Note
Draft. Not yet reviewed.
Purpose. The generic process, independent of scenario. Read this once before your first exercise and skim it before every one after, because the failure modes at the bottom never retire.
Pick the scenario and read the whole pack, facilitator guide last page first, so you know where it is supposed to land. Then rewrite it for your world: real system names, real vendor names, real people's titles. This is the step that separates an exercise from a webinar, and it takes two hours, not two days. Book the room and invite by name from the roles file, sponsor first, because the calendar fight is half the project.
Send the participant brief, only the brief, and resist every request for more detail with the same sentence: you will know what the characters know when they knew it. Confirm the exec sponsor is still coming, in person, because the day they skip it is the day everyone learns this was optional. Appoint a scribe who is not playing, brief them on what to capture: decisions, times, and who people looked at when nobody answered.
Start on time, phones down, no laptops except the scribe. Read the opening situation out loud, then stop talking and let the silence do its work. Run injects on the clock, not when the conversation gets comfortable, pressure is the product. You are the facilitator, not the teacher: ask what do you do next, never here is what you should do. And keep one eye on the quiet people, because the person who has said nothing for forty minutes is usually sitting on the finding of the day.
Write the after-action while the room is still fresh in your head, using the template in each pack. Every gap gets an owner and a date or it is a memory, not a finding. Send it to everyone who attended plus the one person who should have, and put the follow-up review on the calendar before the document goes out, because an exercise with no follow-up is theater with snacks.
Don't let it turn technical: the second two engineers start debugging the hypothetical EDR, pull them back with "assume that takes four hours, what do you do in the meantime?" Silence is data: if nobody knows who declares an incident, that is the finding, do not rescue them. Watch for the confident wrong answer, "legal would handle that" with legal not in the room and never asked, and write it down verbatim. Nobody is supposed to pass: if the team sails through, the scenario was too easy, and the optional escalation injects exist for exactly this moment.
The rabbit hole: forty-five minutes on one technical question, killed by time-boxing out loud. Scenario lawyering: "that would never happen here" answered once with "grant me the premise" and after that with the next inject. The hero facilitator who keeps rescuing the room from its own silences, which converts findings into feelings. The exec who answers everything, handled by asking the person to their left "and if they were on a plane?" The unappointed scribe, discovered at write-up time when nobody remembers who decided what. And the afterglow with no consequences, the good meeting that changed nothing, which the 48-hour rule and the owner-and-date rule exist to kill.
Owner: name a person Last Reviewed: not yet Review Cycle: annual