An incident response plan can look complete until the team discovers that phone numbers are stored in the system that is down or that nobody knows who is authorised to close an account. A short tabletop exercise reveals these dependencies without actually interrupting the service.
The exercise is not a technical penetration test. It is a discussion based on a realistic scenario, designed to test decisions, communication and ownership.
Choose a narrow scenario
Start with something that could happen in daily operations: a suspicious email login, a lost device, inability to access the e-shop or a file sent incorrectly. Do not add numerous simultaneous incidents. The scenario should touch one critical service and force the team to decide what to do first.
Invite the people who would actually act
Include the business owner, technical lead, communications, customer service and whoever manages the affected account. Assign a facilitator to present the scenario and a recorder to note decisions, uncertainties and outstanding actions.
Present the incident in stages
In the first stage, provide only the initial signal. Ask who evaluates it, which evidence is needed and who is informed. Then introduce new information, such as failed recovery or a customer question. Observe whether roles remain clear and decisions are recorded.
Test communication outside the affected system
If corporate email is unreliable, how will the team coordinate? Where are supplier phone numbers, contract references and instructions? The exercise needs to show that critical information is available through a secure alternative route.
Do not score people; improve the system
Record what was missing: authorisation, a contact detail, technical access, an update template or a decision about service interruption. Turn every gap into an action with an owner and deadline. Avoid turning the exercise into a memory test or an exercise in assigning blame.
Repeat after corrections
Run a small follow-up using the same main journey and one different detail. The goal is for the team to act with less uncertainty, not to memorise a scenario.
The exercise structure is an original practical framework developed by DigitalNow and does not replace a specialist cybersecurity assessment.