Tabletop Exercise Toolkit — Guide

Cyber Incident Exercises & Tabletop Scenario Library

Most incident exercises rehearse a script. Everyone reads their part, the plan is declared fit, and nobody learns that the out-of-hours alert goes to the wrong desk until it does so at 6 a.m. This pack runs exercises that test decisions instead: who decides, how fast, on what facts, and whether the decision would survive a legal clock or the board’s questions the next day.

Is this for you?

This pack is for you if:

• your incident response plan has not been exercised in the last twelve months;
• your last exercise ended with “went well” and no owned actions;
• your board has never discussed what it would do if asked to pay a ransom.

Who needs an exercise, and how often

Different people fail in different ways, so each audience has its own interval. A live incident teaches a lot, but it never counts as an exercise.

Every objective names a decision, the person who must take it and the rule it comes from. Each is rated Met, Partly met, Not met or Not tested, on the same scale every year, so you can see whether you are getting better.

How it runs in practice

Take a distributor with 900 staff. In March its crisis team ran a three-hour ransomware tabletop, with the internal audit manager as independent observer. Two of six objectives were met, three partly met and one not met: the monitoring provider’s out-of-hours analyst could reach only the IT service desk, and 25 minutes passed before anyone could declare the incident. Isolation was agreed 40 minutes after declaration, after a debate about who was allowed to stop dispatch.

The after-action report was approved within ten working days, with six owned actions. By April the plan gave the incident manager the right to isolate without waiting for the executive. When real ransomware hit a warehouse in August, isolation was decided 30 minutes after declaration and backups were checked before any restore. The out-of-hours line was still open, and the alert reached the service desk first again. It was fixed in September and is re-tested in an October drill, before a payment fraud tabletop for the executives.

Start with these three

1. Tabletop Exercise Design Methodology: choosing the scenario, writing objectives that test decisions, and rating them the same way every year.
2. Exercise Planning & Facilitation Procedure: from scoping to the hot debrief, with a run-of-show a facilitator can follow.
3. Tabletop Scenario — Ransomware Encryption of Core Systems: the scenario most organisations should run first.

Your first month

Five numbers to report

Report these to executive management each quarter.

Findings rated High are due within 30 days, Medium within 90 and Low within 180. Anything partly met or not met is tested again within six months of its fix. The exercise record is also the evidence that your incident response plan has been exercised, as the incident management policy requires every year.

Everything in the pack

Adapting it

• Small organisation: one tabletop a year for everyone, plus two short drills of the out-of-hours route, meets the intervals. The facilitator must not also be a participant, so borrow one from a peer organisation or your provider.
• Regulated entity: DORA asks financial entities to test their response and recovery plans, including crisis communication. Keep each after-action report as the record of that test.
• IT run by an outside provider: most technical decisions are theirs. Invite their service lead, and check that the contract makes them take part in your exercises.

Where it maps

• ISO/IEC 27001:2022: Annex A 5.24 and 5.27.
• NIST CSF 2.0: ID.IM-02.
• NIS2: Article 21(2)(b), (c) and (f).
• DORA: Article 11(6) and Articles 24 and 25.