A tabletop exercise should create useful discomfort.

The goal is not to demonstrate that the incident plan looks complete. It is to reveal where people lack authority, information, access, recovery options, or a shared understanding of the system.

A successful exercise produces better decisions after the meeting.

Choose A Plausible Scenario

Build the scenario from real dependencies and business impact.

Examples include compromised vendor access, ransomware reaching shared storage, stolen administrative credentials, an edge device used as a foothold, or a deployment artifact with uncertain provenance. Include the physical, network, application, identity, customer, and communication effects that would actually interact.

Avoid scenarios so catastrophic that every answer becomes “everything is down.”

Reveal Information In Stages

Provide evidence as responders would receive it: an alert, support report, access event, failed recovery step, media question, or new indicator.

Do not give the group a complete answer at the beginning. Ask what they know, what they assume, what they need next, and who can authorize action.

Uncertainty is part of the test.

Test Decisions And Tradeoffs

Focus on whether to isolate systems, revoke access, stop deployment, notify customers, engage vendors, preserve evidence, restore backups, or accept temporary business impact.

Record the decision owner, required evidence, deadline, downstream effect, and fallback. Identify conflicts between technical recovery, legal obligations, safety, and customer communication.

Turn Findings Into Work

Capture missing contacts, unclear ownership, inaccessible documentation, broken credentials, absent telemetry, untested backups, and policy gaps.

Assign each finding an owner and completion date. Retest important fixes. The exercise has little value if observations remain meeting notes.

Run The Defense Test

Identify what the response team initially trusts. Test how access is restricted. Practice containment choices. Confirm which evidence survives. Rehearse recovery without erasing investigative context.

The exercise is not the performance. The operational improvement afterward is the result.