Respond to an incident without improvising
See this course’s project requirements
Run the fictional print-center tabletop using your five prepared security records and document two improvements.
Keep your working files in your own notebook or software. Save a private description, checklist, and work link in My Proof.
What to include
- Map work assets, owners and permitted actions.
- Prepare a minimal suspicious-request report using independent verification.
- Resolve access and device scenarios through approved roles.
- Compare a sample restore drill with recovery and data-loss targets.
- Complete an incident chronology and tabletop improvement plan.
Review and revise
Use these criteria to check your work and choose what to improve.
- Authorization: actions stay within the stated workplace role.
- Reporting: facts and interaction history reach the correct route.
- Recovery: time and content evidence are distinguished from assumptions.
- Coordination: fallback contacts and restart decisions are clear.
Want more background?
The idea in everyday life
When a work file becomes unreadable, the cause could be a mistake, an outage or a security incident. You do not need to diagnose the cause before reporting the symptom. You do need to avoid making the situation harder to assess. The fictional incident card assigns concrete first actions and an escalation route while leaving technical investigation to authorized responders.
Coordinate the response before taking actions that could change systems or evidence.
One step at a time.
Use the sample or information you have permission to use. Keep your work as you go. You can pause between steps.
- 1
Use the supplied alert: at 11:05 the queue displays "Access unavailable" and an unfamiliar popup requests payment. Do not interact with the popup or assume payment would restore authorized access.
- 2
Follow the exercise incident card: stop using the affected application, note the time and visible message, and contact the known internal help route. If unavailable, contact the prelisted supervisor route.
- 3
Leave disconnecting devices, shutting down, wiping, scanning or restoring to the documented plan and authorized responder. The correct containment action can depend on the system and evidence needs.
- 4
Write a short timeline of what happened, including any earlier link interaction and which work was affected. Do not include passwords or copy the whole job queue to an unapproved personal account.
- 5
Use the supervisor’s approved continuity option: pause affected jobs and record only non-sensitive job references on the designated offline worksheet. Resume normal work only after the responsible owner confirms readiness.
See how it works.
Fictional chronology: 11:05, queue unavailable; unfamiliar payment popup appears; no payment or link interaction. 11:07, operator reports through the established help channel. 11:10, supervisor pauses affected dispatch and opens the approved offline reference worksheet. The IT responder directs containment and later restoration; the operator does not experiment with deletion or resets. At 12:00, the responder verifies the restored queue, and the supervisor authorizes work to resume. This is a tabletop sequence, not a universal incident procedure. Its purpose is to make roles, observed facts and recovery authorization explicit before confusion leads to uncoordinated action.
Did you cover these?
- Immediate actions follow the supplied card.
- Chronology separates facts from diagnosis.
- Return to service requires the responsible owner’s confirmation.
What to finish
A response card and timestamped tabletop incident chronology.
Watch for this
Wiping, restoring or disconnecting systems reflexively without the applicable response plan.
How can I tell I understand it?
Report useful facts and identify who decides containment and return to service.
Quick knowledge check
Answer all 3 questions. Get at least 2 right and the lesson completes automatically.
You’ll get an explanation for each answer. Signed in? Your results save to your account.
Pass the check. We’ll save the progress.
Answer all 3 questions above and get at least 2 right. You can review the explanations and try again.
Go to the knowledge checkTools, templates, and lesson sources
Tools and templates
Tools open in a new tab so you can keep your place here.
Sources and further reading
Explore the references behind this lesson.
Source & access notes · checked 2026-09-10
Opened full April 2025 publication and official final-publication page, which confirms it supersedes Rev. 2. Used for response/recovery roles and coordination; no forensic procedures are taught.
Access: Free public reading; no account or certificate is required for this Life Starter course.
Reuse: Linked for reference. Examples, activities and assessments here are original; free access alone does not grant permission to reuse source text or branding.
Report a problem with this lesson
Tell us what went wrong. Please leave out personal information and private project contents.