Incident Response Exercises and Tabletops

Exercises in the Outline

Subdomain 5.3 names Incident Response (IR) exercises, with testing and tabletop exercises as examples. A tabletop exercise is a structured discussion in which a team walks through a scenario and the plan's steps without disrupting live operations. A testing exercise exercises the plan more directly.

Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 5.3, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.

What an Exercise Finds

An exercise is useful when it changes the plan. A gap such as an unclear role, a missing contact, or a step that cannot be followed should be recorded and fixed. A scenario that asks what an exercise is for should be answered with finding and fixing gaps before an incident.

What the Outline Lists for This Section

The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:

• 5.3: Data handling policy implementing Incident Response Plan (IRP)
• 5.3: Incident Response (IR) exercises (e.g., testing, tabletop)

Common Traps

A common trap is responding outside the plan. The Incident Response Plan is written before the incident, so the correct answer follows its documented steps and records what was done.