Desk of a CISO: Why Tabletop Exercises are Crucial for Your Incident Response Plan

Updated October 20, 2026, with revised exercise recommendations and incident response guidance.

The Art of Preparation: Why Tabletop Exercises are Crucial for Your Incident Response Plan

Having an incident response (IR) plan is an essential starting point. You also need to practice using it. Tabletop exercises give your team an opportunity to work through an incident, understand their responsibilities and identify gaps before a real emergency.

The Value of Testing

Testing your IR plan helps identify gaps between assumptions, expectations and how your team would respond. It helps company leaders understand their roles before a real incident puts them under pressure.

A tabletop is a discussion-based exercise. It tests decisions, communication and coordination. Separate technical exercises are needed to verify that your team can carry out procedures such as isolating systems and restoring backups.

NIST’s updated incident response guidance, published in April 2025, reinforces the importance of incorporating lessons learned into ongoing cybersecurity risk management.

Who’s at the Table?

It might be tempting to focus these exercises on your technical teams. My recommendation is to involve senior leadership alongside the people responsible for coordinating the incident response. That gives both groups an opportunity to work through decisions that could significantly affect the business.

Suggested participants include:

• CEO, President, COO and CFO
• Legal, HR and Marketing or Communications leaders
• The incident response lead and relevant IT and Security representatives
• Line of business leaders, including operations or plant leadership when appropriate
• A facilitator and a note-taker

Identify alternates for key decision-makers, too. An incident may happen when someone is unavailable.

Going Beyond the Norm

An effective tabletop exercise challenges participants with realistic scenarios and difficult decisions. Introduce complications, such as an unavailable executive, compromised communications or inaccessible backups, to see how the team adapts.

Run exercises regularly and revisit them after significant changes to your systems, leadership or response plan. The following are sample scenarios for use in a tabletop exercise.

Scenario 1: Ransomware Attack on Manufacturing Systems

Situation: The organization’s key manufacturing systems are infected with ransomware, affecting the ability to fulfill urgent orders. The attacker also claims to have stolen sensitive data.

Key decisions:

• Who activates the incident response plan?
• Who can authorize isolating systems or stopping production, and what are the safety implications?
• Who determines if the company should involve law enforcement?
• When should cyber insurance be contacted, and by whom? Is the contact information in the IR plan?
• What happens if the primary backups are unavailable or compromised?
• Are customer contracts affected? If so, what obligations does the company have?
• Media outlets have started calling about the attack. Who speaks with them, who drafts public statements and what information can be shared?

Scenario 2: Insider Data Theft

Situation: A high-ranking engineering leader is discovered to have stolen proprietary designs and is planning to resign.

Key decisions:

• Who activates the incident response plan and coordinates the investigation?
• How will the company preserve evidence and restrict access?
• Should law enforcement be contacted, and who should make that call?
• Who determines whether the incident creates legal, contractual or regulatory notification obligations?
• Should the insurance carrier be notified, who should call and is the number in the IR plan?

Scenario 3: Unauthorized Access to Financial Records

Situation: An audit reveals that an outside contractor had unauthorized access to sensitive customer financial data.

Key decisions:

• Who coordinates the response and determines the scope of the unauthorized access?
• What evidence is needed to establish whether information was viewed, copied or altered?
• Who assesses whether the incident constitutes a reportable breach and identifies applicable disclosure obligations?
• Should cyber insurance be notified?

Scenario 4: Supply Chain Compromise

Situation: You receive notice that critical software used in your billing process has been compromised in a third-party supply chain attack, potentially affecting the integrity of the company’s ERP platform. The COO has had surgery and is unavailable to assist with decision-making.

Key decisions:

• Who has decision-making authority while the COO is unavailable?
• Should any operations be halted?
• Who activates the incident response plan and coordinates with the software provider?
• What happens if the provider cannot confirm the scope of the compromise or provide a recovery timeline?
• Are any regulators, customers or business partners required to be notified?
• When should Legal be involved to assess contractual obligations?

Scenario 5: Phishing Attack Resulting in PHI Exposure

Situation: A successful phishing attack against the company’s benefits coordinator results in unauthorized access to records containing employees’ and dependents’ personally identifiable information and health-related information.

Key decisions:

• Who activates the incident response plan, and who assesses potential breach notification obligations?
• Are the affected records employment records or records maintained by the company’s group health plan?
• What privacy and notification requirements apply, particularly if affected individuals live in different states?
• When should cyber insurance be involved, and who makes that call?
• Should outside counsel be engaged?

The distinction between employment records and health plan records matters. Employee health information is not automatically protected by HIPAA, so the exercise should include determining which requirements apply.

Communication is Everything

A well-executed IR plan depends on clear lines of communication and accountability. Contact information for key personnel and third parties should be readily available, including an offline copy.

Also consider how the team will communicate if email, Teams or company accounts are compromised or unavailable. Crisis communication may warrant its own separate plan, coordinated with the IR plan.

Time is of the Essence

Legal, regulatory and contractual reporting requirements can have different deadlines and triggers. Your exercise should test who identifies those obligations, who approves notifications and how the team gathers the necessary information.

Containment and investigation should proceed while the appropriate team assesses notification requirements.

Adding a Fun Element

For those looking to elevate their tabletop exercises, consider investing in card decks like Backdoors & Breaches by Black Hills Information Security. They add an unscripted, evolving layer to your exercises, keeping everyone engaged.

What About the Tech Teams?

While senior leadership works through business decisions, include tactical exercises for your IT, Security and Engineering teams. Work through logging, detection, forensics and alerting so everyone understands their responsibilities.

Connect these exercises to leadership decisions. For example, a technical team may recommend isolating a system, while business leaders need to understand the operational impact and authorize the disruption.

Turn Lessons Into Action

After the exercise, document what worked and where the team struggled. Assign an owner and a deadline to each corrective action, update the IR plan and retest unresolved issues. CISA’s after-action report and improvement plan template provides a starting point.

Closing Thoughts

Tabletop exercises are more than just a dry run. They’re a rehearsal for reality. Done right, they not only prepare your organization for the worst. They also minimize downtime and reputational damage. So, why leave anything to chance?