Writing an Information Security Policy: How to Run a Tabletop Exercise for Your Incident Response Plan

Many organizations have an incident response plan, but fewer have tested whether leaders, IT, legal, communications, operations and vendors can actually use it under pressure. A tabletop exercise is a practical, low-disruption way to validate your plan, identify decision gaps and improve governance before a real cybersecurity incident occurs.

In this article, you’ll learn how to plan, facilitate and document a tabletop exercise for your incident response plan, with practical checklists, sample scenarios and governance considerations for business leaders.

Why Tabletop Exercises Matter for Cybersecurity Governance

A tabletop exercise is a discussion-based simulation of a security incident. Instead of taking systems offline or running a live technical drill, participants walk through a realistic scenario and explain what they would do, who they would contact and what decisions they would make.

For business leaders, tabletop exercises help answer critical governance questions:

• Do we know who is authorized to declare an incident?
• Can we make timely decisions about containment, downtime, customer communications and legal notifications?
• Do our policies match how our organization actually operates?
• Are executives, IT, compliance, legal, communications and business units aligned?
• Do we understand our obligations to customers, regulators, insurers, partners and affected individuals?
• Are our vendors and managed service providers included in the response process?

A strong tabletop exercise does not try to embarrass participants or prove that the IT team is unprepared. Its purpose is to improve readiness, clarify accountability and strengthen the organization’s broader information security governance program.

Start with Governance: Policies, Roles and Decision Rights

Before you run a tabletop, review the documents that define how your organization manages cybersecurity risk. These usually include:

• Information security policy
• Incident response plan
• Data classification policy
• Business continuity and disaster recovery plans
• Acceptable use policy
• Access control policy
• Vendor risk management procedures
• Cyber insurance incident reporting requirements
• Communications and media response procedures
• Legal and regulatory notification procedures

If your organization is still writing an information security policy, a tabletop exercise can help reveal what needs to be included. For example, if leaders cannot agree on who approves taking a critical system offline, your policy framework may need clearer decision authority. If teams are unsure which data requires heightened protection, your data classification policy may need to be simplified or better communicated.

Key Governance Questions to Answer Before the Exercise

Before building a scenario, confirm the following:

• Who owns the incident response plan?
• Who has authority to activate the incident response team?
• Who decides whether an event is a security incident?
• Who determines whether legal counsel should be engaged?
• Who contacts cyber insurance, law enforcement, regulators, customers or vendors?
• Who approves external communications?
• Who makes business decisions about downtime, restoration priorities and manual operations?
• Who documents decisions during the incident?
• Who tracks lessons learned after the exercise?

These questions are especially important in regulated industries such as healthcare, financial services, education and government contracting, where incident response may intersect with privacy, contractual and regulatory obligations.

Define the Objective of the Tabletop Exercise

A common mistake is trying to test everything at once. A better approach is to choose a focused objective.

Examples of tabletop objectives include:

• Validate the incident response plan template and escalation process
• Test executive decision-making during a ransomware event
• Evaluate communication between IT, compliance, legal and operations
• Confirm procedures for handling sensitive or regulated data
• Practice response to a third-party vendor breach
• Assess readiness for business email compromise
• Review downtime procedures for a critical application
• Identify gaps in cyber insurance notification processes

For a business audience, the most valuable tabletop exercises usually focus less on technical forensics and more on leadership decisions, communication and risk tradeoffs.

Example Objective

“Validate whether the executive leadership team, IT, legal, compliance and communications can coordinate an effective response to a ransomware incident affecting systems that store confidential customer and employee data.”

This objective is specific enough to guide the exercise while broad enough to involve multiple functions.

Select the Right Participants

The best tabletop exercises include the people who would actually be involved in a real incident. This often includes more than the IT department.

Core Participants

Include representatives from:

• Executive leadership
• Information technology
• Information security
• Legal
• Compliance or privacy
• Human resources
• Finance
• Communications or public relations
• Operations
• Customer service
• Risk management
• Vendor management
• Facilities, if physical access or outages are relevant

Optional Participants

Depending on the scenario, consider including:

• Managed service provider or managed security provider
• Cyber insurance broker or carrier contact
• Outside breach counsel
• Digital forensics and incident response provider
• Electronic health record, cloud or software vendor
• Board member or board risk committee representative

For healthcare organizations, participants may also include privacy officers, security officers, clinical operations leaders and health information management staff. Healthcare entities subject to the HIPAA Security Rule should align their incident response processes with administrative safeguard requirements under 45 CFR 164.308, including security incident procedures.

Choose a Realistic Scenario

A tabletop scenario should be realistic, relevant and challenging without being overly dramatic. The goal is to create enough uncertainty to prompt meaningful discussion.

Common Tabletop Scenarios

Useful cybersecurity tabletop scenarios include:

1. Ransomware affecting core business systems

- Employees cannot access shared drives or business applications. - A ransom note appears. - Backups may or may not be reliable.

1. Business email compromise

- A finance employee receives a convincing request to change payment instructions. - Funds may have been transferred. - The attacker may still have mailbox access.

1. Lost or stolen device

- A laptop containing sensitive data is missing. - Encryption status is unclear. - The employee delayed reporting the loss.

1. Cloud storage exposure

- Confidential files were accessible through a misconfigured cloud repository. - It is unclear who accessed the data. - Customers or partners may be affected.

1. Third-party vendor breach

- A vendor notifies your organization of unauthorized access. - The vendor’s information is incomplete. - Business operations depend on the vendor’s system.

1. Insider data misuse

- An employee may have accessed records without authorization. - The employee recently resigned. - The organization must determine scope and response.

1. Healthcare-specific scenario

- A clinical system is unavailable due to malware. - Patient care workflows are disrupted. - Protected health information may be involved.

Use Your Data Classification Policy

Your data classification policy should shape the scenario. If your organization classifies data as public, internal, confidential and restricted, the exercise should specify which categories are involved.

For example:

• Public data: marketing materials already available on the website
• Internal data: internal procedures or organizational charts
• Confidential data: customer contracts, employee files or financial records
• Restricted data: protected health information, payment card data, authentication credentials or sensitive regulated data

This helps participants understand the severity of the incident and the potential legal, operational and reputational impacts.

Build the Tabletop Around an Incident Response Plan Template

An incident response plan template can be useful, but only if it reflects your organization’s structure, systems and obligations. During the tabletop, walk through the core phases of incident response and test whether your plan provides enough guidance.

A practical incident response plan often includes the following sections:

• Purpose and scope
• Definitions and severity levels
• Roles and responsibilities
• Incident reporting channels
• Triage and escalation process
• Evidence preservation expectations
• Containment procedures
• Eradication and recovery steps
• Internal and external communications
• Legal, regulatory and contractual notification considerations
• Vendor and third-party coordination
• Documentation requirements
• Post-incident review process
• Plan maintenance schedule

Tabletop Checklist: Incident Response Plan Readiness

Before the exercise, review whether your plan answers these questions:

• Is there a clear method for employees to report suspected incidents?
• Are incident severity levels defined?
• Is there a current contact list for the incident response team?
• Are after-hours contacts included?
• Is there a backup communication method if email is unavailable?
• Are decision-makers and alternates identified?
• Does the plan address incidents involving vendors?
• Does the plan address cloud systems and remote work?
• Does the plan define who communicates with customers, regulators and the media?
• Does the plan explain how evidence should be preserved?
• Does the plan include criteria for engaging external support?
• Does the plan require a post-incident review?

If the answer to several of these questions is “no,” the tabletop is still worthwhile. It will help prioritize improvements.

Plan the Exercise Step by Step

A well-run tabletop does not need to be complicated, but it does require preparation.

Step 1: Assign an Exercise Owner

Designate one person to coordinate the exercise. This may be the chief information security officer, IT director, compliance officer, risk manager or an external facilitator.

The exercise owner should:

• Define the objective
• Select participants
• Schedule the session
• Prepare materials
• Coordinate with leadership
• Manage pre-briefing communications
• Ensure notes and action items are captured

Step 2: Decide the Format and Duration

Most tabletop exercises run between 90 minutes and four hours. Executive-level exercises are often shorter and decision-focused. Operational exercises may be longer and more detailed.

Common formats include:

• Discussion-based tabletop: Facilitator presents the scenario and asks questions.
• Role-based tabletop: Participants respond according to their assigned roles.
• Hybrid tabletop: Combines business decision-making with some technical validation.
• Multi-session tabletop: Separate sessions for executives, IT and operational teams, followed by a combined review.

For a first tabletop, keep the format simple.

Step 3: Prepare Scenario Injects

“Injects” are new pieces of information introduced during the exercise. They simulate how incidents evolve over time.

Example injects for a ransomware tabletop:

1. Help desk receives reports that users cannot open files.
2. A ransom note appears on several systems.
3. IT discovers suspicious administrator account activity.
4. The backup system is also showing errors.
5. A local reporter contacts the communications team.
6. A major customer asks whether its data was affected.
7. Operations reports that a critical business process is down.
8. The attacker claims to have copied sensitive data.
9. The cyber insurance policy requires prompt notice.
10. Leadership must decide whether to restore, rebuild or continue manual operations.

Injects should be realistic and tied to decisions the organization may actually face.

Step 4: Prepare Facilitator Questions

The facilitator should ask questions that reveal gaps in process, authority and communication.

Examples include:

• Who is notified first?
• What information is needed before declaring an incident?
• Who decides the severity level?
• What systems are most critical to restore?
• What data may be involved?
• How do we determine whether regulated data was affected?
• Who contacts legal counsel?
• Who contacts the cyber insurer?
• Who speaks to employees?
• Who speaks to customers?
• What do we do if email is unavailable?
• What if the vendor is not responding?
• What if backups are unavailable or untested?
• What decisions require executive approval?
• What documentation must be maintained?

The goal is not to find perfect answers immediately. The goal is to learn whether the organization can reach sound decisions with available information.

Step 5: Set Ground Rules

At the start of the exercise, explain:

• This is a learning exercise, not an audit of individual performance.
• Participants should respond based on current processes, not ideal future processes.
• Assumptions should be stated clearly.
• Gaps should be documented without assigning blame.
• Legal interpretations should be referred to qualified counsel.
• The exercise is confidential unless leadership decides otherwise.

Clear ground rules encourage honest discussion.

Run the Tabletop Exercise

A typical tabletop agenda looks like this:

Sample 2-Hour Agenda

0:00–0:10 — Welcome and objectives

• Explain the purpose
• Introduce participants
• Review ground rules

0:10–0:20 — Review incident response roles

• Confirm incident commander
• Review executive, IT, legal, compliance and communications roles

0:20–1:30 — Scenario discussion

• Present initial scenario
• Introduce injects
• Ask facilitator questions
• Capture decisions and gaps

1:30–1:50 — Lessons learned

• Identify what worked
• Identify unclear processes
• Assign preliminary action items

1:50–2:00 — Wrap-up

• Confirm next steps
• Set timeline for after-action report
• Thank participants

Example Scenario: Ransomware and Sensitive Data Exposure

Here is a simplified example suitable for a business-focused tabletop.

Scenario start: On Monday morning, employees report that shared files are inaccessible. Several users see a message demanding payment in cryptocurrency. IT confirms that multiple servers are encrypted. Inject 1: The finance department cannot access payment records needed for payroll processing. Questions:

• Who declares this an incident?
• What severity level applies?
• Who joins the incident response team?
• What business processes are most urgent?

Inject 2: IT identifies suspicious activity from a privileged account. Questions:

• Do we disable accounts immediately?
• How do we preserve logs?
• Who approves containment actions that may disrupt operations?

Inject 3: The attacker claims to have copied employee and customer data. Questions:

• How do we determine what data was involved?
• Does the data classification policy help us prioritize?
• Who contacts legal counsel?
• Who evaluates notification obligations?

Inject 4: A customer asks whether its information was affected. Questions:

• Who is authorized to respond?
• What can we say before the investigation is complete?
• Are contractual notification timelines involved?

Inject 5: Backups are available, but restoration may take several days. Questions:

• Who decides restoration priorities?
• Are manual workarounds documented?
• What is the acceptable business downtime?

This type of scenario tests governance, communication, data classification, legal escalation and operational resilience.

Capture Decisions, Gaps and Action Items

The value of a tabletop exercise comes from what happens afterward. Assign a scribe to document key points during the exercise.

What to Document

Capture:

• Date, time and participants
• Scenario summary
• Exercise objective
• Key decisions made
• Unresolved questions
• Policy or procedure gaps
• Communication gaps
• Technology limitations
• Vendor dependencies
• Training needs
• Action items
• Responsible owners
• Target completion dates

Avoid turning the after-action report into a transcript. Focus on findings and improvements.

Sample Findings

Examples of useful findings include:

• The incident response plan does not identify an alternate incident commander.
• The executive team was unsure who approves external communications.
• The cyber insurance contact information is outdated.
• The organization does not have a tested method for communicating if email is unavailable.
• The data classification policy is too complex for non-technical staff to apply quickly.
• Vendor contact information is incomplete.
• Backup restoration priorities are not aligned with business priorities.
• No process exists for documenting incident decisions in real time.

These findings should be translated into practical remediation steps.

Improve Your Policies After the Exercise

A tabletop exercise should directly inform policy and procedure updates.

Information Security Policy

If you are writing an information security policy or updating an existing one, use tabletop findings to clarify:

• Leadership accountability for cybersecurity
• Security roles and responsibilities
• Risk management expectations
• Incident reporting requirements
• Data protection requirements
• Acceptable technology use
• Third-party security expectations
• Exceptions and enforcement
• Policy review frequency

The information security policy should be high-level enough to remain stable, while supporting procedures provide operational detail.

Incident Response Plan

Update the incident response plan to reflect:

• Clear activation criteria
• Defined severity levels
• Current contact lists
• Alternate communication methods
• Decision authority
• Vendor escalation paths
• Evidence preservation guidance
• External communications process
• Post-incident review requirements

If you are using an incident response plan template, customize it. Templates are helpful starting points, but they rarely capture your exact systems, vendors, legal obligations, customer commitments or business priorities.

Data Classification Policy

Improve the data classification policy by confirming that employees can answer:

• What types of data do we handle?
• Which data is most sensitive?
• Who owns the data?
• Where is the data stored?
• How should the data be protected?
• What should employees do if sensitive data may be exposed?

A practical data classification policy supports faster incident triage. If participants cannot determine whether an incident involves confidential or regulated data, the policy may need clearer examples.

Compliance Considerations

Tabletop exercises support compliance by demonstrating that the organization has considered incident response roles, processes and documentation. Requirements vary by industry, contract, state law, payer requirement and framework version, so organizations should avoid assuming one exercise satisfies every obligation.

Relevant frameworks and rules may include:

• HIPAA Security Rule, including 45 CFR 164.308 for administrative safeguards, for covered entities and business associates
• HIPAA Breach Notification Rule for applicable healthcare privacy incidents
• Payment Card Industry Data Security Standard, where payment card environments are involved
• National Institute of Standards and Technology Cybersecurity Framework
• NIST Special Publication 800-61, Computer Security Incident Handling Guide
• ISO/IEC 27001, where an organization maintains or seeks certification
• State data breach notification laws, which vary by jurisdiction
• Contractual security requirements from customers, payers or business partners
• Cyber insurance policy conditions

This article is not legal advice. When determining whether a specific incident triggers notification duties or contractual reporting requirements, consult qualified counsel.

Common Mistakes to Avoid

Treating the Exercise as an IT-Only Event

Cyber incidents are business events. IT may lead technical containment and recovery, but executives often make decisions about downtime, communications, legal risk, vendor commitments and customer impact.

Making the Scenario Too Easy

If the scenario has no ambiguity, the exercise will not reveal decision gaps. Real incidents involve incomplete information, competing priorities and time pressure.

Skipping Legal and Communications

Legal and communications teams are essential when incidents may involve sensitive data, contractual obligations, regulators, media attention or customer concerns.

Failing to Document Action Items

An exercise without follow-up becomes a meeting instead of a control improvement activity. Assign owners and deadlines.

Overusing Jargon

Business leaders need clear explanations. Terms such as “indicators of compromise,” “lateral movement,” “exfiltration” and “persistence” should be explained in plain language during the exercise.

Ignoring Vendors

Many organizations rely on managed service providers, cloud platforms, software vendors and outsourced operations. If a vendor would be needed during a real incident, include that relationship in the exercise.

Tabletop Exercise Planning Checklist

Use this checklist to prepare your next exercise.

Before the Exercise

• Define the objective.
• Select a realistic scenario.
• Identify participants.
• Assign a facilitator and scribe.
• Review the incident response plan.
• Review relevant policies, including the data classification policy.
• Confirm contact lists.
• Prepare scenario injects.
• Prepare facilitator questions.
• Schedule the session.
• Brief leadership on expectations.

During the Exercise

• Review objectives and ground rules.
• Confirm roles and responsibilities.
• Present the scenario.
• Ask decision-focused questions.
• Introduce injects gradually.
• Capture decisions and gaps.
• Encourage cross-functional discussion.
• Avoid blame.
• Identify immediate improvement opportunities.

After the Exercise

• Prepare an after-action report.
• Prioritize findings.
• Assign action item owners.
• Set deadlines.
• Update policies and procedures.
• Refresh contact lists.
• Schedule follow-up training.
• Report key outcomes to leadership.
• Plan the next tabletop exercise.

How Often Should You Run a Tabletop Exercise?

There is no single schedule that fits every organization. Frequency depends on risk, regulatory environment, business complexity, customer requirements and changes in technology or operations.

Many organizations conduct at least one cybersecurity tabletop exercise annually, with additional exercises after major changes such as:

• New business systems
• Mergers or acquisitions
• New regulatory or contractual requirements
• Significant staffing changes
• Major cloud migrations
• New managed service providers
• Recent security incidents
• Changes in cyber insurance requirements

Healthcare organizations, organizations with regulated data and companies with high customer dependency may benefit from more frequent or more targeted exercises.

Metrics for Leadership Reporting

After the exercise, leadership will want to know what improved. Consider reporting practical, non-technical metrics such as:

• Number of gaps identified
• Number of action items closed
• Percentage of incident response contacts validated
• Number of policies updated
• Time required to assemble the incident response team
• Number of critical vendors with confirmed escalation contacts
• Backup restoration priorities confirmed or updated
• Communications templates created or revised

Avoid presenting tabletop results as a guarantee of readiness. Instead, frame them as evidence of continuous improvement.

Conclusion and Next Steps

A tabletop exercise is one of the most effective ways to determine whether your incident response plan is usable, understood and aligned with business priorities. It helps leaders practice difficult decisions before a real incident, reveals gaps in policies and strengthens coordination across IT, legal, compliance, operations and executive teams.

To get started, choose one realistic scenario, gather the right stakeholders and test your current process honestly. Then update your incident response plan, information security policy and data classification policy based on what you learn.

Practical Next Steps

1. Review your current incident response plan.
2. Confirm that roles, contacts and escalation paths are current.
3. Select a scenario tied to your highest business risks.
4. Schedule a 90-minute tabletop with leadership and key teams.
5. Document findings and assign action item owners.
6. Update policies and procedures within a defined timeline.
7. Plan a follow-up exercise to validate improvements.

How ThornShield Can Help

ThornShield Technologies helps organizations develop practical cybersecurity policies, incident response plans and governance processes that align with business operations and compliance expectations. If your team is updating policies or preparing for a tabletop exercise, our [Security Policy Development](https://www.thornshield.tech/services/policy-development) service can help you build clear, usable documentation.

This article provides general information and is not legal advice.