Home / Services / Incident Readiness and Tabletop Exercises
INCIDENT RESPONSE & RESILIENCE
Incident Readiness and Tabletop Exercises
Practise decisions before they become urgent.
CyberXpert helps organisations build usable incident plans and exercise them through realistic discussion-based scenarios. The focus is on people, decisions and dependencies as well as technology.
Plan an incident exerciseWHO THIS HELPS
Practise the decisions your team would face.
For leadership teams, IT managers and operational owners who need to know how they would coordinate a disruptive cyber incident.
THE PROBLEM TO SOLVE
A plan can exist without anyone knowing who can isolate systems, contact suppliers or approve communications. An exercise exposes those gaps while there is time to address them.
What you receive
Receive the agreed incident plan or improvements, exercise materials, observations and an action tracker. A tabletop is a learning exercise, not certification of resilience.
How delivery works
We agree the objectives and participants, design the scenario, facilitate the session and review the decisions. Follow-up support can help turn findings into revised procedures.
After delivery
Update playbooks, confirm supplier dependencies and repeat exercises when material systems or responsibilities change. Test recovery processes separately where appropriate.
What shapes scope and price
Scenario complexity, participant groups, preparation needs, session format and follow-up work influence scope. Technical recovery testing is distinct from a discussion-based exercise.
Your proposal sets out the deliverables, assumptions, exclusions and responsibilities before work begins. No fixed price or contractual inclusion is implied by this page.
A DEFINED ENGAGEMENT
What the work can cover.
01
Review or development of an incident response plan and contact structure.
02
A scenario linked to your business, such as email compromise or ransomware.
03
Facilitated discussion of escalation, containment, recovery and communication decisions.
04
A debrief and prioritised improvement actions with accountable owners.
Questions worth asking.
Do we need a finished incident plan first?
No. An exercise can help expose what a new plan needs. Preparation is tailored to your maturity and objectives.
Will the exercise test our backups?
A tabletop discusses recovery decisions. It does not demonstrate that backups restore successfully; that requires separate technical testing.
Who should take part in a tabletop exercise?
Include the people who make and carry out incident decisions: leadership, IT or service owners, communications and other relevant business functions. Participants should match the scenario and objectives, rather than treating the exercise as a test only for technical staff.
What do we take away from the exercise?
The useful outputs are observations about decisions and dependencies, gaps in the response process and an improvement tracker with accountable owners. Where included, the incident plan or contact structure can be updated using those findings.
How realistic should the scenario be?
Use a plausible disruption linked to important services, such as account compromise or ransomware. Complexity should support the agreed objectives and maturity. A facilitated discussion can expose decision gaps without deploying malware or disrupting live systems.
LET’S DEFINE THE RIGHT SCOPE
Plan a practical incident exercise
Tell us your exercise objectives, the teams involved and the decisions you want to practise. We will help define a practical scope for a planned exercise. For an active incident, call +44 (0)20 4591 7000 or submit an incident enquiry. Please do not send passwords, confidential evidence or sensitive personal information. Secure transfer arrangements are agreed separately.
Incident Response Retainer →
Cyber Security Risk Assessments →
Virtual CISO →