How to run a tabletop exercise

What a tabletop exercise is

A tabletop exercise gathers the people who would handle a real incident and walks them through a scenario, step by step, in a meeting room or video call. Nothing is switched off and no systems are touched. A facilitator describes what is happening, adds new developments every few minutes and asks the group what they would do, who they would call and what information they would need.

The aim is not to test individuals or find someone to blame. It is to test the plan, the contact list and the decision-making process. Most organizations find a handful of practical gaps the first time, such as a missing phone number or an unclear decision about who can authorize shutting down systems.

Choose a realistic scenario

Pick a scenario that could plausibly happen to your business. Good starting points for small and mid-sized organizations include ransomware encrypting the file server on a Monday morning, a compromised finance mailbox used to redirect a supplier payment, a lost laptop containing client information, or a key cloud vendor suffering an outage. The Canadian Centre for Cyber Security publishes guidance that can help shape realistic scenarios.

Write the scenario as a series of short updates, called injects, that reveal information gradually. Each inject should force a decision. For example, the first might report that staff cannot open files, the second that a ransom note has appeared, and the third that a journalist is calling. Prepare five to eight injects for a first session.

Invite the right people

Include the people who would actually be involved: the owner or senior leader, operations, finance, whoever handles communications and your IT provider. Keep the group to about six to ten people so everyone participates. If your plan relies on outside parties such as your insurer, lawyer or incident response firm, invite them or have someone play their role.

Choose a facilitator who knows the scenario but will not be making decisions. That might be your IT provider, a virtual CISO or a trusted manager. Assign a separate note-taker to capture decisions, questions and gaps as they come up, so the facilitator can focus on keeping the discussion moving.

• Leadership and decision-makers
• Finance and operations
• Communications or client relations
• IT provider or internal IT
• Insurer, legal or responder, if possible

Running the session

Plan for about ninety minutes to two hours. Start by explaining the ground rules: there are no wrong answers, the scenario is fictional, and the goal is to learn. Then introduce the first inject and ask open questions. Who needs to know? What do we do first? Where is the plan, and can we reach it if our systems are down? Let the group struggle a little before offering hints.

Watch for moments of uncertainty, disagreement or reliance on a single person. These are the most valuable findings. Keep the pace steady, and do not let the discussion become a technical deep dive that loses the non-technical participants. Ask the note-taker to flag them. Encourage quieter participants to speak, since the person who answers the phones or manages the office often knows details that leadership does not.

Turn lessons into action

End with a short debrief. Ask what went well, what was unclear and what surprised people. Within a week, send a brief summary with a list of actions, each with an owner and a due date. Typical actions include updating the contact list, printing an offline copy of the incident response plan, clarifying who can approve payments during a crisis and confirming insurance notification requirements.

Run a tabletop at least once a year, and change the scenario each time. Over time, the exercises build familiarity and calm, so that if a real incident happens, people already know their roles and the first steps feel familiar rather than overwhelming. Repeat a scenario only when you want to confirm that earlier gaps have actually been fixed.