Organizations must assess what staff members will benefit most from the exercise and what potential roles they would play if a real event were to occur. You will want to include anyone who could be impacted or might play a role during the incident scenarios. Some questions to ask when you are building out your invite list:
- When a suspected incident occurs, who is notified first? (Help desk, IT Support, etc.?)
- Who should be contacted immediately?
- Who is responsible for handling the situation?
- Who would need to know if an incident had occurred? (Executives, HR, Legal, Communications)
- What if those individuals are not available or are out of the office, who is their backup?
- Who will handle communications if this incident needs to be shared publicly?
- If outside agencies are involved, who would manage that?
