For small and medium-sized businesses (SMBs), knowing who makes key decisions during a cyberattack is essential. A cybersecurity tabletop exercise helps teams identify responsibilities, test response procedures, and clarify escalation paths before an actual breach occurs. Through guided discussions rather than live system testing, businesses can improve their incident readiness without disrupting daily operations.
Why a discussion-based test fits a working business
NIST SP 800-53 Rev. 5 includes control IR-3, which asks organizations to test the effectiveness of their incident response capabilities at a frequency they define. The control identifies checklists, walk-throughs, tabletop exercises, and simulations as acceptable testing methods. NIST’s exercise guidance, SP 800-84, also classifies tabletops as discussion-based exercises. This makes them appealing to businesses: they can test their response plans without shutting down operations, rerouting systems, or simulating incidents on production systems.
Few SMBs are directly subject to NIST SP 800-53, but it remains a useful benchmark. PCI DSS, for example, also requires organizations to test their incident response plans at least annually.
Choose scenarios that match your real exposure
Generic scenarios tend to produce generic answers, so choose two or three situations that reflect the business’s actual risks. These might include ransomware affecting the main file server, a hijacked email account sending a fraudulent payment request, a lost laptop containing customer records, or a breach at a SaaS vendor that stores business data.
Write each scenario as a short narrative, then prepare three or four scenario updates, known as injects. These are new details the facilitator introduces at specific intervals. For example, an inject might reveal that backups are also encrypted or that a customer has reported receiving suspicious emails. Introducing information in stages encourages participants to make decisions with incomplete information, just as they would during a real incident.
Assign decision-making responsibilities beforehand
Confusion over who decides is among the most common failures in a live incident, so the exercise should expose it. List the decisions most likely to arise: isolating affected systems, contacting the cyber insurance carrier, engaging legal counsel, notifying customers or regulators, deciding whether to pay a ransom, and approving public statements. Name an owner and a backup for each.
Invite the people who would actually hold those roles. That usually means IT or the managed services provider, an executive sponsor, legal or compliance, HR, and whoever handles communications. Assign some to take notes, recording decisions, assumptions, and open questions.
Test escalation, not just technical response
Technical steps tend to get the attention while escalation paths do not. Walk through who is contacted first, when the executive team joins, and how each person is reached. Ask what happens if email and the phone system are down, since many plans assume both are available. Confirm that contact details are current, including after-hours numbers for the IT provider and the insurer. Note how long each handoff takes in discussion, because a delay that seems minor around a table becomes serious in a live event.
Keep the session short and low-risk
Schedule the exercise at a quiet time, cap it at 90 to 120 minutes, and keep essential coverage in place so customer-facing work continues. A neutral facilitator, either an outside party or someone who does not own the plan, keeps the pace moving and the tone blame-free. The aim is to find weaknesses in the plan rather than in the people reading it.
Measure readiness with criteria set in advance
Define success before the session starts. Useful measures include whether every decision had a named owner, how long the group took to agree on a first containment step, whether contact lists proved accurate, and how many steps turned out to be unclear, outdated, or impossible to carry out. Record each gap with an owner and a due date in a short after-action report, ideally within a week.
Two weaknesses recur: findings that never make it back into the plan, and key people who were left out of the room. Updating the plan promptly and retesting the revised sections turns a single exercise into steady improvement. NIST also encourages coordinating incident response testing with related plans, such as contingency planning, so the next session can pick up where this one’s backups failed.
Want a tabletop exercise built around your own systems, staff, and risks? Our team can facilitate the session, document the findings, and help turn them into a stronger response plan. Reach out whenever you are ready to schedule one.