Cyber Tabletop Exercises: How to Run One and What It Proves

A tabletop exercise is a facilitated discussion in which the people who would handle a cyber incident work through a realistic scenario, one stage at a time, using their incident response plan. Nobody touches a live system. The point is to find out, before a real incident does, whether people know their roles, can reach each other, can make the big decisions quickly and know who must be told and by when.

A cyber tabletop exercise is one of the cheapest ways to test an incident response plan and a common way to meet the annual testing expected by PCI DSS, the UK Cyber Governance Code of Practice and DORA. If you do not yet have a plan to test, start with our incident response plan template.

What is a cyber tabletop exercise?

It is a rehearsal by discussion. A facilitator presents an incident in stages, called injects, and the players say what they would do at each point. Each inject adds pressure: more systems affected, a journalist calling, a regulator deadline approaching.

It sits at the lighter end of the ways to test incident response.

What does a tabletop exercise prove?

It shows whether the people named in your plan can use it under pressure. Common findings include:

• out-of-date phone numbers and nobody holding the insurer’s or acquirer’s contact details
• no agreement on who can authorise taking systems offline or approving emergency spending
• no fallback channel if email and chat are compromised
• one person holding knowledge that nobody else has
• supplier contracts that do not require the supplier to tell you about an incident
• nobody tracking when the 72-hour clock for reporting a personal data breach to the ICO started

It does not prove that technical controls work or that an attack would be detected; that needs technical testing, such as backup restore tests, penetration testing or a red team.

Which tabletop exercise scenarios should you use?

Pick the incidents most likely to happen to you and most damaging if they did, and use your real systems, suppliers and data so the discussion stays concrete.

Our guide to preventing ransomware explains the controls a ransomware scenario should test.

Who should take part, and how long does it take?

Invite the people who would make decisions in a real incident, plus a facilitator who is not also a player. Keep the group small enough that everyone speaks.

Legal, finance, HR and key suppliers join when the scenario needs them. This sample run sheet assumes one scenario over about three hours:

How do you run an incident response tabletop exercise, step by step?

1. Set three to five objectives, for example “decide within the first hour whether the incident needs reporting to the ICO”.
2. Write the scenario and injects around your own systems, suppliers and recent near misses.
3. Invite the players and send them the plan, but not the scenario, in advance. Ground rules: no blame, use the plan as written.
4. Run the injects. The facilitator keeps asking: who decides, how would we know, who do we call and what do we tell customers?
5. Record everything, including the time each decision would be taken.
6. Debrief and report. Hold a hot debrief while memories are fresh, then write the report with actions, owners and due dates.
7. Update the plan and check the actions are closed before the next exercise.

Can you use the NCSC’s Exercise in a Box or CISA’s exercise packages?

Yes, and it is a good place to start. Exercise in a Box is a free online resource from the National Cyber Security Centre, used by SMEs, local government and the emergency services, and it needs no specialist expertise. It includes tabletop exercises and short micro exercises, with everything needed to set up, plan, deliver and identify post-exercise actions.

Its tabletop scenarios include ransomware delivered by phishing, third-party software compromise, an insider data breach and a threatened leak of sensitive data. Run one as written, then tailor the next to your own systems.

For a wider choice of scenarios, the US Cybersecurity and Infrastructure Security Agency publishes its CISA Tabletop Exercise Packages (CTEPs), of which it says there are more than 100. Each package gives template objectives, scenarios and discussion questions, role templates for planners, facilitators and players, an invitation, a slide deck, a feedback form and an after-action report template. Cyber scenarios include ransomware, insider threats, phishing and industrial control system compromise. The packages are written for US organisations, so replace their reporting steps with UK ones, such as the ICO, the NCSC and any sector regulator, before you run them.

If you want an outside facilitator, the NCSC’s Cyber Incident Exercising scheme assures companies that deliver bespoke exercises. In September 2026 IASME also announced Cyber Exercise Baseline for smaller organisations: one facilitated entry-level exercise, a short report of gaps and recommendations, and a certificate, valid for a year, showing customers you have exercised in the last 12 months.

How often should you run a tabletop exercise?

At least once a year, and after any significant change: a new plan, a major system or supplier change, new key people or a real incident.

Does PCI DSS require incident response testing?

Yes. Requirement 12.10.2 requires the incident response plan to be reviewed, updated as needed and tested at least once every 12 months, including all the elements listed in 12.10.1. A simulated incident worked through as a tabletop exercise by the people with roles in the plan is a common way to meet it, provided the record shows each element was covered.

Those elements include roles and communication (including notifying payment brands and acquirers), containment, business recovery, data backup, legal reporting, critical system components and the payment brands’ own procedures, so design scenarios that exercise every one. Related requirements cover training for responders (12.10.4), with the training frequency set by a targeted risk analysis (12.10.4.1, mandatory since 31 March 2025), and updating the plan from lessons learned (12.10.6). The full text is in the PCI SSC document library.

What evidence does a tabletop exercise give for ISO 27001, PCI DSS and DORA?

A well-recorded exercise is evidence for several requirements at once.

Keep the invitation and attendee list, objectives, scenario and injects, the timed decision log, the report, the action log and the updated plan version. For EU financial entities, our DORA regulation guide explains the wider testing programme set out in Regulation (EU) 2022/2554.

Lessons-learned template

Copy this into your exercise report.

Why Sovereign Secure

• PCI SSC-approved QSA company. We assess Requirement 12.10 in our PCI DSS assessments, so we know what testing evidence assessors look for.
• ISO 27001 certified. Our ISO 27001 consultancy builds incident management controls into your ISMS.
• Testing that checks detection for real. Red team assessments and penetration testing show whether attacks are noticed and escalated, and their findings make realistic injects.
• Clear about our role. We do not provide incident response retainers or live incident response.
• UK company since 2012, headquartered in Accrington, Lancashire.

Next step

Get the plan ready with our incident response plan template, then run your first scenario using the run sheet above. To find out whether detection and escalation would work against a real attack, ask us about a red team assessment through the form below or call +44 161 523 5276.