Handle Stakeholder Disagreement During an Incident Tabletop

A tabletop exercise often exposes a decision nobody named before. Security seeks fast isolation. Operations protects service continuity. Legal needs an internal review before external notice. A business leader needs a clear outage explanation. Each position reflects a real duty. The exercise has value because competing duties appear in front of people who influence a response.

An MDR consultant sets the frame before scenario discussion begins. Say, “This scenario is fictional. We are testing how your group reaches a decision. Your team owns policy and production choices.” Those words reduce pressure. Participants no longer need to defend a scenario answer as a permanent rule. They describe present expectations and identify places where expectations differ.

Start with one decision rather than every concern raised by a simulated alert. Ask, “Where did our paths divide?” Write the reply in direct language. A group might say, “We disagree over when to isolate a customer facing service after suspected unauthorized access.” Keep this question narrow enough for an owner to answer later. “Improve incident response” leaves no person with a usable assignment.

Ask every participant for the condition behind their view. Security might say, “We need a way to stop further access.” Operations might say, “We need service impact before isolation.” Legal might say, “We need our internal escalation path before public discussion.” Those statements expose different concerns without assigning opponents. Record each concern beside a proposed action rather than guessing motive.

Use a neutral recap after each contribution. Say, “Security focuses on limiting access. Operations focuses on customer service. Legal needs an internal review path. Did I record each view accurately?” Pause for corrections. A participant might change “customer service” into “contractual service commitment.” This correction affects later preparation.

Avoid offering a preferred response action. A quick answer feels efficient, yet such an answer shifts authority away from customer leaders. Ask who owns the disputed choice instead. Authority often differs from meeting attendance. An operations manager might describe outage consequences, while a senior service owner approves interruption. A legal participant might explain an internal process, while another leader owns final communication approval.

Consider a fictional online retailer. At 10:00 on a Tuesday, a simulated alert shows unusual activity on an account used by a checkout service. The security lead says, “I want isolation within fifteen minutes.” The operations lead replies, “Tuesday morning traffic is heavy. Removing checkout without an impact view creates a separate problem.” The consultant does not ask either person to yield. They ask, “Who owns a decision to interrupt checkout, and which information does this person expect before deciding?”

The group names a service owner who is absent from the room. Operations says this owner needs a short account of affected service, observed activity, current customer impact, and response options. Security explains evidence available at the fifteen minute point. Legal asks for an internal contact path if a notice question arises. The consultant starts a decision record with four fields: decision question, responsible owner, information needed, and contact path. This record describes a planning gap rather than a response order.

Keep scenario work fictional. Do not treat a tabletop observation as proof of an active event. Do not label an account compromised when scenario facts are incomplete. If someone introduces real confidential detail, redirect with care. Say, “Let us keep this example general and record a private follow up for your team.” The purpose is a workable discussion process, not an investigation during a meeting.

Evidence requests need precision. “More data” gives a team no clear preparation task. Ask a decision owner which fact would change their choice. One owner might request confirmation of affected service. Another might need a statement from an application contact. A third might require a record of attempted access times. Record each request, known source, and expected provider. Leave an unknown source as a question for the customer team.

Separate a decision from a communication. A group might agree on who chooses a service change yet lack a path for informing leadership. Ask, “Who needs awareness, who needs approval, and who speaks first?” A title alone seldom answers those questions. In the fictional retailer scenario, a service owner approves a proposed service action, an operations lead contacts an executive duty lead, and legal receives an internal message only when a notice discussion starts. Customer leaders verify each path outside the exercise.

Disagreement sometimes sounds personal. One participant says, “Operations always slows us down.” Another says, “Security ignores business cost.” Bring discussion back to a decision. Say, “I hear frustration from both sides. For this scenario, which fact or approval would allow the responsible owner to decide?” This response does not erase friction. This response gives the meeting a question whose answer supports future work.

Check whether an apparent dispute hides two separate decisions. Security might seek agreement on temporary account access, while operations seeks agreement on a service interruption. Treating both as one question creates a confused record. Ask each speaker to state the exact action under discussion. Then ask whether one action depends on another. Separate records help different owners respond without waiting for a meeting wide consensus.

An owner also needs a practical route for receiving a question. “Escalate to leadership” is incomplete. Record the named role supplied by the customer, a primary contact path, an alternate path if relevant, and a time for review. Do not invent an on call practice or assume a distribution list exists. When an ownership route is unknown, place “customer to confirm contact path” in the record. Honest gaps make later work visible.

Use a visible board or shared document during discussion. Read each entry aloud before moving forward. A security participant might hear “isolate checkout” and correct this to “suspend a single account.” An operations participant might point out this account supports several services. Those corrections are useful. They show where a broad phrase hides a material difference in scope.

End a disputed point with a dated action. Avoid a vague promise to revisit policy. Record who will bring the question to an owner, which evidence they will gather, and when they will return with an answer. A fictional entry might read, “Service owner reviews checkout isolation language with security and operations by Friday at 16:00, then sends an approved decision path to exercise participants.” The customer owner selects final wording and timing.

For practice, ask two peers to play security and operations in a fictional scenario. Give security a concern about ongoing access. Give operations a concern about service interruption. Your role is neutral. State a recap, ask for the owner of each disputed decision, then write one question for each owner. Read both questions aloud. If either peer hears an implied result, remove words pointing toward a preferred answer.

Continue with a blank decision record. Ask security for one fact an owner needs. Ask operations for one impact detail. Ask both peers how a question reaches the owner. Write short answers in the four fields. Set a fictional return meeting for Thursday at 14:00. Before the exercise closes, hand your completed record to the peer playing service owner and ask for the first unanswered question they would send back.