Unclear Decision-Making Authority
Who may isolate systems, disconnect the network from the internet or stop production? Without clear authority, valuable time is lost in coordination.
Incident Response & Forensics
Crisis & Tabletop Exercises for Cyber Emergencies
Practice before it gets real.
In a tabletop exercise, your team works through a realistic cyberattack step by step – from the first alert to the press inquiry. Senior management, IT, communications and legal experience firsthand where procedures and responsibilities hold up and where they don’t. No intervention in your systems and no risk to operations.
- Individual quote
- Tailor-made scenarios
- Evaluation with action plan
Definition
What Is a Tabletop Exercise?
A tabletop exercise is a facilitated, discussion-based crisis exercise. Participants work together at the table through a fictional but realistic scenario – such as a ransomware attack. Following a script, the exercise team gradually feeds in new information, known as injects; in BSI Standard 200-4, Germany’s Federal Office for Information Security (BSI) calls them “Einlagen”. Decisions are made in the participants’ actual roles, without touching any systems.
Emergency plans are written in calm conditions but applied under pressure. The exercise shows whether roles are clear, whether information reaches decision-makers in time and whether reporting deadlines would be met. Every gap you find and close in the exercise no longer costs you time in a real emergency.
Exercising is also gaining regulatory weight. Under NIS2 – implemented in Germany through the BSI Act (BSIG) – the management bodies of essential and important entities must implement the risk-management measures, oversee their implementation and regularly attend training; these measures include incident handling and crisis management. DORA generally requires financial entities to test their ICT business continuity plans and their ICT response and recovery plans at least annually; they must also test their crisis communication plans.
An IT emergency exercise makes sense after a new emergency plan has been introduced, after restructuring or a change in senior management, before audits – and especially when there’s no plan at all yet. Then it shows where rules are missing.
Our Approach
How We Prepare Your Cyber Crisis Exercise
Together with a small planning team on your side, we define the exercise objectives, participants and framework. Possible guiding questions: Does escalation work all the way up to senior management? Does the crisis team keep track of the GDPR’s 72-hour deadline? Does the communication plan withstand pressure from outside? Nobody except the planning team knows the scenario itself.
Based on interviews and documents, we develop a scenario that fits your industry, your IT landscape and your dependencies. The script defines which injects are fed in and when: an antivirus alert, a ransom note, a call from a newsroom, a query from a major customer or the news that data has appeared on a leak site.
On the day of the exercise, we facilitate, feed in the injects and document decisions, times and open questions. This is followed immediately by an initial joint debriefing, known as the hot wash; you receive the detailed evaluation in writing.
Typical Findings
What Crisis Exercises Regularly Bring to Light
Lack of Availability
Contact lists are outdated, deputies haven’t been designated, and key service providers can’t be reached outside business hours.
Communication over Compromised Channels
Email and chat run through the affected environment, and there’s no independent fallback channel.
Reporting Deadlines Lost from View
Nobody starts the clock on GDPR or NIS2 deadlines, and it remains unclear who drafts and approves a report.
Untested Recovery
Backups exist, but the order and dependencies of the recovery – for example on Active Directory, DNS or license servers – are unclear.
Pressure from Outside
Customers, employees, the press and extortionists all demand answers at the same time; agreed key messages and approval processes are missing.
Handling Extortion
How does senior management respond to a ransom demand combined with a threat to publish data? Without principles clarified in advance – for example on involving the police and the cyber insurer – decisions are made under time pressure.
Dependence on Service Providers
Contracts don’t specify what IT service providers or cloud providers deliver during an incident – and nobody knows the obligations under the cyber insurance policy.
Formats
Three Formats for Different Goals
Discussion-Based
Tabletop for the Crisis Team
Senior management and the crisis team work through the scenario in discussion – focusing on decisions, priorities, communication and reporting obligations.
- Duration depends on scope and scenario
- No technical background required
- Ideal for trying out a new emergency plan
For IT & Service Providers
Technical Simulation
Your IT team works with prepared artifacts such as log excerpts, alerts and ransom notes and walks through the steps of its playbooks in practice.
- Practice analysis, containment and evidence preservation
- Test the interplay with external service providers
- No intervention in production systems
With Red Teaming
Combined Exercise
If you wish, we combine the crisis exercise with a red teaming engagement. Attack techniques executed under controlled conditions leave real traces and – if your detection kicks in – trigger real alerts that the technical team and the crisis team respond to.
- Real traces and alerts instead of paper injects
- Technical team and management practice together
- Purple teaming possible as a variant of or complement to red teaming
Process
How a Tabletop Exercise Works
From setting objectives to the action plan – structured, confidential and aligned with your operations. As with all services in our Incident Response & Forensics practice, we quote exercises individually.
-
01
Initial Consultation & Quote
We clarify objectives, participants and format. You then receive an individual quote.
-
02
Analysis & Scenario
Interviews and documents show which systems, procedures and dependencies make the scenario realistic.
-
03
Script & Coordination
We write the script and injects and coordinate both with your planning team. Participants know the date and objectives, but not the scenario.
-
04
Execution
We facilitate the exercise along the phases of a real incident – detection and analysis, containment, eradication and recovery – while keeping an eye on communication and reporting obligations.
-
05
Debriefing & Report
Immediately after the exercise, we collect everyone’s impressions in the hot wash. The written report follows with lessons learned and measures.
-
06
Measures & Follow-Up Exercise
We help you adapt your emergency plan and playbooks and recommend focus areas for the next exercise.
Evaluation
Exercise Report and Lessons Learned
The report records what worked well, where things got stuck and what needs to be done now. We assess procedures and structures, not individuals – so that the results can be discussed openly.
- Executive summary with the key findings
- Exercise objectives, scenario and participants
- Chronology of the situation and the decisions made
- Strengths and gaps by topic, such as decision-making, communication, technology, reporting obligations and service providers
- Prioritized measures with responsibilities
- Recommendations for the emergency plan, playbooks and the next exercise
Rehearse the Emergency Before It Happens
Whether it’s a first tabletop exercise for senior management or a combined exercise with the technical team: we develop a scenario that fits your organization.
FAQ
Frequently Asked Questions About Tabletop Exercises
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
What’s the difference between a tabletop exercise, a staff exercise and red teaming?
A tabletop exercise is discussion-based: a scenario is talked through at the table without any actions actually being carried out. In BSI Standard 200-4, the closest equivalent is the plan review (a “desk check”); with dynamic injects, it moves closer to a staff exercise. In a staff exercise, an activated crisis team works through a scenario in practice, with situation briefings, a log and visualization. Red teaming, by contrast, is a commissioned, covert attack simulation against your real systems that tests detection and response.
Who should take part?
That depends on the exercise objective. For a crisis team exercise, it makes sense to involve senior management, IT management, information security, data protection, legal, communications and HR – and in manufacturing companies, plant management as well. Technical exercises are aimed at IT operations, system administrators and the service providers involved. A manageable group in which everyone actively participates has proven effective.
How much preparation is needed?
How long the exercise itself takes depends on scope and scenario. Plan for sufficient lead time for interviews, scenario development and coordinating the script. It’s mainly your small planning team that is involved – everyone else essentially invests only the time of the exercise itself.
Does an exercise make sense without an emergency plan?
Yes. That’s exactly when it quickly shows where rules are missing and creates awareness of the need for action among senior management. The results are a good basis for an incident response plan – learn more under Incident Response Planning.
Are individual participants evaluated?
No. We evaluate procedures, information flows and the basis for decisions, not people. Mistakes are explicitly allowed in an exercise – they’re precisely what make weaknesses visible. We word the report in a correspondingly factual way.
Does a tabletop exercise help with NIS2 and DORA?
It can be an important building block. NIS2 requires covered entities to have measures for incident handling and crisis management as well as procedures to assess their effectiveness. DORA requires at least annual tests of ICT business continuity plans and ICT response and recovery plans – for all but microenterprises, including cyberattack scenarios – as well as tests of crisis communication plans. Whether an exercise fully covers your obligations depends on the individual case; in any event, the exercise report documents the scenario, results and measures.
Can real attack techniques be part of the exercise?
Yes – in the combined variant with our Red Teaming & APT Simulation service. Attack techniques executed under controlled conditions then create real traces and, if your detection kicks in, real alerts that the technical team and the crisis team respond to. If you wish, purple teaming can follow – as a variant of or complement to red teaming – to close detection gaps together with your team.
Related pages
Plan Your Crisis Exercise
Tell us who you want to involve in the exercise and which scenarios concern you. We’ll suggest a suitable format and prepare an individual quote. In an acute security incident, you can reach us via the 24/7 emergency hotline +49 2932 465265-0 or the Report an emergency form.