Abstract
Effective incident response in critical infrastructure depends heavily on adequate preparedness, shared situational awareness, and clearly communicated roles and responsibilities. However, organizations continue to struggle with developing a shared understanding of incident response procedures across units. Graphical representations, such as diagrams, have been proposed to improve comprehension of incident response plans (IRPs). Yet, few works have examined how diagram-based IRPs could support learning during preparedness exercises prior to a security incident. This paper investigates how diagram-based IRPs can aid stakeholders’ understanding, decision-making, and
preparedness. We report findings from an exploratory mixed-method study comprising: (1) a focus group with security researchers and industry practitioners (N = 12) exploring perceived benefits and use cases of diagram-based IRPs, and (2) an exploratory learning experiment with security students (N = 88), motivated by the focus group findings, assessing how diagram-based IRPs can be used to teach novices about a complex incident response process. The results suggest that diagram-based IRPs may be less suitable as rigid operational guides during active incidents in critical infrastructures. However, they show strong potential to foster a shared understanding of incident response processes, including for novices, during preparedness activities and post-incident reflection.