Tabletop Exercise (Incident Rehearsal)

A tabletop exercise lets an organization rehearse its response to a hypothetical incident without disrupting production systems. A facilitator introduces a scenario, such as a compromised admin account or ransomware affecting appointment bookings, and asks participants what they would do as events unfold. The emphasis is on communication, responsibilities, available evidence, dependencies, and escalation—not on proving that a live technical recovery will work.

A useful exercise specifies objectives, roles, the scenario timeline, and assumptions. A small repair business might involve its owner, web provider, scheduling vendor, customer-support lead, and insurance contact. The group discusses who can disable access, how customers would be informed, where backups are stored, and who can authorize emergency spending. Record unresolved decisions and assign owners and dates for improvements.

A tabletop can reveal that a vendor's emergency number is outdated or that no one knows the recovery approval process. It cannot confirm backup restoration speed or vulnerability remediation; separate technical drills are needed for those outcomes. Avoid treating attendance as proof of security compliance. Regularly revisiting scenarios is useful because vendors, staff, and data flows change. Distinguish this preparedness exercise from root cause analysis, which investigates a real past incident after evidence is available.