# Role-Based Incident Response Training for Executives and Incident Commanders (2026)

> What executives and incident commanders each need to practise in incident response, and the training options compared: tabletops, branching simulations, SANS LDR553, PagerDuty’s open incident commander guides, Immersive Labs Crisis Sim and PlayCISO’s War Room.

Source: https://playciso.com/blog/role-based-incident-response-training-executives-incident-commanders · Published: 2026-10-29 · Publisher: PlayCISO (https://playciso.com)

---

Most incident response training is built for the person at the keyboard. That leaves out the people whose decisions decide how bad an incident becomes: the executive who can authorise a shutdown, the lawyer who decides when the notification clock started, the communications lead who writes the first public sentence, and the incident commander who holds it all together. This guide covers what each role needs to practise and which training options fit. ## What should each role practise? RoleDecisions to practiseBest format CEO / executive sponsorShutting down revenue systems, pay or not pay, accepting risk on early restore, disclosureTabletop, branching simulation General counselWhen the organisation “became aware”, privilege, regulator and law enforcement contact, contractsTabletop with notification clocks CommunicationsHolding statement, staff message, media, consistency with filingsTabletop, press simulation CFOCyber insurance notice, emergency spend, payment runs, materialityTabletop CISOBriefing the board, recommending options, bridging technical and business tracksSimulation, tabletop, board report practice Incident commanderSeverity, task assignment, update rhythm, handover, escalationFunctional exercise, simulation, shadowing ## What does good executive IR training look like? Four features matter. **Real authority:** the person who would make the decision for real makes it in the exercise, and their deputy plays if they are absent. **Time pressure:** injects arrive on a clock, including notification deadlines such as GDPR’s 72 hours to the supervisory authority or the SEC’s four business days after a materiality decision. **Consequences:** a delayed decision should make the next inject worse. **A score and a debrief:** otherwise the session is a conversation. Keep the technical detail out of the executive room. The incident commander briefs leadership in a fixed format (what we know, what we believe, what we do not know, what we need you to decide) and leadership decides. Practising that briefing is itself an objective. ## What does an incident commander need that executives do not? The incident commander runs the response, not the keyboard. Skills to practise: - Setting severity fast and re-setting it when facts change. The Severity & Playbook Router gives a SEV1 to SEV4 level and the playbooks to open. - Assigning roles: a deputy, a scribe, subject-matter experts and liaisons, so the commander is not doing the work. - Holding an update rhythm: fixed-time briefings to leadership and the team. - Ordering the response: evidence before wiping, credentials rotated before restore. The IR Playbook Lab scores exactly this. - Handover: long incidents cross shifts. Rehearse a spoken handover of status, open decisions, next actions and running clocks. PagerDuty publishes its incident response documentation publicly at response.pagerduty.com, including training guides for the incident commander, deputy, scribe, subject-matter expert and customer and internal liaison roles. It is written for operational outages but transfers well to security incidents. ## Which training options fit executives and incident commanders? OptionBest forWhyMain drawbackPrice (as of October 2026) Facilitated tabletop from a runbookThe real leadership team togetherTests your own people, plan and authorityA few times a year at most; needs a good facilitatorFree with the [runbook generator](/tools/tabletop-runbook-generator) or CISA CTEPs; consultants extra PlayCISO War RoomCISOs, aspiring CISOs, executives and incident leads practising alone or as a teamBranching incidents with regulator, board and press decisions; modes of about 45 or 90 minutes or a full career; scoredFictional companies, not your organisation; no live-fire technical rangeOne full run free with an account; Pro $5/month or $40/year SANS LDR553 Cyber Incident ManagementIncident leaders and commandersFive-day course on the non-technical side of leading an incident: team, objectives, briefings, communications. Leads to GIAC GCILCost and time; aimed at people with hands-on experienceSANS course pricing; check sans.org for current rates PagerDuty incident response guidesNew incident commandersClear role definitions and training materialReading, not practice; operations-focusedFree Immersive Labs Crisis SimEnterprise executive and crisis teamsBrowser-based crisis exercises with scored decisions, run single-player or as a group; pairs with its technical Team SimEnterprise productQuote-based Honest note: PlayCISO is a newer, smaller platform than the enterprise vendors, and its certificate of completion is not an industry certification. Its strength is executive-layer decisions you can practise any time for a few dollars a month. ## Which PlayCISO exercises map to each role? - CEO and executive team: War Room (Quarterly Cycle, about 45 minutes, three crises in the CISO seat), and the Ransom Decision Lab for the pay or not-pay board call. - General counsel and privacy: the Customer Database Breach Lab with GDPR and US state notification clocks, and the Breach Notification Clock Calculator. - Communications: the Crisis Comms Lab and Podium, a press-conference simulation after a breach. - CISO: the War Room CISO Sprint (about 90 minutes) and the Vendor-Breach Board Response Lab. - Incident commander: the Cascade Incident Lab, the IR Playbook Lab and the Virtual SOC. - The facilitator: the Tabletop Facilitation Lab. ## How do you build a role-based programme? - Write a RACI for the response so each role’s decisions are explicit. The RACI & On-Call Roster Builder covers 13 activities across 8 roles. - Give each role one short simulation per quarter in its own lane. - Run one executive tabletop and one technical exercise per half-year. - Run one mixed exercise a year that tests the incident commander’s briefing to leadership. - Track results with the incident response lead KPIs. ## How do you run a 90-minute executive tabletop? A tested agenda for a leadership team: - 0–10 minutes: objectives, rules of play (no-fault, play your real role, the facilitator may pause the room), and the opening situation read aloud. - 10–25 minutes: first report and severity. The incident commander gives a two-minute briefing; leadership asks what it needs to know. - 25–50 minutes: the hard decisions. Inject the trade-off that only executives can make: shut down a revenue system, pay or not pay, accept early restore. - 50–65 minutes: communications and notification. Inject a regulator, a journalist or a major customer. Legal records the “aware” time. - 65–75 minutes: recovery pressure and a curveball, such as the incident commander handing over to a deputy. - 75–90 minutes: hot wash. What worked, what did not, three actions with owners and dates. The [Tabletop Runbook Generator](/tools/tabletop-runbook-generator) builds this timeline for an “Executives” audience, with injects at minute marks and an executive scoring rubric (decision authority, use of the plan, notification, communications, continuity, documentation). Score the hand-off from the incident commander as its own objective in a mixed session. ## Checklist: role-based IR training - Every major decision has a named owner and a deputy - Executives practise in their real roles, not as observers - Incident commanders practise briefing, handover and update rhythm - Notification clocks are part of every executive scenario - Each exercise ends in owned, dated actions ## Frequently asked questions ### What is role-based IR training for executives? Training that puts each executive in their real role during a simulated incident, focused on authority, timing and communication rather than technical steps, usually as a tabletop or branching simulation. ### What is the top training for incident commanders? SANS LDR553 for a formal course (GIAC GCIL), PagerDuty’s free incident commander guides for role definitions, and regular practice in tabletops and simulations such as the War Room and IR Playbook Lab. ### How long should an executive incident response exercise be? Sixty to 120 minutes, limited to the decisions only executives can make. ### Should executives and the technical team train together? Separately for role skills, and together at least once a year to test the hand-off between them.