Incident Management Training for IT Operations

Exercise: Company-Specific Technology Scenario


The technology incident scenario will be provided to the Incident Commanders. 

Missing details may be filled in by the IC and/or other team members. 

This is a simulation. You do NOT need to refer to real life logs or other data sources.

Breakout Room

Incident Commander (IC)

  • Appoint key positions.
  • Brief the group on the scenario (CAN).
  • Engage your staff.
  • Delegate and set time contracts.
  • Drive the group toward resolution, integrating information from other team members.
  • Deliver an additional CAN report part way through the session. 

Liaison Officer (LNO)

  • Keep your own notes of key actions, decisions and benchmarks so you can deliver briefings when asked.
  • Leave the room when requested to provide a CAN report to Unified Command.
  • Review Scribe notes or request an update from IC to stay apprised of what happened while you were off the bridge.


  • Capture details and key events, documenting the incident.
  • Screen share your document throughout the exercise.


  • Confirm tasks received
  • Report back to the IC on the tasks you are assigned.
  • Make up any missing details. You do NOT need to access real life data sources.
  • Support the incident resolution effort.

Main Room


Use the format of your choice to deliver a briefing, outlining your group’s progress toward resolution.


Deliver a briefing using the IMS briefing format. The briefing can be related the beginning, middle or end of the incident.


Screen share your Scribe notes for discussion purposes. Be prepared to submit your document upon request.

AFTER your report in the main room, please submit your work

Click or drag a file to this area to upload.
Your group will be asked to share your work in the main room. Please submit your Scribe notes or LNO briefing AFTER sharing in the main room.