Your Incident Response Plan Has Never Been in a Fight

Your Incident Response Plan Has Never Been in a Fight

Why tabletop exercises belong in every IT security program, and what your team learns by going through one before a real incident forces the lesson.

Most organizations we work with have an incident response plan. It was written for an audit, an insurance application, or a board request, and it lives in a SharePoint folder or a binder in someone's office. It has an incident response team listed on page three, a severity matrix, and a section on notifying stakeholders. Very few of those plans have ever been used.

That matters, because the first time a plan gets tested should not be at 2:00 a.m. on a Saturday with a ransom note on every screen. That is when you find out the phone numbers on page three are two years old, the person authorized to take the network offline is on vacation, and nobody is sure whether to call the insurance carrier, outside counsel, or the MSP first.

A tabletop exercise lets you find those problems on a Tuesday morning, over coffee, with nothing actually broken.

What a tabletop exercise is, and what it isn't

A tabletop exercise is a facilitated, discussion-based walk-through of a security incident. The people who would actually respond, from IT and from the business, sit around a table while a facilitator presents a realistic scenario and moves it forward in stages. At each stage, the group has to decide what they know, what they do next, who makes the call, and who needs to be told.

It is not a penetration test and it is not a live simulation. At no point is a real incident introduced into your physical or logical environment. Nothing is attacked, nothing goes offline, and no one gets phished. The only thing under test is your plan and the people who carry it out.

Why it belongs in every security program

Firewalls, EDR, MFA, patching, and vulnerability management all reduce the odds of a breach. None of them reduce the odds to zero. Mature security programs accept that and invest in the ability to detect, contain, and recover. An untested response plan is an assumption, and assumptions tend to fail at the worst possible moment.

There are practical drivers as well:

• Regulators and auditors expect it. PCI DSS requires the incident response plan to be tested at least annually. Financial institutions are routinely asked by examiners for evidence of incident response testing, and healthcare and other regulated industries face similar expectations.
• Cyber insurers are asking. Insurance applications and renewals increasingly ask whether your plan exists and whether it has been exercised.
• Your environment changes. People leave, vendors change, and systems move to the cloud. A plan that was accurate when it was written drifts out of date quietly. A tabletop surfaces that drift.
• Incidents are business events. A serious incident involves legal, HR, finance, communications, and executive leadership, not just IT. A tabletop is often the first time those groups have worked through a crisis together.

The real test

Security controls are designed to keep incidents from happening. Incident response is what you have when they fail anyway.

What you learn by going through the process

Every exercise is different, but certain findings come up again and again. These are the kinds of things clients typically walk away knowing:

• Who actually has authority. Who can formally declare an incident? Who can authorize shutting down a production system or disconnecting a site? Who approves bringing in an outside forensics firm? Plans often name a team without spelling out decision rights, and the exercise exposes that gap fast.
• Whether you can communicate when your systems can't. If email and Teams are compromised or offline, how does the response team talk to each other? Is there a current, offline contact list? Does anyone have after-hours numbers for the vendors you depend on?
• How your third parties fit in. Your MSP, your cyber insurance carrier, your breach counsel, and your key software vendors all have a role. Many insurers require you to call their hotline first and use their approved incident response firms. Finding that out mid-incident can cost you coverage.
• Whether your recovery assumptions hold. "We'll restore from backup" is a common answer. The follow-up questions are where the learning happens: How long will it take? Are the backups isolated from the compromised environment? When were they last test-restored? Which systems come back first?
• What you have to tell, to whom, and by when. Customer notification, regulator notification, law enforcement, the board, and the press each have different triggers and timelines. The exercise makes the team work out who owns each conversation and what gets said.
• Where the documentation falls short. Some steps are written down but no one knows them. Others are known but never written down. Both show up clearly once a scenario is in motion, along with gaps in evidence handling and incident logging.

How Digital Elevation runs a tabletop exercise

Our Security Tabletop Exercises follow a structured, three-phase methodology. Each engagement is built around your organization rather than a generic script.

• Pre-exercise consultation. We start with a needs assessment to understand your security concerns and objectives, develop realistic scenarios based on your industry, threat landscape, and past incidents, and identify who needs to be in the room and what role each person plays.
• Exercise facilitation. After a kickoff that sets objectives, rules, and expectations, our facilitator guides the group through the simulated incident, prompting discussion and decisions, and adjusts the scenario in real time based on how the team responds.
• Post-exercise analysis. A debrief covers successes, challenges, and lessons learned. We then perform a gap analysis of your policies, procedures, and response plans and deliver a written report with practical recommendations.

Most exercises fit into half a day. A common agenda looks like this:

Running scenarios in two waves gives the team a chance to apply what they learned in the morning. The afternoon scenarios can push harder on the weak points the first wave uncovered.

Why engage Digital Elevation

• Scenarios built for your industry. Threats that are common in your sector, whether that is finance, healthcare, manufacturing, or retail.
• The whole response team in the room. IT, HR, legal, communications, and leadership take part, so the exercise reflects how a real incident unfolds.
• Advanced threat simulations. Ransomware, insider threats, and supply chain compromises, run the way attackers actually run them.
• A record you can use. Sessions are recorded so nothing is lost, and the recording is reviewed when preparing your recap report, which includes an executive summary, the scenarios used, observations, and prioritized recommendations.
• Senior oversight on every engagement. Engagements are typically staffed by two security professionals, one on-site and one remote, with our Director of Security responsible for the delivery of every engagement.

Getting the most out of the exercise

• Invite the decision makers. If the people who would make the hard calls in a real incident aren't in the room, the exercise can only show you half the picture.
• Bring the plan you actually have. Don't polish it first. The point is to test what exists today.
• Treat findings as a work list. Assign owners and dates to each recommendation and track them to closure.
• Make it recurring. Run an exercise at least annually, and again after major changes such as a merger, a new MSP, or a significant system migration.

The bottom line

The organizations that recover best from security incidents are rarely the ones with the thickest binder. They are the ones whose people have already worked through the hard questions once, together, before it counted. A tabletop exercise turns your incident response plan from a document into a capability, and gives you a clear, prioritized list of what to fix before an attacker finds it for you.

When was your incident response plan last tested?

Let Digital Elevation put it through a realistic scenario, with no risk to your production environment. We will tailor a tabletop exercise to your industry, your team, and your plan. Start the conversation, or reach out directly at scott.montgomery@digitalelevationusa.com or 616-600-4737.

W. Scott Montgomery is Director of Security at Digital Elevation, where he leads the firm's security assessment and advisory practice. With more than 40 years of IT experience, Scott helps mid-market organizations, credit unions, and healthcare and defense-sector firms build practical, defensible security programs, from vulnerability management and examination readiness to compliance across frameworks including NIST CSF, FFIEC, GLBA, and HIPAA.