How to Run a 60-Minute Incident-Response Exercise

Accept the tradeoff up front

A 60-minute exercise can't cover the same ground as a two-hour one, and trying to force it usually means rushing through injects without real discussion — which defeats the purpose. Instead, narrow your goal: pick one or two specific things you want to practice (e.g. "can we escalate and assemble the right people in under 10 minutes?") rather than trying to exercise an entire incident lifecycle.

Budget your minutes before you start

• 5 minutes — framing and ground rules (no-blame, this is a learning exercise).
• 5 minutes — initial briefing.
• 35-40 minutes — five to six injects with discussion.
• 10-15 minutes — debrief and action items.

Write this budget down and actually watch the clock — in a short exercise, one long tangent can eat the time meant for the debrief, which is where a lot of the real value lives.

Pick fewer, sharper injects

Six injects is plenty for 60 minutes — five to six minutes of discussion each, plus the time to read and absorb the update. Each inject should force exactly one clear decision. If an inject needs three sub-questions to work through, it's really two injects trying to fit into one.

Pre-brief participants harder than usual

Because you don't have time to explain things mid-exercise, send participants their role description and the exercise format at least two days ahead. In the room, spend less time re-explaining context and more time actually discussing decisions.

Facilitate more actively

In a longer exercise, you can let discussion breathe. In 60 minutes, the facilitator needs to move things along more deliberately: ask directly "what's the decision here, and who's making it?" rather than waiting for the group to arrive there organically. This isn't about cutting discussion short — it's about keeping it focused on decisions rather than open-ended speculation.

Don't skip the debrief

It's tempting to let discussion run long and squeeze the debrief, but a 60-minute exercise with no debrief is really just a discussion, not an exercise with a payoff. Protect at least 10 minutes: what worked, what didn't, and one concrete action item with an owner. That one item is often the entire return on the hour you spent.

Use short exercises as a cadence, not a substitute

A 60-minute exercise every quarter, run consistently, tends to build more organizational muscle memory than one long exercise a year. Short and frequent beats long and rare for building the habit of structured incident response.