Tabletop exercises

Guided incident scenarios for your leadership and technical teams. You rehearse your response plan before you need it, and find the gaps while they are still cheap to close.

Ask about this service All services

Who it is for

  • You have an incident response plan that nobody has tested.
  • You must report certain incidents to CERT-In within six hours and want to know you can.
  • A new leadership team needs to know who decides what during an incident.

What you get

  • A scenario built around your systems and real risks, such as ransomware or a data leak
  • A facilitated session, in person or online
  • An after-action report: what went well, the gaps and who owns each fix
  • Updates to your response plan and contact lists

How it runs

  1. Prepare

    We read your response plan and choose a scenario with you.

  2. Run

    A session of two to three hours where the scenario unfolds in stages and the team decides what to do.

  3. Observe

    We note decisions, delays and missing information as they happen.

  4. Follow up

    An after-action report and changes to the plan.

Typical length
One to two weeks, including a session of two to three hours. Lengths are typical. We confirm them when we agree the scope.
What we need from you
Your current incident response plan, and the people who would be in the room for a real incident.

Frameworks it helps with

  • ISO/IEC 27001
  • SOC 2
  • CERT-In Directions
  • DPDP Act 2023

Auditors ask whether the response plan has been tested. CERT-In and the DPDP Act both set reporting duties that a rehearsal puts to the test.

Tell us what you need, and we will suggest a scope.

Ask about this service