Tabletop exercise: half a day in the crisis team

Many companies shy away from exercises because they picture elaborate disaster tests: shutting down systems, weekend work, risk to live operations. A tabletop exercise is the opposite. It happens at the table, nothing is switched off, and it still shows whether the plan holds.

Preparation

Before the exercise we settle three things:

• Goal: What do we want to test? For example how quickly the crisis team can be reached, the decision paths or external communication.
• Scenario: An event that fits your business. A ransomware attack on the ERP, a data centre provider going down or a fire in the warehouse.
• Participants: Management or a deputy, IT, communications and the owners of critical processes. Six to ten people works well.

How it runs

Opening. A short explanation of the rules: there are no wrong answers and nobody is being assessed. We are testing the plan, not the people.

Situation 1. The first report comes in, the way it would in reality: incomplete, perhaps contradictory. The crisis team decides who takes charge, who is informed and what happens first.

Situations 2 and 3. The scenario develops. A provider does not respond, a customer calls, the press asks questions. Now it shows whether roles and contacts are right.

Debrief. What worked, where did it get stuck, what is missing from the plan? Observations are captured while everyone is still in the room.

Result

After the exercise you receive a report with the scenario, participants, observations, gaps and concrete actions. It gives management a basis to act on and helps at the next audit, because it shows the plan does not just exist but has been tested.

The most common effect

In almost every exercise there is a moment when someone says: "That is what the plan says, but it would never work." That sentence alone is worth the half day, because in a real incident it would cost far more.