How to Test Your Incident Response Plan With a Tabletop Exercise

An incident response plan can look solid until several teams need to act on it at once.

Then, the questions start.

• Who has the authority to shut systems down?
• Who needs to be notified?
• What happens if email or other normal communication channels are unavailable?
• Which systems come back first?

Those questions are much easier to answer before an incident than during one.

A tabletop exercise walks your team through a simulated incident so you can find gaps in your plan before an attack does.

Tabletop exercises let teams work through those decisions in advance and find where the written plan and real-world response don't quite line up. That is becoming more important as incidents move faster and affect more parts of your business.

Cybersecurity Awareness Month offers a timely reason to do it. This year's "Don't Make It Easy for Them" campaign is a good reminder to keep your incident response plan up to date and ready to be tested. Let's look at a few ways you can test and judge the readiness of your response plan.

What Can a Tabletop Exercise Reveal About Your Plan?

A tabletop exercise reveals unclear ownership, hidden dependencies and decisions that stall when the right people aren't available.

Working through a realistic scenario together forces people to get specific about how the response would actually unfold. Here are some things that might come up:

• A responsibility that seemed obvious when the plan was written may turn out to be shared by two teams or owned by no one.
• A recovery timeline may depend on a system or vendor nobody accounted for.
• Even a relatively simple decision can get complicated when the right people aren't immediately available, or different parts of the organization have competing priorities.

Those are much better problems to discover around a conference table than in the middle of an incident and can give you ideas on steps to take to improve your incident response plan.

For critical infrastructure operators, CISA is emphasizing the 3Rs of cybersecurity this month: reduce, replace and recover. Each is important, but "recover" is an easy place to start because you can get your team involved in a tabletop exercise, giving you a chance to kick the tires on your incident response plan before you have to rely on it.

CISA recommends regularly exercising incident response plans against common threat scenarios, and its free, customizable Tabletop Exercise Packages offer a good starting point for building exercises around an organization's own environment and risks.

Is Your Incident Response Plan Out of Date?

One of the first things a tabletop exercise can help you understand is whether your incident response plan is up to date. Here are three ways a plan can get out of date quickly:

Speed

You need to make sure it isn't designed for the attacks that happened five years ago when it was first written. For example, recent research shows that in the fastest 25% of intrusions, attackers reached data exfiltration in about 72 minutes, four times faster than the previous year.

That speed leaves very little room for a slow or overly scripted response. In many incidents, there may be no obvious malware to isolate or a clear moment when everyone knows an attack is underway. Identity weaknesses also played a material role in nearly 90% of investigations, so an attacker could be working through a legitimate account or exfiltrating data while systems still appear to function normally.

That is worth building into the tabletop exercise. Your teams should test whether they can make sense of incomplete information, recognize when an incident is escalating, and involve the right people early enough to act.

Artificial intelligence

AI is another area to test. According to ISACA, only 8% of organizations regularly run AI-specific incident response exercises, while 64% have never run an AI-related response exercise.

Here are a few questions to ask to be ready:

• Can your incident response account for AI?
• If sensitive information is exposed through an AI tool, who owns the incident?
• If an AI-enabled phishing attack compromises an executive account, does the response follow the same path as a traditional credential compromise?
• If a third-party AI application has access to company data, where does that vendor fit into the response?

Those details can get missed as technology evolves both inside and outside your company. Asking these questions right now helps you move and respond better when things are more urgent.

Data-only extortion

Data-only extortion is another issue worth accounting for. Attackers may skip encryption entirely and use stolen data as leverage, so an incident can be serious even when systems are still running normally.

Tabletop scenarios should reflect this, especially how quickly teams can identify data exposure, assess scope, and respond before the situation escalates.

What Questions Should a Tabletop Exercise Include?

As you build out a tabletop exercise, start with the decisions and dependencies that are most critical in your environment. The scenario itself is only useful if it forces the right conversations.

Here are some questions you could consider building into your tabletop exercise and response plan:

• Who has decision authority when the response gets disruptive? Depending on your industry, you need to understand if taking a system offline affects things like patient care, classroom access, public services, or a distributed workforce. Who makes that call and what information do they need first?
• What has to stay available, and what can wait? Recovery priorities should reflect business and mission needs, not just technical dependencies.
• How will you communicate if normal channels are unavailable? This includes internal coordination and communication with customers, employees, patients, students, constituents, regulators, or the media.
• What data changes the response? An incident involving PHI, student records, payment data, law-enforcement information, or other regulated or sensitive data may trigger very different response requirements. Is your plan still compliant with current regulations for your industry?
• Where are the hidden dependencies? A recovery plan may rely on a cloud service, managed provider, identity platform, remote location, or backup environment that becomes part of the incident itself.
• What happens across a distributed environment? Organizations with multiple campuses, clinics, offices, agencies, or remote users should test whether response and recovery still work when the incident does not stay neatly contained in one location.
• When do outside partners come in? Legal counsel, cyber insurance, law enforcement, incident response firms, vendors, and regulators may all have a role, but the team should clarify timing and handoffs before an incident starts.

The most useful tabletop questions are the ones that expose assumptions. If the team cannot agree on an answer, that is usually a sign the plan needs more work.

What to Do After a Tabletop Exercise

The value of a tabletop exercise comes from what happens afterward. Make sure you're documenting what the team learned and assigning owners to unresolved issues. Once you've worked through those issues, update the incident response plan so it's ready for the next tabletop exercise or real-life incident.

Cybersecurity Awareness Month is a good reminder to put controls in place that make attacks harder. VLCM's security team can help you evaluate your incident response plan, identify gaps, and strengthen your ability to respond and recover.

Learn more about VLCM's vCISO services or talk with our team about your cybersecurity strategy.