Tabletop Exercise Template

Purpose

Use this template to practice how the company would respond to a cybersecurity incident without disrupting real systems.

A tabletop exercise presents a realistic scenario and asks participants to explain what they would do, who they would contact, what decisions they would make, and what information they would need.

The goal is to identify gaps before a real emergency occurs.

Exercise Information

Exercise ID: ____________________

Date: ____________________

Facilitator: ____________________

Participants: ____________________

Scenario: ____________________

Expected duration: ____________________

Suggested Participants

Depending on the scenario:

Leadership
IT
MSP
Finance
HR
Legal
Cybersecurity
Communications
Operations
Relevant business owner

Scenario Options

Examples include:

Ransomware
Business email compromise
Supplier payment fraud
Compromised executive mailbox
Lost laptop containing sensitive information
Cloud data exposure
Critical SaaS outage
Vendor compromise
Insider misuse
Website compromise
Stolen administrator credentials

Exercise Scenario

Initial situation:

Example:

“Finance reports that several employees cannot access shared files. IT identifies unusual file encryption activity on a server. The backup console is also showing unexpected administrative changes.”

Stage 1: Detection

Ask:

Who receives the initial report?
Who decides whether this is an incident?
Who becomes Incident Response Lead?
Where is the incident recorded?
Which communication channel is used?
What evidence should be preserved?

Participant observations:

Stage 2: Escalation

Introduce additional information:

Example:

“The MSP believes an administrator account may be compromised.”

Ask:

Who must be notified?
Does leadership need to be involved?
Should the insurer be contacted?
Is external incident response support available?
Who has authority to take systems offline?

Observations:

Stage 3: Containment

Introduce:

Example:

“Similar activity appears on two additional devices.”

Ask:

Which accounts should be disabled?
Which devices should be isolated?
Should remote access be restricted?
How will backups be protected?
What business disruption will containment create?
Who approves significant containment actions?

Observations:

Stage 4: Business Impact

Introduce:

Example:

“Customer orders cannot currently be processed.”

Ask:

Which business processes are most important?
What workarounds are available?
Who communicates with employees?
Do customers or vendors need information?
What should the company avoid saying before facts are confirmed?

Observations:

Stage 5: Recovery

Introduce:

Example:

“A clean backup appears available, but the original entry point has not yet been fully confirmed.”

Ask:

Should recovery begin?
How will the company determine whether the restore point is trustworthy?
What security changes are needed before restoration?
Who validates restored systems?
Who approves return to service?

Observations:

Stage 6: After the Incident

Ask:

What evidence should be retained?
Who performs the post-incident review?
What regulatory, contractual, insurance, or customer reporting may be required?
How are improvement actions assigned?

Observations:

Exercise Findings

What Worked Well

Responsibilities That Were Unclear

Missing Information

Missing Contacts

Technical Gaps

Process Gaps

Training Gaps

Recovery Gaps

Improvement Actions

Action: ____________________

Owner: ____________________

Priority: ____________________

Due date: ____________________

Evidence required: ____________________

Repeat for each significant finding.

Exercise Completion

Facilitator: ____________________

Leadership reviewer: ____________________

Exercise date: ____________________

Actions transferred to Improvement Action Tracker:

Yes / No

Next exercise date: ____________________

Evidence location: ____________________

Practical Rule

A tabletop exercise should expose confusion while the company still has time to fix it.

The most useful question is:

“If this happened today, would everyone know what to do next?”