A tabletop exercise tests how your people would use the plan: the decisions they make, the information they need and the way they coordinate a response.
How is an exercise different from a plan review?
A plan review considers the written arrangements. A tabletop exercise asks the team to use those arrangements within a developing scenario. Participants discuss what they would do, why they would do it and what they need from other people.
That discussion can reveal assumptions about ownership, escalation and dependencies that were difficult to see on the page. The scenario is agreed around your organisation and the decisions you want to explore.
What decisions can we explore?
The right decisions depend on the exercise objectives and the people involved. A technical team, a cross functional management group and an executive team may each need a different scenario and level of detail.
Areas to explore can include:
- Recognising the incident and deciding when to escalate.
- Coordinating technical activity with leadership and business operations.
- Preparing communications for staff, suppliers and other relevant stakeholders.
- Agreeing recovery priorities when time and information are limited.
- Recording decisions and assigning the actions that follow.
Will the exercise disrupt our live systems?
Our tabletop exercises are facilitated discussions. They do not require the team to attack or interrupt live systems. The scenario creates a space to practise judgement and coordination within the agreed scope.
Technical testing is a separate engagement with its own authorisation, assets and boundaries. A tabletop exercise and a penetration test answer different questions; both can contribute to your wider resilience programme.
What should we receive afterwards?
The debrief captures immediate observations while the discussion is fresh. An After Action Report then records the lessons, recommendations and agreed areas for improvement, with a scorecard aligned to the exercise objectives.
The purpose is useful learning rather than a pass or fail judgement. Your next step might be to update the plan, clarify a responsibility, refresh a contact route or run a later exercise focused on a particular decision.
How do we choose the right format?
Begin with the people who need to practise and the outcomes you want to explore. Our tactical, operational and strategic formats support different audiences and levels of responsibility. Scope, preparation and delivery are agreed before the engagement.
If you already have an incident plan, an exercise can help you understand how it would be used. If the arrangements are still being developed, start by clarifying the roles and response structure so the rehearsal has a useful foundation.
