Run Your Own Tabletop Exercise
in 30 Minutes
Six fully facilitated scenarios. Scoring rubric. After-action template. Regulator notification cheat-sheet. Everything you need to run a meaningful incident response tabletop — without hiring a consultant.
The 6 Scenarios
Realistic Incidents. Real Decision Points.
These aren't theoretical exercises. Every scenario is based on actual breach patterns from FBI IC3, HHS OCR, SEC enforcement, and published incident reports. Your team will hit the same decision points real organizations face.
File Server Encrypted During Quarter-Close
Q1 close day. FS01 encrypting. 72-hour ransom demand. Backups untested 4 months. Data leak threat. Your team decides: who calls insurance, who owns the ransom decision, when does HIPAA clock start?
CEO Wire Fraud — $340K Invoice Change
Lookalike domain. CFO traveling. AP coordinator ready to wire. Banking details changed. What is your exact OOB verification step — and what happens if the wire already went?
Departing Engineer Exfil to Personal Drive
Last day on the job. DLP alert: source code + customer data uploaded to personal Google Drive. Still in exit interview. Personal AWS token still active. Do you confront him or preserve evidence first?
MSP Credentials Abused for Lateral Movement
Your MSP was phished. Their account accessed your AD for 4 hours overnight. Threat intel: this group plants Cobalt Strike beacons 48-72 hrs before ransomware. Are you already compromised?
IT Helpdesk Called by "CFO" for MFA Reset
Caller knows the CFO's employee ID, manager's name, and board meeting details. Requests MFA reset while "traveling." Your helpdesk policy either stops this or doesn't. Find out which before it matters.
Attacker Posts to Leak Site Before You Know
A security researcher emails you at 7 AM: ransomware group posted 50K customer records. Reporters calling. Legal wants a denial. IT sees no alerts. Third-party vendor's breach notification from 3 weeks ago sits unread.
Regulator Expectations
These Regulators Want Evidence of Tabletop Exercises
Tabletop documentation isn't just good practice — it's increasingly a regulatory expectation. The pack includes a notification deadline cheat-sheet so you know exactly which clocks start running when an incident occurs.
SEC Cyber Disclosure
4-business-day incident disclosure. Evidence of IR plan testing supports "reasonable" materiality determinations.
NYDFS Part 500 (2023)
Class A companies must conduct tabletop exercises as part of their incident response testing. Documented results required.
HIPAA / HHS OCR
OCR guidance explicitly references tabletop exercises for contingency plan testing under § 164.308(a)(7). Breach investigations ask for evidence.
FFIEC CAT
"Innovative" maturity tier requires regular tabletop exercises testing incident response capabilities. Results must drive program improvements.
Free Download
Get the Facilitator Pack — Free
Enter your work email and we'll send you the 12-page PDF immediately. No credit card. No sales call required.
✅ Pack on its way!
Check your inbox for the 12-page Tabletop Exercise Facilitator Pack. If it doesn't arrive in 5 minutes, check your spam folder.
Want us to facilitate a session for your team?
Our Executive and Business sessions include a fully facilitated tabletop with your actual leadership team, a structured debrief, and a written after-action report for compliance documentation.
Book a Facilitated Session →