Free security exercise template
RMM incident response tabletop exercise
A vendor-neutral exercise planner for testing the decisions an MSP or IT team may face during suspected RMM account, automation, remote-access, integration, or endpoint compromise—without turning the tabletop into an unapproved production test.
What the exercise tests
Independent command
Coordinate when the RMM console or normal collaboration channel is assumed unavailable or untrusted.
Scope and evidence
Reconcile tenants, endpoints, identities, integrations, automations, timestamps, missing logs, and explicitly tracked unknowns.
Containment decisions
Balance immediate risk, critical service dependencies, reversible actions, authorization, and preserved evidence.
Recovery and closure
Restore in bounded waves, reconcile inventory, keep corrective actions visible, and schedule evidence-backed retesting.
How to run it safely
- Name the exercise sponsor, facilitator, observers, technical leads, business owners, and stop authority.
- Define participating tenants and systems, out-of-scope boundaries, assumptions, and production-safety stop conditions.
- Use the injects in sequence or select only those that match the exercise objectives. Keep all production actions simulated unless separately approved.
- Timebox each decision and require participants to name authority, evidence, customer impact, rollback, and the next update.
- Score observable outcomes against the CSV pass criteria. Assign every gap an owner, due date, closure evidence, and retest date.
This template is an operational exercise aid. It is not legal advice, forensic guidance, a compliance certification, or authorization to access or change production systems.
Minimum exercise record
Preserve the approved scope, participant roster, assumptions, injects used, decisions, decision authority, timestamps, evidence references, communication outputs, pass or fail rationale, unresolved gaps, owners, due dates, and retest results. Keep secrets, customer data, restricted reports, and sensitive exports in approved evidence storage; record only authorized references in the worksheet.
Tabletop exercise FAQ
What should the exercise test?
Test independent command channels, privileged identity decisions, tenant and endpoint scope, automation containment, evidence preservation, customer communications, staged recovery, inventory reconciliation, corrective-action ownership, and retesting.
Should participants make production changes?
No. Keep the exercise simulated unless a separately approved and bounded technical test exists. Define stop conditions before the exercise and prevent participants from improvising production actions.
How should the exercise be scored?
Score each objective against observable evidence and explicit pass criteria. Record gaps, owners, due dates, and retest requirements instead of passing the exercise by consensus alone.
Relationship disclosure
This template is maintained by the Nizlo team. Nizlo is a Windows-first RMM and IT-management platform for MSPs and IT teams. The exercise is deliberately vendor-neutral and does not claim that Nizlo or any other vendor satisfies these controls.