What gets tested
is the organisation.
A tabletop exercise puts management, IT, legal and communications around one table and plays a realistic incident through hour by hour. What gets tested is decisions, responsibilities, notification paths and communication; the minutes show where the organisation stalls.
What is included.
Play the crisis through while it is still an exercise.
Scenario
Built around your systems, sector and threat picture; with escalation stages and surprises.
Facilitation
We play time, attacker and outside world; you decide. Every decision is minuted.
Observation
Responsibilities, decision speed, notification deadlines, internal and external communication.
Evaluation
Minutes, assessment against playbooks and duties, action list with owners; evidence of the exercise for auditors.
Five steps,
one deliverable.
Scoping
Agree objectives, participants and scenario with the sponsor.
Delivery
Facilitated exercise across several escalation stages.
Debrief
Immediate review with the participants.
Report
Minutes, assessment, actions.
Repetition
Annually, with a new scenario — included in the cyber-governance module.