Tabletop exercises that expose response gaps
A realistic incident simulation for the board and IR teams. 3 hours worth more than years of procedures sitting in a binder.
Who is it for?
- Board and C-level
- IT and SOC teams
- Compliance and legal
- Communications and PR
- Operations (business continuity)
Exercise outcomes
Procedure gaps
You see where your Incident Response Plan actually works, and where it is just paper.
Who decides what
In practice, the decision chain is not as obvious as the org chart. The exercise tests it.
Regulator communication
NIS2 requires notification within 24h. We drill a realistic submission to CSIRT / sector regulator.
PR readiness
How to communicate to customers, media, partners — rehearsed before you have to do it under pressure.
Report with recommendations
After the exercise you get a written report with gaps, recommendations and repair priorities.
NIS2 Art. 21 alignment
NIS2 requires regular incident-handling exercises — a checkbox ticked.
The scenario, step by step
- 01
Preparation
2 weeks before: interviews, scenario tailored to the industry, participants and roles confirmed.
- 02
Exercise day
3 hours: opening scene (e.g. ransomware in the server room), 5 'injects' introducing new information, a conversation with decision-makers.
- 03
Debrief
Final hour: what worked, what did not, which decisions were good or bad, what was missing from the procedures.
- 04
Report and action plan
Written report within 5 business days: gaps, recommendations, priorities, 30/60/90-day plan.
Frequently asked questions
What scenarios do you run?
How many people participate?
Is this technical?
How often should we run exercises?
How long does the whole thing take, from decision?
Plan a tabletop exercise
We propose two scenarios tailored to your industry and check the board calendar.