The Importance of Tabletop Exercises

Sometimes a cybersecurity emergency can feel like a battleground — and nobody wants to enter a war zone without a game plan.

One of the most effective strategies for risk preparedness is a tabletop exercise. A tabletop exercise is a classroom-style strategy session where team members talk out their roles and pre-planned responses for an emergency situation. Even the Health Insurance Portability and Accountability Act (HIPAA) now requires tabletop exercises for the medical community to prepare for cybersecurity breaches.

To help, we’ve written a handy overview of tabletop exercises so you can prep your business for tomorrow like a five-star general.

What to Expect From a Tabletop Exercise

A cybersecurity tabletop exercise may seem stressful, but it can be an engaging learning experience with the right expectations.

It’s an informal, guided learning experience that builds teamwork and should not feel like a test or quiz. Even if an organization has many processes to review, each exercise should be one to two hours long, with three to four main objectives.

This limit will ensure teams don’t bite off more than they can chew. A facilitator writes a scenario, like a ransomware attack, and asks employees questions to encourage them to work together and develop creative solutions based on their jobs. Once the project is complete, the facilitator should deliver a tabletop exercise report.

How to Prepare for a Tabletop Exercise

Walking through cybersecurity tabletop exercise samples can help you understand the process. In our example, the exercise facilitator needs to prepare for a ransomware attack scenario with several steps:

• Questions: The facilitator creates a script of questions about what each person would do during an attack.
• Scheduling: Each department’s executives and representatives need to be present for training.
• Twists: The facilitator should write twists to make the situation worse as the exercise continues, forcing different departments to reconsider their roles and create new solutions.

Benefits of a Tabletop Exercise

A tabletop exercise can help your teams and strategies grow. A well-done exercise approaches a problem from every angle and reveals flaws in even the best-laid plans. This journey builds your team’s critical thinking and helps employees understand how their job would fit into an emergency situation. The process can also help the facilitator find new preparedness objectives for the company that may not have been obvious before.

This exercise can also give teams peace of mind because they’ll gain experience and know to expect the unexpected with cybersecurity risks.

Need a Helping Hand?

Knowing where to begin with running tabletop exercises may seem overwhelming, but it doesn’t have to be. We offer an Incident Response Service with tactical tabletop exercises and a U.S. Securities and Exchange Commission (SEC) Cybersecurity Governance Program with C-suite tabletop exercises and whiteboarding sessions. Learn more about our cybersecurity services.

We’d love to discuss partnering with you. Call 877.780.2446 or fill out our contact form to get in touch.