How to Run a Cyber Incident Tabletop Exercise

Rehearse decisions before an incident

A cyber incident tabletop exercise is a structured discussion about how your organisation would handle a developing incident. Participants work through a scenario and explain their decisions, contacts and dependencies. It can expose practical gaps before those decisions are needed for real.

The NCSC provides free Exercise in a Box resources, including discussion-based tabletop exercises. These can be a starting point for organisations that want to rehearse their response. ^[1]^[2]

Decide what you want to learn

Choose a small set of objectives. You might want to establish whether an incident can be escalated outside normal hours, whether finance can verify a suspicious payment or who authorises suspension of a customer service.

Avoid trying to test every part of the business in the first session. A focused exercise is easier to facilitate and produces clearer actions. Agree how observations will be recorded and who will receive the results.

Choose a scenario linked to your business

Build the situation around a service the organisation depends on. Examples include a compromised email account, unavailable business data or a security incident at a key supplier.

For each stage, provide only enough information to support the next decision. Introduce uncertainty deliberately: an unavailable administrator, incomplete logs or a customer asking for an update. This tests how people make decisions when the full picture is unavailable.

Use fictional details and clearly mark exercise messages. Do not introduce real customer data or send simulated incident instructions into live operational channels without a separately agreed exercise plan.

Bring the people who would make decisions

Include representatives from the relevant business service, IT or its provider, security and senior management. Add finance, HR, communications, privacy or other advisers where the scenario needs their input.

Appoint a facilitator to present developments and keep the discussion moving. Assign someone else to record decisions, unanswered questions and actions. A smaller organisation can combine roles where practical, but participants should know which role they are performing.

Leadership involvement matters where the scenario tests business risk decisions. The UK Cyber Governance Code of Practice includes incident planning, response and recovery among its governance areas. ^[3]

Run a sequence of decision points

An illustrative 90-minute agenda could be:

10 minutes: explain objectives, roles and exercise boundaries.
20 minutes: introduce the initial event and discuss escalation.
25 minutes: add business disruption and test containment authority.
20 minutes: discuss recovery priorities and communication.
15 minutes: capture immediate lessons and agree action owners.

Adapt this illustrative agenda to the scenario, participants and objectives.

At each stage, ask: What do we know? What do we need to find out? Who can decide? What would we do next? Request the actual document, contact route or approval process participants would use where practical.

Record gaps without turning the exercise into a blame session

A useful observation identifies the decision affected and the missing capability. “Contact list needs work” is less actionable than “the alternative incident lead cannot access the provider’s activation number without company email”.

Distinguish a documented process from a demonstrated capability. A tabletop can establish that people understand a recovery procedure; it does not prove that a backup restores successfully. Schedule separate technical verification where necessary.

Turn discussion into improvement

Give each action an owner, priority, target date and acceptance check. Record who will approve completion and how outstanding risks will be escalated.

An illustrative action might be: “Operations to make the incident contact list available through an approved offline route; deputy incident lead to demonstrate access.” Revisit unresolved actions and repeat relevant parts of the scenario after changes.

Plan the right exercise

CyberXpert incident readiness and exercises can help scope a session around your business decisions. If the underlying plan needs attention first, read Preparing an Incident Response Plan.

For ongoing preparation and activation arrangements, see what an incident response retainer should include.