Definition
Tabletop exercise
In one sentence
A tabletop exercise is a facilitated, discussion-based simulation in which key staff walk through a realistic incident scenario to test their incident response plan, roles and decisions without affecting live systems.
Tabletop Exercise Explained
A facilitator presents a scenario, such as staff arriving on Monday morning to a ransomware note, and releases new information in stages. Participants discuss what they know, what they would do, who would decide and who they would call. The exercise typically lasts two to three hours and ends with a debrief and a list of improvements.
Tabletops reliably reveal practical gaps: contacts stored only in systems that would be encrypted, unclear authority to shut down the network, confusion between the IT provider and the security provider about who leads, and leadership that has never discussed whether paying a ransom would ever be considered.
Participants should include the people who would actually be involved: an executive decision-maker, finance, IT, the security provider, privacy or legal, and communications. For Canadian SMBs, running at least one tabletop a year is a strong, inexpensive improvement. It also provides evidence that the incident response plan has been tested, which insurers and auditors increasingly ask for.
General information for Canadian organizations, not legal advice.