Do you remember doing fire drills in school? They were always a welcome break on tedious school days. But they also taught you an important lesson: Hope for the best, prepare for the worst.

It’s a concept that even elementary school children can understand. Yet, in the business world, we sometimes forget to prepare for the unique disasters that can happen to us. Especially when it comes to cyber-attacks.

So, what is a tabletop exercise?

A tabletop exercises (also known as TTX) is basically your organization’s way of doing a dry run for a cyber attack. Think of it as a role-playing game where IT pros, execs, and anyone else who’s crucial when things go south, pretend there’s a massive attack on their systems. They all huddle up and brainstorm how they’d react in real-time, figuring out who drops the ball and where the plan leaks.

Typically, you might use a TTX to help test your disaster recovery (DR) or business continuity plan (BCP). These are plans that you should already have developed and written down before a cyber incident ever happens! But don’t fret, even if you don’t have any plans written down, tabletop exercises are great for helping you brainstorm them.

7 Goals of Tabletop Exercises

You could have all manner of reasons for running a TTX exercise, but here are 7 common ones we’ve noticed in our experience running tabletop exercises for our clients at EliteSec.

1. Identifying Weaknesses and Gaps: One of the primary goals is to identify weaknesses in current plans, procedures, and resources. This identification helps organizations make the necessary adjustments to strengthen their overall preparedness.
2. Enhancing Coordination and Communication: Tabletop exercises provide a platform for team members from various departments to collaborate and communicate. This improves understanding and cooperation across different parts of the organization, which is vital during actual emergencies.
3. Improving Decision-Making Skills: By simulating crisis situations, participants can practice making critical decisions under pressure. This helps in refining decision-making processes and ensuring that team members are better equipped to handle real incidents.
4. Testing Plans and Procedures: Exercises test the effectiveness of current emergency response plans and procedures. They allow organizations to see how theoretical plans perform in a simulated but realistic situation.
5. Training and Education: They serve as training sessions for team members to understand their roles and responsibilities during an emergency. This educational aspect is crucial for new employees or when new procedures are introduced.
6. Building Confidence: By going through the motions of an emergency in a controlled environment, team members build confidence in their abilities and the organization’s emergency management system.
7. Compliance and Auditing: For many organizations, regular tabletop exercises are part of regulatory compliance or internal auditing processes to ensure ongoing preparedness.

When to Run A Tabletop Exercise

Holding a tabletop exercise is important for keeping your team prepared and making sure your emergency plans work well and are current. Here are some tips on when to organize a tabletop exercise:

After Updates to Emergency Plans

Whenever there are significant updates or changes to your DR or BCP, it’s essential to run a tabletop exercise. This ensures that all relevant personnel are familiar with the changes and can implement them effectively during an actual emergency.

Following an Actual Incident

After experiencing a real-life hack, conducting a tabletop exercise is beneficial to review the response and identify what worked well and what didn’t. This can be crucial for refining your plans based on practical experience.

Introduction of New Technologies or Processes

If your organization introduces new technology or processes that significantly impact operations, a tabletop exercise can help ensure that these new elements are effectively integrated into your emergency response strategies.

Change in Personnel

Significant changes in personnel, especially within critical roles involved in emergency response (like security, operations, or management), can necessitate a tabletop exercise to ensure new staff are prepared and aware of their roles in a crisis.

Regulatory or Compliance Requirements

Certain industries are required by law or industry standards to conduct regular emergency preparedness exercises.

For instance, the finance and healthcare industries often have more rigorous rules regarding cybersecurity given that such companies hold sensitive customer data.

Periodic Review

Even if none of the above changes occur, it’s wise to hold tabletop exercises regularly (e.g., annually or biannually) to keep all team members sharp and ensure ongoing familiarity with emergency procedures. Imagine if you stopped driving for 5 years. You would be a little rusty the next time you got behind the wheel. That’s why maintaining familiarity with these procedures is critical.

After Significant Organizational Changes

Major organizational changes, such as mergers, acquisitions, or restructuring, can impact how your organization responds to emergencies. A tabletop exercise can help realign plans and ensure coordination among new or restructured teams.

3 Alternatives to Tabletop Exercises

Now, before you launch into setting up a tabletop exercise, you should take stock of all your alternatives. This is important because many organizations confuse each of these 3 exercises with TTX exercises.

Make sure you know the difference!

Tabletop Exercises vs. Walkthroughs

Tabletop exercises and walkthroughs both serve to familiarize participants with emergency procedures, but they differ significantly in their approach and depth of engagement. Walkthroughs involve a physical or verbal review of specific procedures, allowing participants to understand step-by-step actions in a low-stress environment. They are generally less about decision-making and more about procedural familiarity. In contrast, tabletop exercises are more interactive and focus on strategic decision-making under simulated crisis conditions.

Tabletop Exercises vs. Functional Exercises

Functional exercises involve real-time response where the cybersecurity team actively uses its tools and protocols to detect, respond, and mitigate a simulated cyber threat, testing the operational capabilities of systems and the technical proficiency of responders. Functional exercises provide a hands-on experience and are crucial for testing the practical aspects of cybersecurity plans, making them more dynamic and technically rigorous compared to the more conceptual and management-focused tabletop exercises. This is a lot more hands-on than the discussion-based exercises that you see with Tabletop exercises.

Tabletop Exercises vs. Full-Scale Exercises

A full-scale exercise is usually only necessary for extremely large organizations with boatloads of sensitive data. Think of a military base or a hospital. More than likely, you don’t have the required attack surface area to run one. Think of it as a hyper-realistic version of a functional exercise, which is already a step beyond tabletop exercises.

Tabletop Exercise Examples: How to Run Your Own Tabletop Exercise Like A Pro

Define Objectives

Start by determining the specific goals you want to achieve with the exercise. Objectives might include testing specific aspects of your emergency response plan, improving communication among team members, or simply increasing awareness of potential scenarios.

Select a Scenario

Choose a realistic scenario that could potentially impact your organization.

Here are 3 examples of tabletop exercise scenarios:

1. Simulate a ransomware attack on company servers.
2. Handle a data breach involving customer financial information.
3. Manage a distributed denial-of-service (DDoS) attack on websites.

Develop the Scenario and Script

Create detailed threat scenarios and a script that outlines how the exercise will progress, including key events and decision points. The script should guide participants through the various stages of the emergency, providing enough detail to provoke thought and discussion.

Ideally, you want to make your exercise gamified. That is, there should be multiple different paths for you to go down during your simulation. It could be as simple as rolling a 6-sided die to go over different (and surprising) scenarios among different groups of people. That’s usually how we run our tabletop exercises at EliteSec.

Identify Participants

Select participants from across your organization who will play roles in the exercise. This often includes key personnel like senior management, operational staff, and any specific teams critical to the scenario (e.g., IT, HR, security).

Assign Roles

Clearly define and assign roles to participants, ensuring they understand their responsibilities during the exercise. You might also assign roles to facilitators and observers who can provide feedback and evaluate the exercise.

Schedule and Prepare Logistics

Set a date and time for the exercise that minimizes disruption to your operations. Prepare the venue, ensuring there is adequate space and necessary technology (like projectors, telephones, computers) to run the exercise effectively.

Conduct a Pre-Exercise Briefing

Before starting the exercise, hold a briefing to explain the format, scenario, objectives, and rules. Ensure all participants understand the expectations and how the exercise will be conducted.

Run the Exercise

Start the exercise according to your script. Facilitators guide the discussion, ensuring that all aspects of the scenario are explored and that participants engage in problem-solving. Inject new information as needed to simulate real-time updates that might occur during an actual incident.

Monitor and Document

Throughout the exercise, observers and facilitators should monitor the proceedings and take notes on performance, decision-making, and any issues that arise. This documentation is crucial for the post-exercise review.

Conduct a Debrief

Immediately after the exercise, conduct a debriefing session to discuss what went well and what could be improved. Encourage honest feedback and open discussion to identify lessons learned and practical steps for improvement.

Prepare an After-Action Report

Compile the observations and feedback from the exercise into an after-action report. This report should summarize the exercise, highlight successes, identify gaps, and recommend changes to plans and procedures.

Implement Improvements

This is where a lot of organizations tend to mess it up. Don’t let entropy get in the way of developing a proper cybersecurity strategy. Once you have insights from your tabletop sessions, you must create a plan of action to address each issue.

Based on the after-action report, implement the necessary changes to your emergency plans and procedures. This might involve training, revising documentation, or changing organizational structures.

Schedule Regular Exercises

Tabletop exercises should be a regular part of your organizational preparedness efforts. Schedule them periodically to continue building resilience and adapting to new threats.

Run a Tabletop Exercise with EliteSec

Tabletop exercises are about hypotheticals. Let’s run a quick hypothetical of our own right now.

Say you don’t run a tabletop exercise, what do you have to lose?

In the event of a cyber attack, your whole team is unprepared. Even though you might have technical safeguards in place, your team’s response could worsen the situation. Not only might you lose money, but you could also risk your reputation in the market.

On the other hand, if you just devoted a few hours to tabletop exercises now, with periodic reminders and updates, you stand to lose a lot less. Effective response procedures are the mark of a mature organization.

At EliteSec, we can help design and run gamified tabletop exercises to help you simulate realistic scenarios of what could happen in a potential security breach. Reach out to us for a call to start preparing the best responses to the worst-case scenarios. Contact us today so we can help prepare you for the unexpected.