A transit agency’s IR plan looks complete on paper, but leadership worries the team has never practiced it. Which activity best keeps the IR capability ready?

Incident response capability is proven by rehearsal, not by the thickness of a binder. Tabletop exercises walk decision-makers through a realistic transit scenario—loss of fare systems, ransomware on scheduling, or a compromised vendor link—so participants practice role assignment, escalation, containment choices, and public messaging without touching production. Technical simulations and purple-team style drills go further by exercising detection tooling, isolation procedures, and recovery steps. Together they reveal gaps in contacts, privileges, and playbook clarity while muscle memory is still cheap to build. For a transit agency, readiness means operators, IT, OT-adjacent staff, legal, and communications have already practiced who speaks and who isolates.

Vendor marketing webinars may raise awareness but do not rehearse the agency’s own roles, architectures, or decision rights. Disabling monitoring during drills to avoid false positives trains the team to operate blind and fails to validate detection. Annual policy reviews without scenario walkthroughs refresh paperwork without testing execution under time pressure. Exam caveat: when a stem contrasts a complete-looking plan with lack of practice, the answer is exercises and simulations—not more unread documentation. Operationally, put tabletops on a recurring calendar, include after-action findings in IR plan revisions, rotate facilitators, and track whether the transit IR team can name the commander, isolate a critical segment, and draft an approved public statement within the exercise timeline.