramatic scenario: the facilitator needed objectives, participant roles, timed complications, decision prompts, evidence questions, presentation material, and an after-action record that could survive the meeting. Response Rehearsal grew from that practical need for a credible starting point that a small team could adapt instead of a promise to replace a paid exercise platform.
The creator's working context
The creator is a working sole cyber practitioner and ISSO in a small software company. The initial design context includes a hybrid workforce, remote and multi-location participation, executive decision-makers, customer demonstrations and travel, common cloud productivity services, and software delivery work. The organization had already completed a tabletop exercise, and the next exercise needed to fit a 60-minute window without allowing technical detail or executive discussion to consume the closeout.
That experience shapes the product's emphasis on clear authority, realistic business pressure, remote facilitation, evidence capture, and a short list of owned improvements. It does not make one workplace the model for everyone. Roles remain configurable, scenarios stay system-neutral, and users are expected to adapt the material to their own plans, organization, obligations, and professional advice.
How the material is developed
The content model is informed by recurring structures in public incident response and exercise guidance, including CISA tabletop exercise packages, NIST SP 800-61 Revision 3, and NIST SP 800-84. Those sources help identify useful lifecycle, facilitation, evaluation, and after-action patterns. Their wording is not copied into the generator. Scenarios, injects, choices, consequences, guides, and rubrics are written as original, simplified material for defensive discussion.
Each focused interactive rehearsal is checked for a coherent five-stage progression, three materially different choices per inject, explicit decision authority, evidence preservation, continuity tradeoffs, careful communications, recovery validation, and durable improvement ownership. Scenario language avoids product-specific commands and operational attack instructions. Uncertainty is intentional, but the exercise should never require participants to invent facts the facilitator has quietly assumed.
What review does and does not mean
Review is a product-quality gate, not a certification. Material is checked against the project's source map, system-neutral design rules, privacy boundary, scenario continuity, and browser behavior. Response Rehearsal does not claim official CISA or NIST alignment, guaranteed compliance, legal sufficiency, forensic accuracy, or suitability for every organization. Facilitators remain responsible for reviewing the output, involving qualified internal or external advisers, and adapting decisions to current policies, contracts, regulations, systems, and risk authority.
How the site handles exercise data
The generator runs from static HTML, CSS, and JavaScript. It does not require accounts, uploads, a database, or a backend service, and generated exercise content is not sent to a Response Rehearsal server. Use fictional or sanitized details anyway. Do not enter credentials, personal information, regulated data, customer information, sensitive architecture, or active incident evidence. Copies, downloads, and printed records should be handled under the user's own storage, access, retention, and disposal rules.