You do not have to shut down the company to find out whether an incident plan makes sense. Sit the right people around a table, describe a realistic problem, and ask what they would do. The answers usually become more useful when somebody asks, “How would we actually do that?”
A cybersecurity tabletop exercise is a discussion of a scenario and the decisions it creates. It can help test roles, contact routes, assumptions, and communication. It is not a penetration test or proof that every technical control works. Its value comes from finding gaps you can fix before an actual incident makes the decisions urgent.
Choose a problem your team can picture
Start with a mailbox takeover, an unavailable business application, or a suspicious payment change. Describe enough context to support decisions without building an elaborate story. Use a hypothetical scenario and make clear that no real incident is happening. The exercise should create a useful conversation, not alarm employees.
CISA provides tabletop exercise packages that can help structure discussions. Adapt the material to your business, the systems involved, and the decisions participants can make. A realistic hour of discussion can be more useful than a complicated exercise that avoids the uncomfortable questions.
Source: CISA Tabletop Exercise Packages
Include the people who make the decisions
IT needs to participate, but it cannot answer every business question. Invite the person who can authorize an interruption, someone who understands customer communications, and the staff responsible for any payment or operational process in the scenario. Include an alternate contact when one person normally holds all the knowledge.
- Who receives the first report, and how do they verify what is known?
- Who can approve containment that affects normal work?
- How will the team communicate if company email is unavailable?
- Who contacts the bank, insurer, or appropriate adviser when needed?
- Which customers or partners might need an approved update?
- What information is missing before the next decision can be made?
Let the uncertainty do useful work
If someone says they would call a provider, ask where the number is stored. If the answer is “in the mailbox we cannot access,” record the gap. If two people each expect the other to approve a customer message, settle the responsibility. Do not rescue every awkward pause by giving participants information they would not have in real life.
Keep the tone constructive. An exercise is not a test of who is clever enough to solve the scenario. It is a chance to check whether the company has given people the authority, information, and support needed to act. That distinction makes it easier for someone to admit they do not know.
Finish with changes people can own
Record a short action list with responsible people and review dates. Update contacts, clarify approvals, or arrange a technical recovery test where the discussion revealed an assumption. A tabletop can show that you need a restore test; it cannot replace performing one.
RIKR can help bring the technical context into the conversation and connect the findings to support, protection, and recovery work. We would rather work through a confusing decision with a cup of coffee than discover the same uncertainty during an urgent call.
Related: what belongs in an incident response plan
Related: backup versus disaster recovery
Explore RIKR managed cybersecurity
Written by Joshua Price
Back to the blog