Incident response, evidence and tabletop exercises

Prepare response through risk management

NIST 800-61r3 integrates response with CSF 2.0. Govern, Identify and Protect support preparation; Detect, Respond and Recover cover incident activity; improvement feeds back across the organization. This is the current conceptual model in the assigned source. The older r2 lifecycle is not substituted as the current NIST model.

Make decisions and responsibilities explicit

An incident plan helps define criteria, authority, roles, communication, coordination and response actions. Triage validates a report, priorities reflect risk, and escalation/elevation bring appropriate resources or management attention. Recovery criteria matter because restoration can disrupt operations or affect investigation. Continuity and DR plans may need to run alongside response.

Preserve useful evidence and its context

Record what happened, actions taken and the sequence of events. Protect confidentiality, integrity and provenance of records, data and metadata. Apply organizational evidence/retention procedures and the circumstances; formal prosecution-oriented chain-of-custody procedures are not asserted to be identical for every incident. Distinguish observed facts, estimates and unresolved questions.

Exercise decisions before a real disruption

A tabletop is a structured discussion of a hypothetical incident. It can expose unclear contacts, authority, priorities and dependencies without launching a real attack. Capture actions and lessons, then assign and review improvements. Discussion participation and publisher feedback on a short check do not validate an operational response capability.

Exercise response where AI is part of the service

Editorial application: extend a tabletop to ask whether AI was a target, a support tool or a dependency; what evidence is actually available; who can authorize containment; and how to verify usable recovery. Preserve facts and assumptions separately. A model’s changed behaviour can have multiple causes and should not automatically be attributed to a malicious actor.

Connect the terminology.