Rehearse incident response and assemble the hardening dossier

Verifiedon 2026-07-302026.7.1

Capstone scenario

A disposable service credential may have appeared in an untrusted-content test, and a new plugin was enabled shortly before the discovery. Run a tabletop first; execute only the revocation portion in a sandbox with disposable credentials. Your goal is a credible response, not theatrical speed.

One-page incident runbook

Define: trigger; incident lead; containment authority; safe stop conditions; evidence custodian; credential revocation/rotation order; plugin/skill disable path; communication owner; recovery criteria; and post-incident review date. Preserve timestamps and minimal redacted evidence. Do not copy secrets into a ticket or lesson submission.

Dossier deliverable

Submit:

1. The deployment threat model and prioritized threats.
2. A least-privilege matrix and tool/network allowlist.
3. Redacted evidence for two tested controls, including the adversarial boundary pack.
4. The reproducible audit record and its source revision.
5. The incident runbook, rehearsal timeline, recovery verification, and residual risks.

Rubric

• Realistic, deployment-specific threats — 25%
• Effective and scoped controls — 30%
• Test evidence and reproducibility — 25%
• Honest residual-risk statement and workable recovery plan — 20%

A dossier fails if it contains a secret, claims a control was tested when it was not, or lacks an accountable owner.

Final check

Before sign-off, ask a reviewer to pick one control at random. They must be able to identify its purpose, authority boundary, test evidence, owner, rollback, and next review date. If they cannot, the hardening work is incomplete.

Check your understanding