4 min read
A tabletop exercise shows what your plan forgot
On a Friday at 6 p.m., the planning manager of a 400-person industrial company finds renamed documents and a ransom demand on a file server. The company is fictional, and six of its managers played out this imaginary evening on a Tuesday morning around a single table, in what is called a tabletop exercise. No system was touched and nobody ran. In three hours, though, the exercise brought out gaps that rereading the crisis plan had never shown, and that ability to reveal what a plan forgets is what makes the tabletop exercise the cheapest preparation tool available.
Three hours around a table
The principle takes few words. The people who would really sit in the crisis cell, here general management, IT, production, human resources, legal and communication, come together. A facilitator announces what is happening, the group says what it would do, and the facilitator develops the situation. In our fictional company, the evening unfolds in small touches. At 6:10 p.m., the ransom note is confirmed. At 6:25 p.m., the purchasing manager of a major customer writes that the week’s automatic orders have not arrived. At 6:40 p.m., the IT provider finds that the backup server is encrypted too. At 7 p.m., a local journalist calls the switchboard operator to ask whether the company is the victim of a cyberattack.
Each piece of information arrives when the facilitator gives it, not when the group is ready, which forces people to decide with what they know. That constraint, light around a table, is enough to bring out what a quiet reading of the plan left in the shadows.
What the exercise brings to light
What the group discovers that Tuesday resembles what many organizations discover. The crisis contact list is out of date: two of the numbers no longer answer. Nobody knows for certain who has the right to shut down a critical system on a Friday evening, with production running in three shifts. The lawyer hears about the incident late, at 7:30 p.m., when deadlines are already running. The General Data Protection Regulation (GDPR) provides for notification to the authority within 72 hours of becoming aware of a personal data breach, where one is required, and the NIS2 directive requires the entities concerned to issue an early warning within 24 hours for a significant incident. In the room, nobody knows who owns the decision to notify, or at what time the countdown began.
The communication team, for its part, does not know what it may say to the journalist, or whom to ask. Each of these points looks minor taken alone, and none appeared in the plan as a risk. Yet they have one thing in common: they do not show up in a document, they show up when someone has to act. The exercise forces everyone to turn each sentence of the plan into an action. “The crisis cell is activated” becomes a concrete question: activated by whom, and how do the others know?
How to run it so that it is useful
A few choices determine the value of an exercise. The first is the scenario: ransomware discovered on file servers on a Friday evening speaks to participants more than an improbable state-sponsored attack, because they can picture themselves in it. The second is the objective, which must be set from the start: you are testing decision-making and coordination, not people, and everyone must be able to say “I don’t know” without it being held against them. The third is the assignment of roles, given to those who would really hold them, because a director who plays the technician learns nothing about their own function.
The facilitator, finally, keeps time and takes notes. Right after the last piece of information, a hot debrief lets the group say what worked and what did not, and set for each gap an action, an owner and a date. That last step is the one most often rushed, even though it carries most of the value: a finding without an owner is forgotten within a month.
Its limits, and what comes next
The tabletop exercise has limits worth knowing. Preparing a good scenario takes several days of work, and the facilitator’s notes are often the only record of what was said. Above all, a group gathered in a quiet room says what it would do, which is not what it does at three in the morning with forty messages waiting: discussion sometimes replaces action, and the loudest voice in the group ends up deciding for the others. Finally, it is generally done once a year, which lets a plan age for eleven months between two tests.
These limits take nothing away from its value; they indicate what to add to it. After the exercise, each finding becomes an action, the plan is reread, and part of the evening is replayed a few weeks later to check that the fix holds. For the fictional company, that means a rebuilt contact list, a named owner for notification, and a sentence ready for the journalist. It is little, and it is precisely what was missing that Friday at 6 p.m.