Rehearse a workplace security incident
See this course’s project requirements
Run the fictional print-center tabletop using your five prepared security records and document two improvements.
Keep your working files in your own notebook or software. Save a private description, checklist, and work link in My Proof.
What to include
- Map work assets, owners and permitted actions.
- Prepare a minimal suspicious-request report using independent verification.
- Resolve access and device scenarios through approved roles.
- Compare a sample restore drill with recovery and data-loss targets.
- Complete an incident chronology and tabletop improvement plan.
Review and revise
Use these criteria to check your work and choose what to improve.
- Authorization: actions stay within the stated workplace role.
- Reporting: facts and interaction history reach the correct route.
- Recovery: time and content evidence are distinguished from assumptions.
- Coordination: fallback contacts and restart decisions are clear.
Want more background?
The idea in everyday life
Your final project is a tabletop exercise, meaning you walk through a scenario and record decisions without causing a real incident. This can reveal unclear contacts, missing authority or untested recovery assumptions. You will reuse every lesson output and finish with a focused improvement plan. No outreach, phishing campaign, network scan or production restore is part of the course.
A rehearsal tests whether people know the next authorized action before a real incident.
One step at a time.
Use the sample or information you have permission to use. Keep your work as you go. You can pause between steps.
- 1
Assemble the asset-role map, suspicious-request report, access decision table, restore assessment and incident card. Check that the same roles and contact labels appear consistently across them.
- 2
Run the supplied sequence: an urgent export request arrives; the operator declines an unexpected sign-in prompt; the queue later becomes unavailable. Record the immediate authorized action for each event.
- 3
Introduce a complication: the normal help channel is down. Use the predefined supervisor fallback rather than the contact details supplied in the suspicious message.
- 4
Reuse the recovery drill targets to ask what evidence the responder needs before restoration and return to service. Separate technical readiness from the supervisor’s operational restart decision.
- 5
Write two improvements based on actual gaps in the tabletop, each with an owner and a check. For example, clarify the fallback channel on the card and repeat the scenario to confirm it can be found.
See how it works.
Fictional rehearsal findings: the operator correctly withholds the export and rejects an uninitiated sign-in approval. When the help channel fails, the team finds the supervisor fallback in the asset-role map but not on the incident card. Improvement one copies that already approved fallback onto the card, owned by the supervisor, then checks retrieval in a repeat walkthrough. Improvement two asks IT to verify the restored sample against both reference lines, because the first draft checked only file existence. These changes come from observable rehearsal gaps and do not claim that the organization has passed a security audit.
Did you cover these?
- All five prior outputs use consistent roles.
- Fallback reporting works without the normal channel.
- Two improvements have owners and verification steps.
What to finish
A complete workplace security tabletop packet with two owned improvements.
Watch for this
Turning a paper rehearsal into an unauthorized phishing test or live-system experiment.
How can I tell I understand it?
Choose the next permitted action at each event and repair an observed coordination gap.
Quick knowledge check
Answer all 3 questions. Get at least 2 right and the lesson completes automatically.
You’ll get an explanation for each answer. Signed in? Your results save to your account.
Pass the check. We’ll save the progress.
Answer all 3 questions above and get at least 2 right. You can review the explanations and try again.
Go to the knowledge checkTools, templates, and lesson sources
Tools and templates
Tools open in a new tab so you can keep your place here.
Sources and further reading
Explore the references behind this lesson.
Source & access notes · checked 2026-09-10
Read the public course overview emphasizing account, data, system and software risks at home and work. Optional deeper study only; original workplace scenarios here.
Access: Free OpenCourseWare reading/videos; external submissions require an edX account. Verified certificates or credit-bearing courses require separate enrollment and may cost money. Life Starter provides no Harvard affiliation, credit or certification.
Reuse: Linked for reference. Examples, activities and assessments here are original; free access alone does not grant permission to reuse source text or branding.
Source & access notes · checked 2026-09-10
Read official examples of urgent action requests and verification through known contact information. CISA pages returned 403 and were not used as verified sources.
Access: Free public reading; no account or certificate is required for this Life Starter course.
Reuse: Linked for reference. Examples, activities and assessments here are original; free access alone does not grant permission to reuse source text or branding.
Source & access notes · checked 2026-09-10
Opened full nine-page guide; read asset owners, need-based access, backups and testing, detection and response authority. General voluntary guidance, not compliance certification.
Access: Free public reading; no account or certificate is required for this Life Starter course.
Reuse: Linked for reference. Examples, activities and assessments here are original; free access alone does not grant permission to reuse source text or branding.
Source & access notes · checked 2026-09-10
Opened full April 2025 publication and official final-publication page, which confirms it supersedes Rev. 2. Used for response/recovery roles and coordination; no forensic procedures are taught.
Access: Free public reading; no account or certificate is required for this Life Starter course.
Reuse: Linked for reference. Examples, activities and assessments here are original; free access alone does not grant permission to reuse source text or branding.
Report a problem with this lesson
Tell us what went wrong. Please leave out personal information and private project contents.