domains / families / security / performing-soc-tabletop-exercise

performing-soc-tabletop-exercise

separate

'Performs tabletop exercises for SOC teams simulating security incidents

When to use

• Annual or semi-annual incident response testing is required (NIST, ISO 27001, PCI DSS compliance)
• New SOC analysts need exposure to major incident scenarios in a controlled environment
• Updated playbooks need validation before next real incident
• Cross-functional coordination (SOC, IT, Legal, PR, Executive) needs rehearsal
• Post-incident reviews reveal gaps requiring scenario-based training

When not to use

• Technical purple team exercises
• Testing technical detection capabilities

Skill page

Source