Session Coordinator Brief

Note

This document is for the company-side coordinator, not the facilitator. If you are running the session, see the Large Group Session Preparation and Execution Guide instead.

This brief covers everything you need to do before and on the day of the session. The facilitator handles all scenario content, printed materials, and facilitation. Your job is logistics.

What This Session Is

A tabletop incident response exercise for 12-15 participants. Teams investigate a simulated cyberattack using printed evidence cards, then brief an Incident Commander who synthesizes findings across teams and makes decisions under pressure. The session closes with a structured group debrief on coordination, communication, and decision-making.

Total duration: approximately 3.5-4 hours including room setup, session, and debrief.

Your Responsibilities vs. the Facilitator’s

Your responsibility	Facilitator’s responsibility
Book the room	All printed scenario materials
Arrange tables as specified	Facilitation and scenario delivery
Provide whiteboard or flip chart	Team and role briefings
Pre-assign IC and team leads (optional)	Timing and round management
Sticky notes and pens at each table	Post-session debrief

Room Requirements

Capacity for 12-15 people with 3 separate work tables
Tables arranged in a triangle or U-shape (not a boardroom row or single long table)
Enough space between tables that teams cannot easily see each other’s materials
1 whiteboard or flip chart accessible from the centre of the room
Whiteboard markers – at least 2, different colours if possible
A projector or large screen is optional but useful; the facilitator can use it to display the opening narrative
No other AV required

Room Layout

%%{init: {
  "theme": "base",
  "themeVariables": {
    "primaryColor": "#f8f9fa",
    "primaryTextColor": "#2c3e50",
    "primaryBorderColor": "#dee2e6",
    "lineColor": "#2c3e50",
    "fontFamily": "\"Source Sans Pro\", sans-serif",
    "fontSize": "15px"
  }
}}%%
graph TB
    WB["WHITEBOARD"]
    A["ALPHA TABLE"]
    B["BRAVO TABLE"]
    IC(["IC POSITION"])
    C["CHARLIE TABLE"]

    WB --- A & B
    A & B --- IC
    IC --- C

    classDef wb      fill:#0033FF,stroke:#0033FF,color:#ffffff,font-weight:bold
    classDef alpha   fill:#dbeafe,stroke:#0d6efd,color:#1e3a5f,font-weight:bold
    classDef bravo   fill:#fef3c7,stroke:#d97706,color:#713f12,font-weight:bold
    classDef charlie fill:#dcfce7,stroke:#198754,color:#14532d,font-weight:bold
    classDef ic      fill:#2c3e50,stroke:#2c3e50,color:#ffffff,font-weight:bold

    class WB wb
    class A alpha
    class B bravo
    class C charlie
    class IC ic

The triangle layout is deliberate. Each team holds a different slice of the evidence, and the exercise depends on teams not being able to compare notes during the investigation phase. The Incident Commander position at the gap reinforces their role: they must physically move between teams to collect information, then synthesize it without knowing which thread is primary.

If the room does not allow a triangle, a U-shape with the IC at the open end works. A straight-line arrangement (all teams in a row) does not – teams on opposite ends will communicate directly and bypass the IC synthesis moment.

Roles to Designate

Incident Commander (1 person): Who takes the IC role is a deliberate choice that depends on what the organisation wants to learn. Discuss this with the facilitator before the session.

Giving the IC role to the person who actually leads incidents in real life produces the most realistic test – it surfaces how they perform under information pressure and whether their synthesis instincts hold when inputs arrive from three directions simultaneously. It is the right choice when the goal is to stress-test real decision-making.

Giving the IC role to someone outside that function – a senior analyst, a business-side participant, a network engineer – forces synthesis from someone without the reflexive domain knowledge. It develops empathy for the coordination role and often surfaces assumptions that the usual IC holds without realising it. It is the right choice when the goal is broader team development rather than leadership assessment.

Neither approach is wrong. The facilitator will brief whoever takes the IC role before the session starts.

Team Leads (3 people, one per team): Can be pre-assigned or self-select on the day. No special preparation needed. The facilitator will brief all team leads at the start of the session. The same natural-role vs. cross-function logic applies here as for team assignment generally – see below.

All other participants: No advance preparation required. They will be briefed on arrival.

Your own role: If you have been involved in scenario planning, you may already know elements participants will be discovering. In that case, consider taking a Non-Player Character (NPC) role – the facilitator will give you a character and a few lines to deliver during the exercise. If you have not seen the scenario content, there is no reason not to participate as a full team member. Discuss with the facilitator before the session.

A note on team assignment

Participants do not need to be assigned to teams that match their real-world function – but they can be. Both approaches are valid.

Assigning people to their natural role (network engineers on Bravo, business stakeholders on Charlie) makes the exercise feel immediately relevant and produces the most realistic simulation of how the organisation actually responds. It surfaces real coordination gaps between functions that exist in daily work.

Assigning people outside their usual function – a business manager on the forensics team, a security analyst on business impact – creates a different kind of learning. Participants develop empathy for adjacent roles, and the exercise surfaces assumptions people hold about what other functions actually do under pressure.

Discuss this choice with the facilitator before the session.

What to Have Ready on the Day

Before participants arrive:

Tables arranged per diagram above
Whiteboard markers at the whiteboard (at least 2 colours)
Sticky notes (A5 or larger preferred) and pens at each table

The facilitator brings everything else: printed artifact cards, evidence envelopes, IC materials, tent cards, reference cards, and timing tools.

Summary

Task	When
Book the room	As early as possible
Confirm triangle or U-shape layout is possible	When booking
Pre-assign IC (optional)	1 week before
Confirm room is set up per diagram	Day of, before participants arrive
Whiteboard markers and sticky notes at tables	Day of, before participants arrive