Tabletop exercise

A tabletop exercise is a discussion-based practice session in which key staff walk through a realistic incident scenario to test their response plan, roles and decision-making.

A facilitator presents a scenario, such as ransomware on a Monday morning or a fraudulent payment discovered at month end, and reveals new developments step by step. Participants discuss what they would do, who they would call and what information they would need. No systems are touched. The goal is to uncover gaps in plans and assumptions before a real crisis.

Many small businesses have an incident response plan that has never been tested. A tabletop exercise often reveals simple but important problems: nobody knows how to reach the insurer's breach hotline, backups are older than expected or the contact list lives on the server that just went down. Insurers and larger clients increasingly ask whether plans have been exercised.

Practical tip: run a short tabletop at least once a year and include leadership, finance, operations and your IT provider. Keep it to about an hour, record the lessons learned and assign owners to fix each gap.