# Module 2 Overview

## Theme

Playbooks and decision trees

## Essential Question

How do procedures become executable response logic?

## Module Components

- `Book prose`: conceptual framing, domain scenario, methods, and failure modes
- `Assignment`: evidence-backed production of a specific artifact
- `Slides`: presentation sequence for seminar or lecture delivery
- `Narration`: spoken version of the slide flow
- `Instructor notes`: facilitation plan, discussion prompts, and grading cues
- `Rubric`: criteria for evaluating the module artifact
- `Notebook`: executable lab aligned with the module theme using synthetic incident records with severity, confidence, blast radius, containment option, and approval outcome

## Module Artifact

automated response playbook with approval gates, rollback plan, and post-incident learning loop focused on playbooks and decision trees: Draft an automated response playbook.

## Professional Setting

Students work as if advising an incident response team deciding which containment actions can be automated safely. Their work must be intelligible to incident commander, security engineer, legal/compliance reviewer, and affected service owner.