Incident Commander: Level 1

Block 1, Exercise 1: Improving Incident Response

SCRIBE: Share your screen for this exercise!


GL leads discussion to identify issues that prevent the incident response program from reaching optimal operational maturity. Use the form below to complete the exercise, submitting ONE form for the whole group. Page 1 of the form asks for basic group information, Page 2 guides you through the questions required to complete the exercise. Feel free to refer to the Operational Maturity Model (below) as needed.

Enter the email address where you would like a copy of this form to be sent so it can be accessed when reporting back to the large group.
(optional) If anyone other than the LNO and Scribe would like this exercise to be emailed to them when complete, the Scribe will be responsible for distribution.
1. Incident Response in Your Organization

Please select the number that most closely represents the opinion of the group regarding the current state of incident response operational maturity. If there are dissimilar participants in the group, the GL must lead the group to select a single ranking from all the inputs from the group.

2. Areas for Improvement

Based on your experience and observations as an incident responder, use the following five boxes to discuss the current incident management process at your company and identify practices, procedures or situations where programmatic improvement is needed. Use one box per idea.