The exact requested timeline, data/evidence, decision/escalation and after-action artifacts are supplied and tied to an explicit fictional plan, with model reasoning and limits.
Original editorial teaching and fictional application, informed by the linked primary passages. Compare your reasoning with the model; this is not independently marked learner work, an official examination key or a replacement for the selected course.
What this guide contributes.
Primary route: ISC2 CC. These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.
See this guide’s exact scope links and remaining depth
What the source review checked
- Plan, authority and classification supplied before exercise
- Incident criterion and disclosure uncertainty
- Timeline and provenance
- Handling record
- Decision/escalation and recovery
- After-action feedback and action verification
Assigned public passages and original model guidance were checked. No learner work, paid course or full licensed standard was assessed; the remaining-needs section controls any closure claim.
1. Read with a purpose.
NIST · NIST SP 800-61r3: timeline, protected evidence and improvement rows
FREE PUBLIC READINGRead: Selected timeline/evidence rows and improvement rows.
Learn: Preserve what happened, when it happened, who collected the record and who may access it; improve response using evidence rather than assuming the incident is fully understood.
Exact scope and exclusionsFree public 48-page PDF; selected table rows were read through the public browser reader.
UK National Cyber Security Centre · NCSC effective cyber exercise creation: test a stated plan and act on lessons
FREE PUBLIC READINGRead: Steps 1, 3, 5 and 7–9, then the stated plan before the case injects.
Learn: An exercise needs a plan, purpose and expected actions to compare with observations; feedback also covers exercise quality.
Exact scope and exclusionsFree public HTML article, including the actual nine-step teaching, read without an account.
CISA · CISA CTEP Facilitator/Evaluator Handbook: evidence, decisions and after-action improvement
FREE PUBLIC READINGRead: Pages 3–7 observation, analysis and after-action/improvement guidance.
Learn: Join decisions and plan deviations to justified actions, owners, timing and later evidence of completion. A discussion has no automatic pass mark.
Exact scope and exclusionsPublic PDF returned HTTP 200 (643,785 bytes, 26 pages) through an ordinary direct request on 29 October 2026; selected pages were extracted and read. The browser reader returned 403, so normal browser-reader availability was not assumed.
2. Try the fictional case.
A booking export becomes publicly accessible: plan, timeline and lessons
Original editorial application; no real incident, customer or provider is involved. Read fictional plan P1 before the injects. P1: report suspicious activity to the duty analyst; the incident lead declares an incident when credible evidence indicates unauthorized access or sharing of Restricted data; the lead may authorize the operator to suspend public sharing and revoke the affected integration token, recording availability/evidence trade-offs; the service owner and privacy lead receive an internal escalation; only the communications lead approves external statements. Recovery needs incident-lead and service-owner approval after containment is verified, relevant records are preserved and the booking workflow works with approved permissions. If the owner cannot be reached, use the backup contact in the plan; the exercise copy has that field blank. Fictional classification policy D1: booking exports and raw incident records are Restricted, accessible only to the named response/custodian/privacy roles through protected approved storage; a redacted manager summary is Internal; public notices require communications approval and contain no raw records. The custodian records provenance, access and retention/review decisions; routine deletion must not override an active evidence-preservation requirement. All following times are UTC. Inject I1 at 09:00: an alert reports a public export link. I2 at 09:03: the account user denies requesting it. I3 at 09:05: the provider supplies audit evidence that an integration token created the link at 08:57 for an export of 800 wholly fictional booking rows; the log does not record downloads. I4: the service owner is unavailable and the backup field is blank. I5 at 09:07: the lead authorizes token revocation and link suspension; the operator reports application at 09:09. I6 at 09:15: a separate approved check shows that the old link now denies access and the revoked token no longer accesses the service, while the permitted booking workflow still works. A colleague proposes deleting the logs because they are sensitive. The exercise then ends; no external notification rule is supplied.
Your tasks
- Apply P1's incident criterion and D1's classifications. Separate evidence of public sharing from an unproved claim that 800 rows were downloaded.
- Build an event timeline with separate source/collection times and known-versus-unknown fields.
- Create a handling record for the alert, audit export and working manager summary; specify permitted access, integrity/provenance and the decision about deletion.
- Produce a decision/escalation log tied to P1, then an after-action record with a strength, observed gap, cause-check, action owner, deadline chosen for the exercise and retest evidence.
- State what may be concluded at 09:09 and 09:15, and what remains unresolved before or after recovery.
3. Compare your reasoning.
Decide and write your explanation first. Where a table is wider than your screen, focus it and use the arrow keys, or scroll it sideways.
Open explained model guidance
Classification and triage: at 09:00 the alert is a report requiring validation. The user's denial adds context but is not conclusive by itself. At 09:05 the audit record supplies credible unauthorized public-sharing evidence for Restricted data, meeting P1's stated criterion; the model recommends that the lead declare and prioritise the incident under P1, recording the 800-row export and business impact. The inject supplies the evidence, not an observed declaration or its time. Record 'public link created; download activity unknown'. The evidence does not justify '800 rows were exfiltrated', 'nobody downloaded it' or attribution to the account user. P1/D1 are local fictional rules, not universal NIST classifications or legal thresholds.
Timeline:
| Event time UTC | Learned/recorded time UTC | Supplied fact, proposed model decision and uncertainty |
|---|---|---|
| 08:57 | 09:05 | Audit record E2 says the integration token created the public link. Whether an external party downloaded data is unknown. |
| 09:00 | 09:00 | Alert E1 reports the link; initially unvalidated. |
| 09:03 | 09:03 | User denial E3 is recorded as a statement, not proof of who acted. |
| 09:05 | 09:05 | I3 supplies audit evidence E2 of the 08:57 link creation. Applying P1 to this evidence is the model's proposed declaration decision, not an additional observed inject. |
| Not supplied for I4 | Not supplied for I4 | I4 states that the service owner is unavailable and the backup field is blank. Record the actual contact-attempt and learning times when available; do not infer 09:05. |
| 09:07 | 09:07 | I5 records the lead authorizing suspension and token revocation. |
| 09:09 | 09:09 | Operator reports changes applied. This records action completion as reported, not independently verified effectiveness. |
| 09:15 | 09:15 | Separately approved check E4 observes old-link denial, revoked-token denial and permitted workflow success. These are scoped results; past download activity remains unknown. |
Keep the original source timezone/time quality in the record even when normalized to UTC; later evidence can change the reconstructed sequence.
Data/evidence handling record:
| Record | Classification and source | Custody/access/working use |
|---|---|---|
| E1 alert, E2 audit export and E3 user statement | Restricted under D1; record source, collector, collection time, original event time and method | Custodian preserves originals with their metadata in the protected evidence location, records receipt/transfers and grants only the named response/privacy roles access. Analyse a working copy and preserve an integrity/provenance record. |
| E4 verification record | Restricted incident evidence; record tester role, approval, exact checks, expected and observed outcomes | Preserve the result and its limited scope with the change/decision reference; protect it like other incident records. |
| M1 management summary | Internal, derived from E1–E4 | Explain impact/uncertainty and decisions, remove row-level booking content and unnecessary identifiers; the original Restricted evidence does not become Internal merely because a copy is made. |
| Proposed log deletion | Requires custodian decision under D1 and preservation procedures | Reject immediate ad hoc deletion. Restrict access to reduce exposure, record the retention/review decision and keep relevant evidence while preservation applies. Privacy sensitivity is a reason for controlled handling, not automatic destruction. |
This is a handling design on paper, not a claim that files were collected, hashed or preserved in an actual incident.
Proposed decision/escalation log: recommended decisions are distinguished from supplied observations. Declaration, owner-contact, privacy-escalation and custody times must be recorded when actually known; they are not new inject facts.
| Time | Decision, authority and reason | Follow-up/unresolved item |
|---|---|---|
| On receiving I3; recommended decision | The model recommends declaration under P1 because the audit evidence supports unauthorized public sharing; the actual declaration time is not supplied | Recommend escalation to the privacy lead to assess obligations/context; no jurisdiction-specific notice deadline or observed escalation is invented |
| When I4 is learned; time not supplied | Record the unavailable owner/blank backup and recommend elevating the contact gap to the incident lead; record actual contact attempts when known | The lead uses the containment authority already granted by P1; a missing contact does not silently grant other staff new powers |
| 09:07 | Lead authorizes operator to suspend the link and revoke the token to limit continuing exposure | Preserve relevant audit records and record availability effects; verify enforcement separately |
| 09:09 | Record operator's reported application; do not close the incident solely on that report | Obtain the approved 09:15 checks |
| 09:15 | Lead and service owner, when reached, may consider P1 recovery approval using checks and preservation evidence | Historical downloads, root cause, broader scope and any reporting obligation remain open investigations; recovery of service and closure of investigation are different decisions |
| Exercise end | Communications lead controls any outward statement under P1 | A draft may state confirmed facts and uncertainty; no notification is sent by this exercise |
After-action/improvement record:
| Observation compared with plan | Analysis and action | Owner/date/effectiveness evidence |
|---|---|---|
| Strength supported by the supplied injects: I5 records the lead's authorized containment decision, and I6 records a separate approved verification after the operator's report; the requester of that check is not specified | Retain the distinction between deployment and checked effect | Incident lead retains E4 and the decision link in the training record |
| Gap: P1 required a backup route, but the supplied plan's backup field was blank when the owner was unreachable | Immediate correction: complete and approve the backup contact. Cause is not yet established; check who maintains the contact list and what changes trigger its review | Plan owner; illustrative deadline: five working days. Before closure, run a newly authorized fictional unreachable-owner inject and record that the correct backup is found and engaged under the plan |
| Gap: E2 lacks download evidence, so the extent of disclosure cannot be settled | Service/privacy owners assess whether suitable access logging and protected retention would answer the needed question; document trade-offs and any accepted visibility limit | Service owner; illustrative review in ten working days. Evidence: approved decision plus a synthetic event showing the chosen logging/handling works, or a clearly documented unresolved limit |
| Exercise-quality feedback | Ask whether the given authority, timestamps and injects let participants make the intended decisions; revise ambiguous material before the next exercise | Facilitator captures feedback separately from response performance |
These are proposed actions with chosen exercise dates, not evidence that improvements have happened. A later check must establish the action's result rather than closing it when an owner is merely assigned.
Original editorial mini-plan, injects and explained model. No publisher-issued exam key, independent learner assessment, legal determination, actual evidence handling, notification, provider contact or operational response is represented.
4. Check the work, not just the score.
- You use the supplied plan and classifications; you do not treat a generic standard's words as the studio's actual approval or disclosure law.
- Your timeline distinguishes the 08:57 source event from the 09:05 collection/learning time and separates statement, action report and observed check.
- You retain the uncertainty about downloads while taking proportionate action on credible public-sharing evidence.
- Raw evidence stays Restricted with provenance and controlled access; the summary is minimized and immediate log deletion is not accepted without the proper decision.
- The after-action table has an evidence-based gap, a cause check, a named role, a review date and an observable later check; participation or a completed action list alone is not proof of capability.
These checks help you revise an explanation. They do not certify mastery or predict an examination result. Ask a qualified reviewer to assess a fresh case when independent feedback is needed.
5. Keep the limits in view.
Free coverage added
- One integrated fictional plan with classification/handling rules, incident criteria, authority, containment and recovery conditions supplied before the injects.
- Reviewed UTC event timeline distinguishing event time from collection time, evidence-access record, decision/escalation log and after-action improvement table.
- Explained handling of an uncertain disclosure, a missing backup contact, a request to delete sensitive evidence and verification before recovery.
Still missing or outside this guide
- The mini-plan teaches connections; it is not a complete organization-specific incident policy, legal notification determination, evidence-acquisition procedure or forensic laboratory.
- No live restoration, provider response, real permission change or operational retest has been performed.
- Publisher discussion guidance and an editorial model do not independently assess learner or organizational incident-response capability.
Payment and access
FREE selected primary readings and the complete integrated tabletop with explained records. A paid exercise facilitator or commercial CC course is not required for this bounded introductory case. Specialist operational training, independent feedback and exam fees are separate decisions.
Open this area in the gap register