A cyber tabletop exercise is a facilitated, scenario-based rehearsal of organisational decisions during a cyber incident. Good exercises test ownership, escalation, dependencies, communication and recovery—not only technical knowledge.
Start with a decision objective
Choose the decision that matters: when to declare a major incident, who can isolate a production system, how to approve a supplier payment under threat or who communicates with regulators. Define success as observable coordination.
List participants by decision authority: incident response, security, business, legal, communications, privacy, operations, HR and executive leadership as applicable. A room full of observers rarely reveals decision friction.
Build timed injects and consequences
Use plausible information fragments, not a perfect narrative. A ransomware warning arrives; five minutes later a customer calls; later a critical vendor goes offline. Each inject should force a trade-off or a handoff.
The facilitator should draw out assumptions and document who said what should happen. Include information the team cannot yet verify. In real crises, decisions frequently happen before all the facts are known.
Turn the debrief into a remediation plan
Conclude with a short record of decision gaps, owners, priorities and test dates. Distinguish unclear authority from absent process, technical dependency and communication delay.
Retest the most important weakness within a defined period. An exercise that produces an attractive slide deck but no completed action plan is theatre rather than resilience.
Four actions to take away
- Write decision-specific objectives
- Invite people with actual authority
- Use realistic, timed injects
- Assign and retest corrective actions
Further reading & sources
These authoritative references provide additional technical, regulatory or security context. The analysis and recommendations above are original editorial commentary.