Most organisations have some form of incident response plan. Far fewer have tested it. The first time many teams discover that a plan doesn't work is in the middle of a real incident, which is the most expensive time to find out.
What is a tabletop exercise?
A tabletop exercise is a facilitated discussion in which your team works through a realistic cyber incident scenario, step by step. There is no live system testing and no risk to operations: just a safe space to make decisions, spot gaps and build confidence.
What you learn
- Who decides what. Who can authorise taking systems offline, engaging lawyers or contacting regulators?
- Whether contacts work. Do you have out-of-hours numbers for your IT provider, insurer and key suppliers?
- How you communicate. What do you tell staff, customers and the media, and when?
- What you're obliged to do. For example, UK GDPR requires notifying the ICO of qualifying personal data breaches within 72 hours of becoming aware of them.
What good looks like
An effective exercise is tailored to your organisation, involves the right people (including executives), and is run by a neutral facilitator who keeps the session realistic but constructive. It should end with a short report of strengths, gaps and practical actions.
How often?
At least once a year, and after any significant change such as a new plan, a new leadership team or a major system migration. Many cyber insurers and auditors now expect evidence of testing.
Where to start
If you don't have a plan yet, start with incident response planning. If you do, a tabletop exercise is the best way to prove it works.