How to Conduct an Effective Tabletop Exercise

Tabletop exercises provide one of the most effective methods for testing your incident response (IR) plan, short of experiencing an actual breach. 

Incident response planning in general has moved up the priority list for most organizations as weekly reports prove that no one is immune to cyberattack. But unless you test your incident response plan, you won’t really know if it covers all the right steps. A tabletop exercise throws your team into a simulated breach, which quickly helps everyone start recognizing the incident response plan as a real-world lifeline, not just a dusty policy statement. Most mature organizations conduct a tabletop exercise at least once a year, and some conduct several each year to cover various parts of the organization. 

The guidelines below help you plan and carry out a tabletop exercise (also known as a TTX) that pays immediate dividends in finding places to improve your incident response plan and focusing your team’s attention on the potential challenges (if you want to take a deep dive into tabletop exercise planning and don’t mind government-speak, review the CISA Tabletop Exercise Package).

Write Clear Objectives and Outcomes 

The exercise’s organizers should have a specific idea of how the tabletop fits into the overall strategy for testing your incident response plan. And since the incident response plan will drive the tabletop exercise, make sure that all participants have a copy of the incident response plan before the exercise. Let everyone know that they’re expected to review it prior to the exercise and to bring a copy to the meeting.  

Invite the Right People 

With a clear concept of your exercise’s purpose, you’ll know whom to have participate and what kind of scenario to use. The best tabletop exercises include representatives beyond the IT team. While your tech folks will be tasked with the immediate jobs of understanding and stopping a breach, key decisions require perspectives beyond the IT staff. For example, an operations representative should be there to explain the real-world ramifications if someone from IT always suggests “shut it down” as a solution to a breach. Representatives from the public relations and legal teams can help manage messaging and highlight legal traps to avoid. And, if you can get them to come, it’s best to have a member of the C-suite attend so they get a firsthand sense of the potential risks and what it will take to mitigate them. If you’ve identified a full Disaster Recovery team, inviting those people will probably check most of the above boxes.  

Create Meaningful Scenarios 

The scenario’s quality determines much of the success of the tabletop exercise. An experienced cybersecurity expert can help craft a scenario that reflects the latest real-world threats. They can pace the reveal of information to mimic how actual breaches develop. They can build in multiple attack vectors like the ones you’ll see in real life. The scenario should also bring in third-party concerns, such as clients calling to ask why your services aren’t working or issues that start cascading through your supply chain. The best scenarios typically take a key leader out of the equation by declaring them unreachable during the crisis. That prevents everyone from saying, “We’ll just call the boss, and she’ll know what to do.” 

Take it Seriously, But Encourage Honesty 

Managers should set the tone by treating the entire exercise with urgency. Don’t let participants short-circuit the process by skipping steps or brushing something off as unrealistic. Following the defined steps is all part of the exercise. This prepares you for the fact that, in some industries, you may not be able to file a cyber insurance claim for a real incident without showing a full root cause analysis (RCA) of the breach. So work the problem as described in the scenario and require everyone to be specific with their answers. But cultivate an atmosphere where people can admit it when they don’t know what to do. After all, you run these exercises to identify exactly those kinds of gaps. 

Use an Outside Facilitator  

You’ll usually get better results with an experienced third-party expert facilitating the process. They’ll work with the test’s leader to plan a strong scenario, and they’ll keep everyone on track during the actual exercise. They know how to ask the right questions and won’t be held up by internal politics. The facilitator also helps drive everyone to identify action items at the end. 

Commit to Follow-Up Steps 

Your session should include an immediate discussion about how the exercise went (what CISA calls a “hot wash”). Task someone (your facilitator often handles this step) to write down and assign specific to-do items from the meeting. Those often include updating portions of the incident response plan, getting more information about how your backup system works, etc. Set a deadline for completing the to-do list and/or holding a follow-up meeting to check progress. 

HBS consultants lead dozens of tabletop exercises every year for clients of all sizes. Contact us today to learn how we can help you get the most from your next exercise.