Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Tabletop Exercise Toolkit — Guide

  • Version 1.1
  • Updated
  • 13 documents
  • Word, PowerPoint, Excel

Cyber Incident Exercises & Tabletop Scenario Library

Most incident exercises rehearse a script. Everyone reads their part, the plan is declared fit, and nobody learns that the out-of-hours alert goes to the wrong desk until it does so at 6 a.m. This pack runs exercises that test decisions instead: who decides, how fast, on what facts, and whether the decision would survive a legal clock or the board’s questions the next day.

Is this for you?

This pack is for you if:

  • your incident response plan has not been exercised in the last twelve months;
  • your last exercise ended with “went well” and no owned actions;
  • your board has never discussed what it would do if asked to pay a ransom.

Who needs an exercise, and how often

Different people fail in different ways, so each audience has its own interval. A live incident teaches a lot, but it never counts as an exercise.

AudienceAt least everyUsually
Board, or its equivalent24 monthsA short session on the decisions only it takes, such as a ransom
Executive management and the crisis team12 monthsA tabletop
Incident response team6 monthsA tabletop, or a drill
Technical responders, including providers6 monthsA technical tabletop or a drill
Critical suppliers with a part in the plan12 monthsJoining an exercise that involves their service

Every objective names a decision, the person who must take it and the rule it comes from. Each is rated Met, Partly met, Not met or Not tested, on the same scale every year, so you can see whether you are getting better.

How it runs in practice

Take a distributor with 900 staff. In March its crisis team ran a three-hour ransomware tabletop, with the internal audit manager as independent observer. Two of six objectives were met, three partly met and one not met: the monitoring provider’s out-of-hours analyst could reach only the IT service desk, and 25 minutes passed before anyone could declare the incident. Isolation was agreed 40 minutes after declaration, after a debate about who was allowed to stop dispatch.

The after-action report was approved within ten working days, with six owned actions. By April the plan gave the incident manager the right to isolate without waiting for the executive. When real ransomware hit a warehouse in August, isolation was decided 30 minutes after declaration and backups were checked before any restore. The out-of-hours line was still open, and the alert reached the service desk first again. It was fixed in September and is re-tested in an October drill, before a payment fraud tabletop for the executives.

Start with these three

  1. Tabletop Exercise Design Methodology: choosing the scenario, writing objectives that test decisions, and rating them the same way every year.
  2. Exercise Planning & Facilitation Procedure: from scoping to the hot debrief, with a run-of-show a facilitator can follow.
  3. Tabletop Scenario — Ransomware Encryption of Core Systems: the scenario most organisations should run first.

Your first month

WhenWhat to doYou’re done when
Week 1List the audiences and when each was last exercised.Executive management has approved the year’s programme.
Week 2Pick a scenario from your top risks and write three to six objectives, each a decision.The sponsor has approved the objectives.
Week 3Book the room and the people, brief an independent observer, and adapt the injects.The readiness checklist is complete.
Week 4Run the exercise and the hot debrief the same day.Every finding has an owner and a due date.

Five numbers to report

Report these to executive management each quarter.

NumberTarget
Audiences exercised within their intervalAll four internal audiences
Objectives met at the last executive exerciseNo category not met at two exercises in a row
Exercise actions overdueNone more than 30 days overdue
Re-tests outstandingNone past the six-month window
Critical suppliers exercised in the last 12 monthsAll, by the year end you set

Findings rated High are due within 30 days, Medium within 90 and Low within 180. Anything partly met or not met is tested again within six months of its fix. The exercise record is also the evidence that your incident response plan has been exercised, as the incident management policy requires every year.

Everything in the pack

Adapting it

  • Small organisation: one tabletop a year for everyone, plus two short drills of the out-of-hours route, meets the intervals. The facilitator must not also be a participant, so borrow one from a peer organisation or your provider.
  • Regulated entity: DORA asks financial entities to test their response and recovery plans, including crisis communication. Keep each after-action report as the record of that test.
  • IT run by an outside provider: most technical decisions are theirs. Invite their service lead, and check that the contract makes them take part in your exercises.

Where it maps

  • ISO/IEC 27001:2022: Annex A 5.24 and 5.27.
  • NIST CSF 2.0: ID.IM-02.
  • NIS2: Article 21(2)(b), (c) and (f).
  • DORA: Article 11(6) and Articles 24 and 25.

Prepared by Zero One Cybersecurity · Published by CISO Times

CISO Times Resource Licence — Internal Use