A tabletop exercise tests an incident response plan (IRP) through a facilitated discussion of a hypothetical incident. Participants walk through decisions and coordination, exposing gaps before a real incident. Exercises can help evaluate the plan, strengthen teamwork, and guide improvements; test the IRP before use and periodically, at least annually. section 9.3
Build the exercise around clear objectives and a realistic scenario:
- Choose objectives, such as testing procedures, communications, or gaps in the IRP. section 9.3
- Develop a relevant scenario that grows in complexity and introduces challenges. section 9.3
- Bring together the incident response team and relevant stakeholders, including IT, legal, communications, and management, and clarify their roles. section 9.3
Customer data breach scenario
At SecureTech Solutions, unusual traffic from a server holding customer data prompts discussion about confirming a breach, containment, and notification. Later, an attacker encrypts data and demands a ransom; a journalist then asks for comment. These escalating developments test response decisions alongside internal, customer, and media communications. section 9.3.1
Choose measures for a reason, then use them to interpret exercise performance:
- Track IRP adherence and deviations from procedures. section 9.3.2
- Record the number and severity of identified gaps. section 9.3.2
- Collect participant feedback and improvement suggestions, and assess knowledge retention and skill improvement. section 9.3.2
Figure 9.2 Tabletop exercise example metrics table with target values, actual values, and corrective actions based on metrics
Compare target and actual metric values, then use the indicated corrective actions to address gaps. section 9.3.3
