A cybersecurity tabletop exercise is a talk-through of a made-up incident, held with the people who would do the responding. It shows where the incident plan has gaps before a real incident does. Nothing is shut down or restored. The group works through what it would do, out loud, one step at a time.
Without a practice run, a business may find missing contacts, unclear authority and out-of-date instructions only while an incident is under way. That’s a hard time to learn them. So the practical task is short. Pick one scenario. Gather the people who would respond. Write down every gap.
What Is a Cybersecurity Tabletop Exercise?
It’s a structured conversation about an incident that hasn’t happened. A small group sits down with a made-up situation and says out loud who would do what at each step. The talking is the test. By the end, the group can see where the incident plan is missing, stale or unclear.
No computer gets touched. No system is scanned or shut down. Nothing gets restored. Nobody in the room needs technical skill to take part, either. The exercise tests people and paperwork, not equipment.
A business doesn’t need a polished plan to hold one. A rough draft can be enough, and so can a list of who to call. The exercise can show what the plan lacks, which is a reason to run one early rather than late.
Who Should Be in the Room?
The room needs three kinds of people. One guides the talk-through without playing a part in it. One takes notes, so the gaps don’t get lost when the meeting ends. The rest are the people who would respond to a real incident, because their answers are the ones being tested.
The Cybersecurity and Infrastructure Security Agency publishes tabletop exercise packages. They’re described on CISA’s Tabletop Exercise Packages page as sets of resources to help an organization run its own exercise. That page also lays out roles for exercise planners, facilitators and evaluators, and participants. A business can read through what’s offered and borrow the structure.
For a small business, the responder list is shorter than it sounds. It may come down to these seats:
- The owner, or whoever can make a decision without asking anyone else
- Whoever runs IT, plus the outside IT provider if there is one
- Whoever handles customers
- Whoever handles money and payments
- An office lead who knows the daily routine
The guide matters more than the title suggests. A good one keeps asking “and then what?” and resists answering for the group. If that person fills every silence, the gaps stay hidden. So it may help to pick someone who can sit through an awkward pause.
Which Scenario Should a Small Business Start With?
Pick one incident the business could plausibly face. CISA’s Tabletop Exercise Packages page lists cybersecurity scenarios that include ransomware, insider threats and phishing, so there are options to choose from. The right starting point is the one the people in the room can picture happening on a normal workday.
Keep the scenario to a few short paragraphs of made-up facts, and reveal them one step at a time. That way the group reacts to each turn instead of reading the ending first. An employee reports a strange message on a screen. Then a shared folder won’t open. Then a customer calls to ask why an order is stuck. Every added detail changes the question in front of the group.
One scenario per session is plenty. Running two can turn the meeting into a tour of everything that could go wrong, and the notes get thin. Start with the one the business could most plausibly face, and leave the rest for another session.
What Should the Group Talk Through?
The group walks through three stages: the time before an incident, the response while it’s happening, and the recovery afterward. CISA’s Tabletop Exercise Packages page says the packages include discussion questions for each of those stages. The questions can stay plain. The answers are what the note taker is listening for.
Start before the incident, while nobody is under pressure.
- Who is on the contact list, and where is that list kept?
- Who is allowed to decide that a system gets shut down?
- Who would tell the IT provider, and how?
Then move into the response itself.
- Who gets called first?
- Who tells customers, and who tells staff?
- How does the business keep working while a system is down?
Finish with recovery, which is where answers can run out.
- How does the business decide a system is safe to use again?
- Who confirms that call?
- Who writes down what happened?
What Should You Write Down Afterward?
Write down a short list of gaps. Each one gets a plain description, a named owner and a due date. That’s the whole output. A long report may sit unread, while a list of a few fixable items with names beside them has a chance of getting done before the next exercise.
CISA’s Tabletop Exercise Packages page says the packages include a feedback form to hand out after the exercise, along with an After Action Report. A business can borrow the idea without the paperwork. A short written summary of what went well and what needs fixing, drafted while the conversation is fresh, does the same job.
The plan itself should change to match what the group found. A missing contact or a decision nobody owned belongs in the document, not just in the notes. What goes in that document is its own subject, covered in a separate post on what an incident response plan should contain.
Share the list with everyone who took part, and with the IT provider if the business uses one. Then bring it back out at the next exercise. Items that are still open after two sessions are telling you something.
What Can a Talk-Through Not Tell You?
It tells you about people and paperwork. Missing contacts, unclear authority, instructions that no longer match how the business works: the conversation surfaces all of that. What it can’t tell you is whether a backup restores, or whether a system comes back the way the plan assumes.
A restore is its own test, and a conversation can’t stand in for it. That one has its own method and its own result, set out in a separate post on how to test a backup restore.
Leaders have a part in this, too. According to CISA’s Cyber Essentials guide, they should lead development of an incident response and disaster recovery plan that outlines roles and responsibilities, and test it often. The same guide says to learn who to call for help: outside partners, vendors, responders, technical advisors and law enforcement. It’s written for leaders of small businesses, and for leaders of small and local government agencies. It’s guidance, not a legal requirement.
O&O Systems’ Cybersecurity and Compliance page says its team equips staff to recognize phishing scams and suspicious activity.
Spotting a suspicious message is one skill. Knowing whom to tell, and what happens after that, is another. A walkthrough can rehearse that second part, which is the part that can go unpracticed.
As a rule of thumb, a first exercise with one scenario can fit inside about an hour. Past that, attention can drift. Repeating it after a big change, such as a change of IT provider or a move to another office, keeps the answers accurate.
Frequently Asked Questions About a Cybersecurity Tabletop Exercise
How long does an exercise take?
There’s no fixed length. As a rule of thumb, one scenario can fit inside about an hour, and a longer session gets harder to keep focused. The number of scenarios changes it, and so does the size of the group: more people means more voices on every question. Start short. A second session can always go deeper.
Do we need a finished incident plan first?
Not necessarily. A rough draft can be enough, and so can a list of who to call. The exercise is what shows the gaps, so starting with less written down may simply mean a longer list of gaps at the end. The plan can be improved afterward, which is the point of holding one early.
Does anyone have to touch the computers?
No. It’s a conversation, start to finish. Nothing gets shut down, scanned or restored, and no account or device needs to be opened to take part. A technical test is a different job, and an IT provider may offer that separately. The two can sit well together, but one doesn’t replace the other.
How often should a business hold one?
CISA’s Cyber Essentials guide says to test the incident response and disaster recovery plan often. How often is a judgment call. As a rule of thumb, and not as the guide’s instruction, once a year plus a run after any big change can keep the answers accurate. A change of IT provider or a move to another office counts.
Can a small business use CISA’s packages?
They’re CISA resources for running your own exercise. CISA’s Tabletop Exercise Packages page says each one is customizable, with template objectives, scenarios and discussion questions. A business can look through them and borrow the structure that fits. Adapting a scenario to how the business works takes some judgment, and a manager or the IT provider can help with that part.
Put the First Exercise on the Calendar
Choose a scenario and a date. Name someone to guide the talk and someone to take notes. Invite the people who would respond, and block out the time before the plan has a chance to go stale. A short session that happens is worth more than a thorough one that keeps getting moved.
If you’re planning a first cybersecurity tabletop exercise and want a second opinion on the incident plan, ask O&O Systems about your incident readiness and bring whatever plan or contact list you have.