Tabletop exercises and facilitation
A written incident plan is not tested until people have to use it. A tabletop exercise walks leaders and IT staff through a realistic scenario, such as ransomware on a Friday night, and shows who decides, who calls the insurer and where the plan has gaps.
What we do
- Scenario writing
- Session facilitation
- Decision and gap recording
- After-action reporting
- Plan updates
- Exercise scheduling
Our team works with the CISA Tabletop Exercise Packages and the exercise guidance on Ready.gov, and has experience with Immersive Labs for crisis simulation. We write a scenario for the company's own systems, run the session, take notes on decisions and delays and deliver a short list of fixes with owners.
This group links to our Cybersecurity and Disaster Recovery practices. An exercise tests a plan on paper and does not replace a technical recovery test. These are tools and guides our team has experience with, not partnerships.
Leading platforms we work with
- CISA Tabletop Exercise Packages
- Immersive Labs
- Ready.gov exercises
Platforms and practices
- Scenario design for the company's own systems
- Executive and technical session formats
- Ransomware and email compromise scenarios
- Decision log and timing notes
- Insurer, counsel and regulator contact steps
- Communication drafts for staff and customers
- After-action report with owners
- Follow-up exercise schedule
- Backup restore test pairing
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Tabletop exercises and facilitation for clients
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreDisaster Recovery Planning
Know how long you can be down, and prove you can come back before the day you must.
Learn moreSecurity Awareness Training
Train your people to stop the phish, the fake voice and the wire request before money moves.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWho should take part in a tabletop exercise?
Leaders who make decisions, such as owners, finance and communications, plus the IT staff who would do the work. Many companies run one short session for each group, then a combined one.
Is a tabletop exercise a technical recovery test?
No. It walks people through a scenario on paper and shows gaps in the plan. It does not prove that backups restore or systems rebuild, which is why we suggest pairing it with a restore test.
How long does a session take?
Most sessions fit in a few hours. The scope depends on the scenario and the number of people, and we agree it with you before we write it.
What do we get at the end?
A short after-action report with the decisions made, delays and gaps found, and a list of fixes with an owner for each. Ask your insurer or counsel whether they want to see it, since some records can be requested later.