The tabletop exercise a leadership team should actually run

Most tabletop exercises are run for the wrong room. The scenario lands in a security team's calendar, the security team works through it competently, and the decisions that would have cost the company real money are never reached — because nobody in the room was allowed to make them.

A leadership tabletop is a different exercise with a different purpose. It is not a test of whether your engineers can contain an intrusion. It is a test of whether the people who hold authority can use it quickly, in sequence, on incomplete information.

The definition is narrower than the invitation

NIST's glossary defines a tabletop exercise as "a discussion-based exercise where personnel with roles and responsibilities in a particular IT plan meet in a classroom setting or in breakout groups to validate the content of the plan by discussing their roles during an emergency and their responses to a particular emergency situation," with a facilitator who "initiates the discussion by presenting a scenario and asking questions based on the scenario." That definition is drawn from NIST SP 800-84.

The words that carry the weight are roles, discussion and validation. For the hands-on version, the same glossary keeps a separate term: a functional exercise is "an exercise that allows personnel with operational responsibilities to validate their IT plans and their operational readiness for emergencies in a simulated operational environment."

Both are worth doing, and they are not substitutes for each other. In our view the one that gets skipped is the first, because it is the one that requires the busiest calendars in the company.

The decisions only this room can make

Build the exercise around the choices that cannot be delegated downward. In our view these are the ones worth forcing:

• Taking something that earns money offline. Containment often means stopping the business. Someone has to be allowed to say yes without a meeting.
• Paying, or refusing to pay. The decision has legal, insurance and reputational dimensions that arrive together, and it is not a technical decision at all.
• Telling customers before the facts are settled. Enterprise contracts commonly carry notification clauses tighter than anything a statute requires, and they bite early.
• Whose lawyers, whose forensics. Policies generally require prompt notice and often specify panel counsel or a panel forensics firm.
• Who speaks. The FTC's breach response guide is direct: "Have a communications plan," reaching "all affected audiences — employees, customers, investors, business partners, and other stakeholders", and "Designate a point person within your organization for releasing information."

On Item 1.05 of Form 8-K, the SEC's small entity compliance guide states: "For domestic registrants, this disclosure must be filed on Form 8-K within four business days of determining that a cybersecurity incident is material." It adds: "The rule instructs registrants to make the materiality determination 'without unreasonable delay.'" The same guide routes foreign private issuers to a different form and a different trigger: "For foreign private issuers ('FPIs'), this disclosure must be furnished on Form 6-K promptly after the incident is disclosed or otherwise publicized (or is required to be disclosed or publicized) in a foreign jurisdiction, to any stock exchange, or to security holders." It also states: "The rules do not apply to eligible registrants that file disclosures on Form 40-F under the Multijurisdictional Disclosure System, nor to asset-backed issuers as defined in Item 1101 of Regulation AB." SEC staff has also addressed a series of ransomware incidents in the Form 8-K interpretations, saying a registrant "should consider whether any of those incidents were related, and if so, determine whether those related incidents, collectively, were material" — the definition of a cybersecurity incident reaches "a series of related unauthorized occurrences." Which of these applies to you is a question for counsel — and the answer decides which form the exercise rehearses. The mechanics of that filing are a separate subject, covered in Item 1.05 Form 8-K disclosure.

Who is in the room

The FTC's breach response guide describes assembling a team of experts that, "depending on the size and nature of your company," "may include forensics, legal, information security, information technology, operations, human resources, communications, investor relations, and management."

For a leadership exercise, weight that list toward authority rather than tooling, and invite the named alternates as well as the primaries. Whether the alternate knows they are the alternate is one of the cheapest findings an exercise produces, and one of the most common.

CISA's #StopRansomware Guide also gives the leadership table a precondition worth checking before the exercise begins: "Ensure the IRP and communications plan are reviewed and approved by the CEO, or equivalent, in writing and that both are reviewed and understood across the chain of command." If no such approval exists, the exercise will be validating a draft.

Design the scenario backwards from a decision

Pick the decision you are least confident about, then write the smallest scenario that forces it. A scenario built from a threat actor's techniques tends to produce a conversation about the techniques. A scenario built from a decision produces an argument about authority, which is the point.

You do not have to write it yourself. CISA publishes Tabletop Exercise Packages, "a comprehensive set of resources designed to assist stakeholders in conducting their own exercises," each one "customizable" and including "template exercise objectives, scenarios, and discussion questions as well as a collection of references and resources." The listed topics include "ransomware" and "insider threats", and CISA states that "with over 100 CTEPs available, stakeholders can easily find resources to meet their specific exercise needs." The page lists cisa.exercises@cisa.dhs.gov for more information or to request an exercise.

Running it so it finds something

A few mechanics make the difference between an exercise and a presentation:

1. A facilitator who is not the security lead. If the person who wrote the plan is also running the room, the plan gets defended instead of tested.
2. Staged injects. Release facts in pieces, including facts that contradict earlier ones. Decisions made on complete information are not the decisions you will face.
3. Deliberate information gaps. The honest answer "we would not know that yet" is a finding, not a failure.
4. A scribe. Someone whose only job is to record what was decided, by whom, and what nobody could answer.
5. Closed laptops. The moment participants look up the answer, the exercise stops measuring readiness and starts measuring search skills.

Disagreement in the room is the product. If the exercise is comfortable, the scenario was too kind.

The after-action report is the deliverable

NIST's glossary defines an after action report as "a document containing findings and recommendations from an exercise or a test." That is the whole output, and it is worth taking literally.

In our view, each finding needs three things attached before the room empties: a named owner, a date, and a statement of what will change — a plan edit, a contract read, a phone number stored out-of-band, a delegation written down. Findings without owners come back identically next time.

The glossary's entry for exercise sets the bar the report should answer to: "a simulation of an emergency designed to validate the viability of one or more aspects of an IT plan." Viability, not completeness. A plan can be thorough and still not survive a Tuesday.

It is also evidence

The report's second audience arrives later. Enterprise buyers, auditors and insurance underwriters commonly ask when the plan was last exercised, who took part and what changed as a result — and they ask for records rather than recollection. A dated after-action report with closed items is a short answer to a long question. What underwriters tend to ask is covered in cyber insurance underwriting questions.

CISA's Cyber Essentials, which the agency describes as "a guide for leaders of small businesses as well as leaders of small and local government agencies," is written to the leader rather than the technician. Among its "Actions For Leaders": "Lead development of an incident response and disaster recovery plan outlining roles and responsibilities. Test it often."

What to do first

1. Confirm the plan has been approved in writing by the chief executive or equivalent, as the #StopRansomware Guide asks. Exercise the approved version.
2. Choose one decision you would rather not make under pressure, and build the scenario around it.
3. Agree the after-action format before the exercise, so the findings have somewhere to land while everyone is still in the room.

If the plan itself is the weaker half, the incident response plan a mid-market company can run covers what has to be in it. If something has already happened and you are working out what it did to your control environment, the breach aftermath control checklist walks it in order, and the readiness scorecard will show which gaps are worth taking to the next exercise.

This is general information, not audit, security or legal advice. Confirm what applies to you with your auditor or counsel.

Common questions

What is the difference between a tabletop exercise and a functional exercise?

NIST's glossary treats them as separate things. A tabletop is discussion-based: people with roles in a plan talk through those roles against a facilitated scenario. A functional exercise puts personnel with operational responsibilities into a simulated operational environment to validate operational readiness. Restoring a backup in a lab is the second one; deciding whether to take order entry offline is the first.

Who should be in a leadership tabletop exercise?

The FTC's breach response guide describes a response team that, depending on the size and nature of the company, may include forensics, legal, information security, information technology, operations, human resources, communications, investor relations, and management. For a leadership exercise, in our view the people who hold authority matter more than the people who hold tools — plus the named alternates, because the exercise is partly a test of whether they know they are the alternate.

Do we have to write our own scenario?

No. CISA publishes Tabletop Exercise Packages described as a comprehensive set of resources designed to assist stakeholders in conducting their own exercises, each customizable and including template exercise objectives, scenarios, and discussion questions. CISA says over 100 packages are available, covering topics including ransomware and insider threats, and lists cisa.exercises@cisa.dhs.gov for more information or to request an exercise.

What is the output of a tabletop exercise?

A document. NIST's glossary defines an after action report as a document containing findings and recommendations from an exercise or a test. In our view the findings are only useful once each one carries a named owner and a date, because the exercise does not fix anything — it only tells you what is unowned, unreachable or undecided.

How often should a leadership team run one?

CISA's #StopRansomware Guide tells organizations to create, maintain, and regularly exercise a basic cyber incident response plan and associated communications plan, and its Cyber Essentials material, a guide written for leaders, says: 'Lead development of an incident response and disaster recovery plan outlining roles and responsibilities. Test it often.' In our view, pick a cadence you will actually keep and re-run the exercise after any material change to the business.

Sources

1. Computer Security Resource Center Glossary — 'tabletop exercise' (definition drawn from NIST SP 800-84) · National Institute of Standards and Technology
2. Computer Security Resource Center Glossary — 'functional exercise' (definition drawn from NIST SP 800-84) · National Institute of Standards and Technology
3. Computer Security Resource Center Glossary — 'exercise' (definition drawn from NIST SP 800-84) · National Institute of Standards and Technology
4. Computer Security Resource Center Glossary — 'after action report' (definition drawn from NIST SP 800-84) · National Institute of Standards and Technology
5. CISA Tabletop Exercise Packages · Cybersecurity and Infrastructure Security Agency
6. #StopRansomware Guide · Cybersecurity and Infrastructure Security Agency
7. Cyber Essentials · Cybersecurity and Infrastructure Security Agency
8. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure — Small Entity Compliance Guide · U.S. Securities and Exchange Commission
9. Division of Corporation Finance, Compliance and Disclosure Interpretations: Exchange Act Form 8-K — Section 104B · U.S. Securities and Exchange Commission
10. Data Breach Response: A Guide for Business · Federal Trade Commission