REHEARSAL.

6 incident scenarios × 5 phases × 3 choices each. 4 scenarios surface a runbook gap the team didn't know existed. 1 scenario reveals an unresolved ownership question between teams.

You don't pick when the breach happens. You pick whether you've rehearsed.

TT-004 · ransomware in primary DB GAP FOUND

No runbook for cross-region ransomware recovery. Team paused 14m.

Author runbook, drill 2x quarterly, validate cross-region restore.