Tabletop Exercises

Tabletop exercises are facilitated discussion-based simulations in which key stakeholders walk through their response to a hypothetical disruptive event without actually activating systems or deploying personnel. They are the most accessible form of BCP/DR testing because they require no technical activation, can be conducted with cross-functional groups, and are specifically designed to surface gaps in plans, assumptions, and coordination rather than technical capabilities. A well-designed tabletop exercise reveals: which procedures are unclear or inconsistently understood; which decisions fall between roles with no clear owner; which communication paths break down under pressure; and which assumptions in the plan do not survive contact with a realistic scenario.

Exercise design determines whether a tabletop is genuinely useful or a compliance box-ticking exercise. The scenario must be realistic and calibrated to the audience: a ransomware scenario for a financial services organisation is more likely to reveal real gaps than a scenario about a meteorite strike. The scenario should have sufficient specificity — a named system affected, a specific time of day, a specific data type involved — to force concrete decisions rather than abstract discussions about "what we would generally do." Injects are pre-planned complications introduced during the exercise to push the scenario in new directions: a key staff member is unavailable, a communication channel fails, a regulatory notification deadline is approaching, the backup system is not responding. Well-timed injects reveal how the plan degrades under realistic adverse conditions rather than the idealised conditions the plan was written for.

Documentation and follow-through are what distinguish exercises that improve organisational resilience from exercises that generate a report nobody reads. During the exercise, a dedicated observer should record: decisions made, gaps identified, assumptions challenged, and action items arising. The post-exercise report should clearly list findings — gaps in the plan, unclear ownership, missing documentation, failed assumptions — with named owners and target remediation dates. The real test of an exercise programme's maturity is whether findings from previous exercises have been closed before the next exercise runs. Organisations that run annual tabletops and find the same gaps year after year have an exercise programme that documents problems without fixing them. The governance requirement is not just to run exercises but to demonstrate that exercises drive measurable improvement in the organisation's recovery capability.