Skip to content

[REVIEW] ir-playbook: add tabletop inject decision capture gates #2749

@stmr

Description

@stmr

[REVIEW] ir-playbook: add tabletop inject decision capture gates

Skill Being Reviewed

Skill name: ir-playbook
Skill path: skills/incident-response/ir-playbook/

False Positive Analysis

A tabletop exercise can be successful despite imperfect response if decision points, owners, assumptions, and follow-up actions are captured.

Coverage Gaps

The playbook should capture tabletop inject decisions, not only agenda and lessons learned. Without decision logs, teams cannot prove why they notified, contained, escalated, or deferred.

Edge Cases

  • Inject arrives after simulated business-hours cutoff.
  • Legal/comms decision differs by region.
  • Participant substitutes for actual decision owner.

Remediation Quality

  • Add inject log: time, inject, options, decision owner, decision, rationale, and follow-up.
  • Require evidence of unresolved decision gaps.
  • Link exercise findings to playbook updates.

Comparison to Other Tools

Exercise platforms record timelines; IR playbook review must verify decision traceability.

Overall Assessment

Add tabletop decision gates so exercises improve real response governance.

Bounty Info

  • I have read and agree to the CONTRIBUTING.md bounty terms.
  • Preferred payment method: PayPal samik4184@gmail.com

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions