Contingency plans are written at desks and often fail on details: nobody knows who calls the insurer, the contact list sits on the encrypted server, and management is on holiday. A tabletop exercise finds such gaps in two to three hours.
Process
A facilitator presents a scenario, for example: Monday morning, several employees report they can no longer open files. Participants describe what they would do, whom they would inform and which decisions they would take. At intervals the facilitator introduces new information: a ransom demand appears, the media call, a key customer gets in touch. A debrief follows at the end.
Participants
Management, IT or the IT provider, communications, data protection and, depending on the scenario, business units such as accounting. Decision-makers must take part, because many questions in an emergency are leadership questions: do we shut down operations, do we pay, do we inform?
Good scenarios
Realistic and tailored to your own company: ransomware, a taken-over mailbox with CEO fraud, the outage of a central cloud service or a data leak with reporting duties. The scenario should challenge your own plans, not show them off.
From findings to improvement
Every exercise ends with a list of measures with owners and dates: add missing contacts, clarify decision authority, adapt the incident response plan. One exercise a year keeps plans alive. Running it is part of our cyber readiness check.