Tabletop exercises
A tabletop with the people who would be called
A tabletop exercise is a structured hour, or a short series of hours, in which the people who would handle an incident walk a scenario out loud. The scenario is one of your systems failing in a way that is already plausible. We work around your normal operations, and we'll need access to the right areas and the right people while we do.
What a tabletop is
The scenario is not a movie plot. It is a shared admin login, a vendor account, a laptop with customer data, or a backup that will not restore.
The facilitator keeps the group on the decision in front of them. Who is called first. Who is allowed to disable an account. Where the timeline is written. What they would tell a customer if they had to speak before the facts were complete. Those questions are useless if the people who would answer them are not in the room.
We do not treat the tabletop as a test of how well someone memorized a policy. If the policy and the room disagree, the disagreement is the finding. We write it down. You do not receive a score.
How we facilitate
Before the exercise we read the plan, if you have one, and we pick one system with you. We need access to that system's record: who can change it, who would notice it is down, and when access was last reviewed. We also need the names of the people who would be called, and a time they can attend.
During the exercise we introduce the facts in pieces, the way an incident actually arrives. The first fact is rarely the whole story. We pause when two people give different owners for the same step. That pause is the work. We do not smooth it over to keep the hour pleasant.
You can decline the scope before the date is set. Once you approve it, we'll need access to the right areas and people. The exercise depends on attendance. If the person who can revoke access cannot be there, we reschedule or we write that absence as the finding. We will not facilitate a tabletop with substitutes who cannot act.
What is written after
You receive a record of what the room did: the call order they actually used, the step that had no owner, the fact they could not produce, and the change they agreed to make. The record is plain. It is not a slide.
If the hour produces a named owner and a revoke step someone has demonstrated, that is a result. If it produces an argument about who decides, that argument is also a result, and it goes into the plan. The playbooks are updated from this record, not from the scenario we hoped to run.
A second exercise is a separate scope. One exercise that the right people attended is more useful than a series held for people who will not be called.
What this is not
A tabletop is not a penetration test, and it is not a live failover. We do not exploit a system, and we do not pull a production restore unless that restore is the engagement on the backup and recovery testing page.
We do not run the exercise as a private review and then tell you how your staff would have behaved. The people have to be there. We work around your normal operations, and we'll need access to the right areas and the right people while we do.
We do not sell a retainer that sits on the phone after the exercise. Readiness is the record they can use next time. A response firm, if you need one for an active breach, is a different contract, and we will say so.
Questions
What does a tabletop exercise facilitator do?
We bring a scenario based on one of your systems, sit with the people who would be called, and write what they actually do in the first hour. The exercise needs those people in the room. We do not run it as a slide deck in their absence.
How long is a tabletop?
We scope the length in writing before it starts. A useful exercise is long enough to reach a decision: who is called, who can revoke access, and where the record is written. A short meeting that never names an owner is not a result.
Contact
Task us with the scenario you want to rehearse.
Name the system. We will say if a tabletop is the wrong first step. We work around your normal operations, and we'll need access to the right areas and the right people while we do.