The incident response plan is a page of names, numbers, and first moves — and like every plan, it contains errors that only surface when someone actually walks it. A tabletop exercise is the walk: ninety minutes, a conference room, a scenario read aloud, and the plan followed literally until it stumbles — which it will, and that’s the product. The continuity version covers outages and disasters broadly; this is the cyber-specific script, ready to run.
The setup: who’s in the room, and the one rule
Attendees: whoever the plan names — the incident lead, the owner or GM, whoever speaks externally, the IT lead or your provider’s representative, and whoever handles money. A facilitator runs it (your provider is a natural fit — we run these with clients precisely because an outside voice can push where colleagues won’t). The one rule, stated up front: answers come from the plan and the room’s real knowledge, not from optimism. “Someone would call the insurer” isn’t an answer; who, using what number, found where — that’s an answer, and the gap between the two is what you’re here to find. Second rule, cultural: findings are wins — the person who exposes the broken step just saved a real bad day.
The script: a Tuesday, escalating
8:05 a.m. The office manager reports: three people can’t open files, and one screen shows a note demanding payment. Walk it: Who does she call — does she know that? Who declares this an incident? What are the first physical moves — and does anyone in the room know to disconnect-but-not-power-off? When does the insurer’s hotline get dialed, and can someone produce the number right now, without the network?
8:40 a.m. — the facilitator’s first injects, dealt one at a time: The file server is encrypting. The backup console won’t load. A client calls asking why the portal is down. Now: who’s checking whether the immutable copy survived — from what device? Who takes the client call, saying what? Who’s telling staff what to say and not say? Is anyone writing the timeline down?
10:00 a.m. — the decision injects: IT says containment requires shutting down the remaining servers — an operational stop. Separately, forensics will take days; the ransom note’s deadline is 48 hours. Who has authority for the shutdown call, and do they know the downtime number that prices it? What’s the room’s answer on the ransom — and does it match the plan’s “insurer and counsel decide together” line? What gets said to the whole company at noon?
Day 2 (fast-forward) — the recovery injects: Restores are running; forensics reports client data was likely copied out. Who calls counsel, and does the room know the notification trigger? In what order do systems come back — is the order written anywhere? Who owns the version-of-record message to clients?
The debrief: fifteen minutes, one list
Stop with fifteen minutes left and build the findings list live — each item with an owner and a date, fed back into the plan documents within the week. First-tabletop findings are remarkably consistent across businesses: a phone number that’s wrong · the insurer hotline nobody could find offline · the break-glass access question · a decision (shutdown, ransom posture, client messaging) with no named owner · the plan itself reachable only on systems the scenario just encrypted. Every one costs minutes to fix today and hours-to-fortunes to discover live.
Making it annual
Run it yearly at minimum — alongside the restore fire-drill, so the technical and human halves rehearse together — rotating scenarios (the wire-fraud version and the compromised-mailbox version deserve their own years) and tracking one meta-metric: findings per exercise, trending down, with repeats trending to zero. Insurers ask whether you do this; more importantly, the second real value is unmeasurable but unmistakable — the year the actual bad Tuesday arrives, someone in the room thinks: we’ve done this before.
The bottom line
A tabletop is ninety minutes of pretending, purchased against hours of real chaos: the script above, the plan followed literally, injects that force the hard decisions, and a findings list with owners. Run it annually, rotate the scenarios, and watch the list shrink — because the worst Tuesday is coming eventually, and the only question the exercise decides is whether it arrives at a rehearsed company or a surprised one.