Incident Response Tabletop Exercise: Rehearse the Plan

An incident response plan only works once the people named in it have rehearsed it, usually through a tabletop exercise run at least once a year.

Most organisations we assess have an incident response plan. It was written for an ISO certification or a customer questionnaire, and it names people who may or may not still work there. When we ask when it was last run, the answer is usually a version history and no date. Then an incident happens, and the first hour looks nothing like the document.

What the first hour of a cyber incident looks like

The plan says: convene the incident response team, assess severity, follow the communication matrix. The first hour contains questions like these. Who has the authority to take the finance system offline during month-end? The plan's contact for the hosting provider left last year, so who has the account details now? Legal wants everything preserved and operations wants everything restored, and both are talking to the same engineer. Is the attacker reading this email thread?

They come up in almost every real incident, and none of them can be answered from a document under pressure. People who have faced them before, even in rehearsal, can answer them.

How to run an incident response tabletop exercise

A tabletop exercise is a structured walkthrough of a realistic scenario with the people who would respond: IT, leadership, legal, communications, and whoever owns the customer relationships. The scenario unfolds in stages, with injects that force decisions.

The scenarios worth running are the hard ones. Ransomware detected on a Friday night with backups of unknown integrity. A business email compromise discovered after the payment went out. A vendor breach where your data is affected but your systems are not. Each one tests a different handoff between teams, and handoffs are where responses fail.

Two rules make the exercise useful. First, decisions have to be made in the room, out loud, by the person who would really make them. "We would consult legal" is not a decision. Second, someone writes down every question the team was unable to answer, because that list is the main output. It converts directly into fixes: an updated contact list, a pre-agreed authority to isolate systems, a break-glass communication channel that does not run through the possibly compromised tenant.

Evidence preservation and out-of-band communication

Evidence preservation is the discipline that separates a managed incident from an expensive one. The instinct in the first hour is to switch things off and rebuild. Done wrong, that destroys the forensic record your insurer, your regulator and possibly a court will later ask for. Rehearsal is where people learn that isolation and preservation come before eradication, so the lesson does not arrive during the real thing. Insurers increasingly ask about it; see what insurers and auditors expect.

The out-of-band channel is the other part people skip. If your tenant is compromised, your incident coordination cannot run on it. Agreeing where the response team meets when email and Teams are unavailable takes ten minutes in a tabletop and is close to impossible to improvise at 11pm.

How often to run a tabletop exercise

Once a year is the minimum, twice is better, and the plan needs another run after any significant change to systems or people. The exercise takes half a day, against the weeks of disruption a mishandled incident routinely causes. Keeping the plan current between exercises is part of what a vCISO does.

Frequently asked questions

What is a tabletop exercise in incident response?

It is a structured walkthrough of a realistic incident scenario with the people who would respond. The scenario unfolds in stages, and each stage forces the team to make decisions out loud.

How long does a tabletop exercise take?

About half a day. The follow-up work, such as updating contacts and agreeing authority to isolate systems, comes afterwards.

How often should we test our incident response plan?

At least once a year, preferably twice, and again after any significant change to systems or people.

Who should attend an incident response tabletop exercise?

IT, leadership, legal, communications and whoever owns the customer relationships. Decisions should be made by the person who would make them in a real incident.

Which scenarios should we rehearse?

Start with ransomware with backups of unknown integrity, a business email compromise discovered after a payment, and a vendor breach that affects your data but not your systems.

Our cyber security practice runs tabletop exercises and incident response. Our virtual CISO (vCISO) service includes a tested incident response plan and keeps it current between exercises.

Ben Jones leads the cyber security practice at Coder Trove.