Incident response tabletop exercises
A facilitated, discussion-based rehearsal of a realistic incident, so leadership and IT find the gaps in your plan in a meeting room rather than during a real attack.
Reviewed by the ITRS security team · Last updated
What a tabletop exercise tests (and what it doesn't)
An incident response tabletop exercise is a discussion-based session in which leadership and IT walk through a realistic scenario, such as ransomware or business email compromise, using your actual response plan. NIST SP 800-84 sets out how to design, conduct and evaluate exercises like this. The output is an after-action report listing the gaps and the plan changes needed.
A tabletop is a structured conversation. A facilitator walks a group through an incident as it unfolds, releasing new information at intervals, and the group decides what they would do. Nothing is touched on live systems.
It tests decisions, roles and communication: who has authority to shut down a system, who calls the insurer, who speaks to clients, whether anyone knows where the plan is. NIST SP 800-61 Rev. 3 (2025) and NIST Cybersecurity Framework 2.0 both treat this kind of preparation and improvement as an ongoing part of managing cyber risk, and ISO/IEC 27035 includes exercising the incident management plan as part of being ready.
It does not test whether your backups restore, whether your EDR catches a technique, or whether your firewall rules hold. Those need technical testing. A tabletop will often tell you which of those tests to run next.
Who should be in the room
The right group is the people who would actually make or carry out decisions in a real incident. For most organizations of 20 to 500 people that means six to twelve people.
| Role | Why they need to be there |
|---|---|
Executive decision-maker (owner, CEO or COO) | Authority to shut down operations, spend money and approve external statements |
Finance lead | Payments, bank contact, insurance, and cost tracking |
IT lead or managed service provider | Technical containment and recovery options |
Legal or in-house counsel | Privilege, notification and contractual obligations |
Privacy officer | Breach assessment and records |
Communications or client relations | Client, staff and media messaging |
HR | Insider scenarios and staff communications |
Preparation: plan review and interviews
Read what exists
We review your incident response plan, contact sheet, insurance notice requirements, backup arrangements and any recent assessments. If there is no written plan, the exercise is built around how you would respond today.
Short interviews
Brief conversations with the IT lead and one or two decision-makers about systems, dependencies and concerns. This keeps the scenario believable for your environment.
Agree objectives
Two or three things the exercise must test, for example: can we make a shutdown decision within the first hour, do we know who calls the insurer, can we reach staff if email is down.
Design the scenario
A timeline of injects (new facts released during the session) written to stress those objectives without being unwinnable.
Scenario examples
| Scenario | What it typically exposes |
|---|---|
Business email compromise and payment fraud | Payment verification, bank contact, mailbox evidence preservation, client notification |
Ransomware on a Monday morning | Shutdown authority, backup confidence, working without email or files, payment discussion, insurer notice |
Departing employee takes client data | HR and legal coordination, preservation of devices and accounts, employee privacy limits |
A key vendor reports a breach | Contract terms, what data the vendor held, your own notification analysis |
The session and the after-action report
Sessions usually run two to three hours. The facilitator presents the scenario in stages, asks the group for decisions, and probes assumptions ('who has the bank's fraud number?', 'where is that written down?'). A separate note-taker records decisions, open questions and moments of uncertainty. The tone is no-fault: the purpose is to find gaps, not to grade people.
Within the agreed timeframe you receive an after-action report: what went well, where the plan or team struggled, and a list of specific improvements, each with a suggested owner and priority.
Turning findings into plan updates
An exercise only pays off if the plan changes. Typical outputs include:
- A one-page incident contact sheet and call tree, kept outside the systems that could be down
- Clear decision authority for shutting systems down and engaging outside help
- An out-of-band communication method for when email and Teams are unavailable
- Insurer notice steps and approved-vendor checks written into the plan
- Technical follow-ups, such as a restore test or an audit logging review
- A date for the next exercise, with a different scenario
FAQ
Many organizations aim for at least once a year, and again after major changes such as a new IT provider, a merger, or a real incident. NIST SP 800-61 Rev. 3 treats improvement as continuous rather than a one-off event.
Yes. The exercise shows how you would respond today, and the after-action report becomes the outline for a first plan.
Yes, although in-person sessions tend to produce better discussion. Hybrid sessions work if remote participants have a clear way to contribute.
No. The report records gaps in the plan and process, not individual performance.
Related work.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
- Case studyEmail Authentication for a Vaughan Smart-Home IntegratorHow IT Rapid Support audited a Vaughan smart-home integrator's email authentication and implemented DKIM and DMARC to shut down domain spoofing.
Related.
- PracticeCyber Forensics & AssuranceIncident response, digital forensics, penetration testing and independent attestation.
- GuideWriting an incident response plan that works for a small organizationA usable incident response plan is short enough to read under stress and specific enough to act on.
- GuideOut-of-band communications and incident call treeWhen an attacker is inside your email or Teams, using them to coordinate the response tells the attacker your plans.
- ServiceRansomware responseA plain sequence for a 20 to 200 person organization hit by ransomware: isolate, preserve, scope, recover, assess data theft and notify, with evidence kept intact for…
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.