Security · Incident Readiness · 02
Tabletop exercises
A tabletop exercise walks leadership and technical staff through a realistic incident scenario, step by step, to test whether the plan, the people and the decisions hold up before a real event tests them. It is needed when a plan has never been exercised, when leadership has never faced an incident decision, when an insurer, regulator or customer requires evidence of exercises, or when new staff, providers or systems have changed how a response would actually run. The exercise produces a scenario tailored to the organization’s real risks, a facilitated session with injects that force decisions, observations of what worked and what did not, and an improvement list with owners, which is itself the evidence that the organization tests its readiness.
Scope
What the review covers.
- Scenario design from the organization’s actual risks and systems
- Participant selection across leadership, technical, legal and communications roles
- Facilitated session with timed injects and decision points
- Observation against the plan: roles, escalation, notification, evidence, communications
- Debrief and improvement list
- Record for insurers, auditors and regulators
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Scenario and inject script | Tailored to the organization |
| Facilitated exercise | Half-day session, remote or on site |
| Observation report | What worked, what did not, with evidence |
| Improvement plan | Owned actions and the next exercise date |
Prerequisites
What we need from you.
- The incident response plan, or agreement to exercise without one and build it after
- Availability of the right participants for a half day
- Agreement on the scenario type: ransomware, email compromise, data exposure or other
Related
Where this sits.
- Incident Readiness Service
- Security Hub
- Ransomware readiness review Also
- Breach escalation procedures Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Is this a technical exercise?
A tabletop is a discussion exercise focused on decisions. Technical drills such as restore tests are separate and complement it.
Who should attend?
The people who would be in the room during a real incident: executive decision-makers, IT and security leads, legal, communications and sometimes HR.
What does the insurer get?
A record that the exercise took place, who participated and what was improved. Many policies now ask for exactly that.