{"id":"sec-mgr-tabletop-debrief-actions","audience":"managers","category":"security","track":"security","technique":"format","title":"Turn tabletop exercise notes into owned action items","free":false,"task":"Turn yesterday's tabletop exercise notes into the follow-up list. Write exactly 4 numbered action items like '1. action - Owner: name - Due: date', using only owners and dates from the notes. Skip anything already fixed during the session and ideas the group turned down. Plain text, under 90 words.","materialLabel":"Tabletop notes (attached to your prompt automatically)","material":"Tabletop debrief notes - ransomware scenario, Nov 5, 2026 (facilitator: Jo)\n\nWhat went well: people knew to disconnect the infected laptop; the comms lead had a holding statement ready.\n\nGaps found:\n- Nobody knew who can approve shutting down the file server after hours. Decision: Marisol (IT manager) will write a one-page decision list by Nov 21.\n- The cyber insurance phone number in the plan was out of date. Ben fixed it in the plan during the session.\n- The backup restore has never been timed. Decision: Kwame will run a timed restore test of the file server by Dec 5.\n- Staff didn't know where to report a suspicious screen. Decision: Jo will add the help desk number to the laptop login screen by Nov 28.\n- Legal contact list only had one name. Decision: Hana will add a backup legal contact by Nov 14.\n\nIdeas discussed:\n- Buy a second backup product. Group decided no: cost too high for now.\n- Run the next tabletop in March. Jo to schedule later, no date set.\n\nSnacks were great, thanks Ben.","rules":[{"type":"numberedItems","count":4},{"type":"plainText"},{"type":"maxWords","max":90}],"mistakes":[{"title":"Including what's done","why":"The AI lists every gap, including the insurance number Ben already fixed.","fix":"Say: \"Skip anything fixed during the session.\"","checks":["r1"]},{"title":"Turning ideas into tasks","why":"The AI adds 'evaluate a second backup product', which the group rejected.","fix":"Add: \"Skip ideas the group turned down or didn't date.\"","checks":["r1"]},{"title":"No owner or date","why":"The AI writes 'improve restore testing' with nobody on the hook.","fix":"Show the shape: \"action - Owner: name - Due: date.\"","checks":["r0","r2"]},{"title":"A full debrief report","why":"The AI writes sections for what went well, gaps and next steps.","fix":"Be exact: \"Exactly 4 numbered action items, nothing else.\"","checks":["numberedItems","maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the follow-up email they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Asks for owners and dates","patterns":["owner","due","date"]},{"label":"Skips done and rejected items","patterns":["skip","already (fixed|done)","turned down","rejected"]},{"label":"Says exactly how many","patterns":["\\b4\\b.{0,25}(action|item|line)","exactly (4|four)"]},{"label":"Keeps it to the material","patterns":["only (use )?(the )?(facts|what|info|details)","don'?t (invent|make up|guess|add)","not in the","stick to","nothing (else|extra|outside)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"A debrief is only useful if each gap has a person and a date. Ask for that shape, and tell the AI what doesn't belong on the list.","rubricLabels":["The 4 items are: Marisol's after-hours decision list (Nov 21), Kwame's timed restore test (Dec 5), Jo's help desk number on the login screen (Nov 28), and Hana's backup legal contact (Nov 14)","Does not include the insurance number (already fixed), the second backup product (turned down), or the March tabletop (no date)","Every item follows 'action - Owner: name - Due: date'"]}