Most organizations have an incident response plan. Very few have ever walked through it once, start to finish, with the people who will have to apply it. So the first day it is used is also the day you find out what is missing: the IT provider's number that nobody has outside the email system, the person who can decide to stop production, the insurance policy whose first steps nobody knows.
A plan that has never been tested is not a plan. It is an assumption. The good news: an hour, a room and five people are enough to check it.
Why a tabletop exercise first
In our business continuity guide, we recommended testing the restore, not the backup, and starting with a tabletop exercise. It is the cheapest format and often the most revealing: no system is touched, a scenario is played out around a table, and you watch where decisions get stuck.
In its baseline controls for small and medium organizations, the Canadian Centre for Cyber Security asks for a formal incident response plan that lists the internal people, external parties and regulators to contact, with a paper copy in case the digital version is unavailable. A tabletop exercise is the simplest way to check that this list exists, is current, and that everyone knows where to find it. CISA, the US cybersecurity agency, offers more than one hundred ready-to-use tabletop exercise packages, with scenarios, discussion questions and an after-action report template: you do not have to invent everything.
What it changes: the exercise does not measure technology, it measures decisions. Who decides, with what information, how fast, and who tells whom.
Who to invite: your community, not just your team
October is ending, and with it Cyber Security Awareness Month, whose last week this year is "Build your cyber security community". For an organization, the crisis community goes well beyond the org chart. On the day of an incident, you will depend on people you do not all pay, or not directly.
The NIST Cybersecurity Framework 2.0 makes it an explicit outcome: relevant suppliers and other third parties are included in incident planning, response and recovery activities (GV.SC-08). In practice, for a small or mid-sized organization, the table brings together five to seven people:
- The decision-maker: the CEO or a named deputy. Without them, the exercise tests nothing.
- Finance: payments, cash, insurance.
- Operations: what stops, and what can keep running in degraded mode.
- Internal IT, and the external IT provider if you have one. It is often the first time the provider sees the client's plan.
- Whoever handles communications, or whoever will talk to customers and staff.
- One person who does not play: they facilitate, read out each step and record decisions and gaps.
If you have cyber insurance, keep the claims number at hand and know what the policy requires in the first hours. If you hold personal information, bring the person responsible for protecting it, or at least their name and number.
The run sheet: 60 minutes, four parts
The facilitator reads each step out loud, then lets the table decide. They do not give the answer. They ask the questions and take notes.
Part 1, minutes 0 to 15: discovery. Monday, 7 a.m. The IT provider calls: its remote management tool was compromised over the weekend, and several of its clients have encrypted files. In your environment, email is down and a workstation shows a ransom note. Questions: who is told first, and how, if email is down? Who has the authority to isolate the network or shut down a system? Where is the paper copy of the plan?
Part 2, minutes 15 to 30: scope. 8:30 a.m. The business system is unreachable; billing and shipping have stopped. Backups exist, but nobody knows yet whether they were hit. Questions: what can run in degraded mode today, on paper? Who calls the insurer? How long can you hold before the outage costs you a customer?
Part 3, minutes 30 to 45: the outside world. 10 a.m. A major customer calls: they received a suspicious email that seems to come from your accounting team. An employee asks whether they should come to work tomorrow. Questions: who talks to customers, and what do you say when you do not know everything yet? Could personal information have been accessed? Under Canadian privacy law, a breach that creates a real risk of significant harm must be reported to the regulator and to the people affected, and in Quebec every confidentiality incident must be logged: who makes that assessment, and on what basis?
Part 4, minutes 45 to 60: the debrief. Stop the scenario. Everyone says in one sentence what surprised them. The facilitator reads back the gaps. The table picks three actions, no more, each with a named owner and a date.
Three traps
Playing the technology. The discussion drifts to the ransomware strain or the firewall configuration. Bring it back to decisions: who decides, when, with what.
Looking for someone to blame. The exercise is there to find gaps in the plan, not in people. If someone did not know what to do, the plan did not tell them.
Leaving without actions. An exercise that ends with "that was interesting" changes nothing. Three actions, three names, three dates: that is the only deliverable that counts.
This weekend's test
Before you even schedule the exercise, answer three questions alone, on paper:
- If email and the network went down Monday at 7 a.m., how would you reach your four key people? Do you have their numbers anywhere other than your work phone?
- Have your IT provider and your insurer ever seen your incident response plan?
- When was your plan last walked through, start to finish?
If the answer to the third question is "never", you know what to put on next month's agenda.
What you should have after the exercise
One page. The scenario you played, the date, who was there, the gaps you found and three actions with their owner and date. Run it again in six months with a different scenario, a critical vendor outage or a payment fraud for example, and compare the two pages. The continuity vocabulary is in our entry on business continuity.
Sources: Canadian Centre for Cyber Security, Baseline Cyber Security Controls for Small and Medium Organizations · CISA, Tabletop Exercise Packages (CTEP) · NIST, Cybersecurity Framework 2.0 (CSWP 29) · CSE, Cyber Security Awareness Month 2026