Define the decisions to test
A tabletop is not a presentation about an imaginary attacker. Choose a small number of decisions the organisation needs to practise: isolating a service, invoking outside support, communicating with customers, approving recovery or operating without a critical platform. Name the participants who actually hold those responsibilities.
Build a plausible scenario from the organisation’s services and dependencies. Release information in stages so participants must work with uncertainty. Include technical evidence, business impact and conflicting priorities, but avoid trivia that rewards guessing the facilitator’s preferred answer.
Observe coordination and evidence
Record who takes leadership, which channels are used, what information is requested and which authority is unclear. Ask participants to make decisions, state assumptions and identify the evidence that would increase confidence. A discussion that never commits to action may conceal the most important gap.
Test degraded conditions: unavailable email, compromised administrators, missing supplier contacts or an uncertain backup. Do not surprise participants purely for drama. Each inject should examine a known objective and expose whether the plan, people and systems support it.
Turn learning into verified change
Conclude with a factual debrief that separates strengths, observations and actions. Assign each improvement an owner, due date and validation method. Some findings require documentation; others need technical change, contractual clarification or leadership authority.
Repeat a focused exercise after important corrections. Measure action closure, decision time, contact accuracy and recovery evidence, while acknowledging that exercises are not full technical tests. Readiness improves when exercises create funded, tested changes rather than polished reports.
What to do next.
- ✓Choose explicit decisions and objectives.
- ✓Include real decision-makers and service owners.
- ✓Use staged information and degraded communications.
- ✓Record assumptions, actions and missing evidence.
- ✓Assign owners and validation to improvements.
- ✓Re-exercise corrected high-impact gaps.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.
Thandiwe Jacobs
Business Resilience ContributorWrites about incident preparation, service recovery and the decisions organisations need to make before disruption.
More from this writer