Introduction

Whether you are mandated by industry regulations or simply enhancing your training programs, a tabletop exercise is a fantastic method to review policies and procedures with your team. This blog will guide you through planning and executing a successful tabletop exercise.

What is a Tabletop Exercise?

A tabletop exercise is a discussion-based session where team members meet in an informal, classroom setting to discuss their roles during an emergency and their responses to a particular emergency scenario. The goal is to structure the exercise around one premise to avoid overwhelming participants. Topics can range from phishing, cyber policy, and incident response to outage management. Focus on what impacts your business the most.

Setup

Choosing Participants: Include representatives from each key department such as IT, HR, legal, senior management, and others. Diverse participation brings comprehensive insights and training across the organization.

Roles:

Assigning clear roles is crucial for an effective exercise. Here are some essential and optional roles:

Essential Roles:

• Facilitator: Guides the exercise, manages the scenario, and ensures objectives are met.
  • Reason: Critical for keeping the exercise on track and ensuring participants stay engaged.
• Participants: Actively engage in the exercise, responding to the scenario and injects.
  • Reason: They are the ones being trained and tested.
• Scribe/Note-Taker: Documents the proceedings, including actions, decisions, and discussions.
  • Reason: Important for capturing information for post-exercise review and analysis.
• Observers (if applicable): Provide an external perspective on performance and interactions.
  • Reason: Useful for obtaining objective feedback and insights.

Optional but Beneficial Roles:

• Simulators/Role Players: Play roles of external entities like customers, media, or attackers.
  • Reason: Adds realism and dynamic interaction to the exercise.
• Incident Commander/Team Leader: Leads the response team, making critical decisions and coordinating actions.
  • Reason: Beneficial for testing leadership and decision-making under pressure.
• Public Information Officer (PIO): Manages communications with the public and media.
  • Reason: Important if the exercise involves scenarios requiring public or media interaction.
• Technical Specialists: Provide expertise in specific areas like IT, legal, or HR.
  • Reason: Useful for addressing specialized issues and providing detailed guidance.
• Safety Officer: Ensures the safety and well-being of participants.
  • Reason: Important in larger exercises or those with physical components.
• Logistics Coordinator: Manages logistical aspects of the exercise.
  • Reason: Helps ensure the exercise runs smoothly by handling practical details.
• Evaluator: Assesses the performance of participants and the effectiveness of the exercise.
  • Reason: Useful for providing objective evaluation and feedback.

Minimal Viable Setup:

For a smaller or simpler tabletop exercise, you might only need:

• Facilitator
• Participants
• Scribe/Note-Taker

Enhanced Setup:

For a more comprehensive exercise, consider including:

• Facilitator
• Participants
• Scribe/Note-Taker
• Simulators/Role Players
• Incident Commander/Team Leader
• Observers
• Technical Specialists
• Evaluator

Scenario Details

With your topic in place and having your people in their roles, the next step is to go over scenario examples to get the actual tabletop exercise started. You can set up questions based on the main topic to see what your company knows and the thought process. Remember they will need to participate and this is an open environment. You would have them answer questions freely without feeling like they were being  quizzed. This is an assessment to reintroduce topics that they may not normally know. Everything should be documented and as for the Facilitator role, your goal is to keep the pace of the discussion and to try to steer the conversation in an open process while trying to walk them through the scenario. An important thing to remember is to try not to make your scenario a yes or no question. Leave questions open with many other solutions. For example, What do you do when you detect a phishing attack? They can answer this question with a lot of correct answers like: report it to i.t, Block email sender, Do not respond and so on. The Facilitator job is to provide them with the results that will be the most benefit for the scenario towards the end.

ftermath

Once the exercise is complete, gather all the information and analyze the results. Reflect on the performance, identify gaps or weaknesses, and consider ways to improve training or awareness. Collect feedback from participants to enhance future exercises. Use this information to implement better strategies and revisit the exercise to test improvements.

Resources

Here are some examples and resource links that will help with your tabletop exercise:

Guide to Tabletop Exercises

What we Do?

We run cyber security firm that helps with everything GRC and providing software to help  business say complaint. If you would want to learn about us please reach out to me at wwellington@welltecllc.com