What a tabletop is — and what it is for
A tabletop exercise walks your real decision-makers through a realistic scenario, hour by hour, around a table — no systems touched, no production risked. It tests the three things documents cannot: do people know their authority, do the handoffs work, and do the assumed workarounds actually exist. It is the cheapest instrument in continuity — and the one that produces the most findings per hour invested.
Designing the scenario
- Pick your worst realistic day. For most GCC organisations in 2026: a ransomware event with full encryption, or a facility closed by an area incident — intact but inaccessible for 72 hours. Both scenarios have public regional precedent; neither needs invention.
- Write a timeline with injects. 6-10 developments delivered at intervals: detection, escalation, a media call, a regulator question, a supplier failing, a recovery setback. Injects force decisions; decisions expose gaps.
- Set constraints honestly. The CEO is unreachable for the first hour. The backup administrator is on leave. Realism lives in the constraints.
- Prepare the answer key. For each inject: what the plan says should happen. The gap between the plan's answer and the room's answer is your findings list.
Running the room
- Cast real roles. The people who would decide on the day — not their more available delegates. Authority questions only surface with authority holders present.
- Keep the clock moving. 2-3 hours total; every stalled discussion is itself a finding («no one owns this decision») — log it and move.
- Facilitator asks, never answers. «What do you do now? Who authorises that? Where is that number?» The moment the facilitator helps, the test stops testing.
- Scribe everything. Timings, decisions, disagreements, missing information. The scribe's log is the raw material of the report.
The paradox of a good exercise: the more uncomfortable the room, the more valuable the report. A smooth exercise means the scenario was too easy — or the room was rehearsing agreement instead of response.
After: findings that change things
- Write the report within a week. Scenario, timings against RTOs, findings ranked by consequence, owners and deadlines per fix. Two to four pages.
- Close the top three first. A dozen open findings age into wallpaper; three closed findings change the plan.
- Amend the plan visibly. Each finding either changes a document, a contract, an arrangement — or is formally accepted as risk by leadership.
- Keep the evidence. Report, attendance, closed actions: this is exactly what NCEMA 7000 clause 9, CBUAE Article 7 and ISO 22301 auditors ask to see.
Frequently asked questions
How often should we exercise?
At least annually per the regulatory minimum — plus after any material change, and a second run when the first produced serious findings. Mature programmes alternate scenarios year to year.
Tabletop or full simulation?
Tabletop first, always: it finds the decision and authority gaps at near-zero cost. Full simulations (actual failover, site evacuation) come after tabletops stop producing findings.
Who should facilitate?
Someone outside the response structure — internal audit, a continuity professional, or an external facilitator. The person who wrote the plan defending the plan is a conflict, not a facilitator.
How do we exercise a drone-incident scenario without alarmism?
Frame it as what it is operationally: a facility-access and fire scenario — production stopped, zone closed, insurer and media asking questions. The response disciplines are identical to any area incident; no military framing is needed or useful.