What a tabletop is — and what it is for
A tabletop exercise walks your real decision-makers through a realistic scenario, hour by hour, around a table — no systems touched, no production risked. It tests the three things documents cannot: do people know their authority, do the handoffs work, and do the assumed workarounds actually exist. It is the cheapest instrument in continuity — and the one that produces the most findings per hour invested.
Designing the scenario
- Pick your worst realistic day. For most GCC organisations in 2026: a ransomware event with full encryption, or a facility closed by an area incident — intact but inaccessible for 72 hours. Both scenarios have public regional precedent; neither needs invention.
- Write a timeline with injects. 5-10 developments delivered at intervals: detection, escalation, a media call, a regulator question, a supplier failing, a recovery setback. The pack gives five core injects to start from. Injects force decisions; decisions expose gaps.
- Set constraints honestly. The CEO is unreachable for the first hour. The backup administrator is on leave. Realism lives in the constraints.
- Prepare the answer key. For each inject: what the plan says should happen. The gap between the plan's answer and the room's answer is your findings list.
Running the room
- Cast real roles. The people who would decide on the day — not their more available delegates. Authority questions only surface with authority holders present.
- Keep the clock moving. 2-3 hours total; every stalled discussion is itself a finding (“no one owns this decision”) — log it and move.
- Facilitator asks, never answers. “What do you do now? Who authorises that? Where is that number?” The moment the facilitator helps, the test stops testing.
- Scribe everything. Timings, decisions, disagreements, missing information. The scribe's log is the raw material of the report.
The paradox of a good exercise: the more uncomfortable the room, the more valuable the report. A smooth exercise means the scenario was too easy — or the room was rehearsing agreement instead of response.
After: findings that change things
- Write the report within a week. Scenario, timings against RTOs, findings ranked by consequence, owners and deadlines per fix. Two to four pages.
- Close the top three first. A dozen open findings age into wallpaper; three closed findings change the plan.
- Amend the plan visibly. Each finding either changes a document, a contract, an arrangement — or is formally accepted as risk by leadership.
- Keep the evidence. Report, attendance, closed actions: this is exactly what NCEMA 7000 clause 9, CBUAE Article 7 and ISO 22301 auditors ask to see.
Download the template
Exercise brief, a five-inject ransomware scenario with questions and expected responses, an observer form and a report template with findings and corrective actions. Docx, four pages.
Download docx (tabletop-exercise-pack.docx)
Swap the scenario for site loss or supplier failure by replacing the inject table only. No registration, no forms. Need it adapted to your organisation or a full programme: see how we work.
Frequently asked questions
How often should we exercise?
At least annually per the regulatory minimum — plus after any material change, and a second run when the first produced serious findings. Mature programmes alternate scenarios year to year.
Tabletop or full simulation?
Tabletop first, always: it finds the decision and authority gaps at near-zero cost. Full simulations (actual failover, site evacuation) come after tabletops stop producing findings.
Who should facilitate?
Someone outside the response structure — internal audit, a continuity professional, or an external facilitator. The person who wrote the plan defending the plan is a conflict, not a facilitator.
How do we exercise a drone-incident scenario without alarmism?
Frame it as what it is operationally: a facility-access and fire scenario — production stopped, zone closed, insurer and media asking questions. The response disciplines are identical to any area incident; no military framing is needed or useful.