Run a useful business continuity tabletop

Choose a service and disruption

Start with an essential service and one fictional disruption: an unavailable office, a critical provider outage or unavailable key people. Invite the roles that own the service and can authorize alternate processes.

Define targets without assuming capability

Record business impact, dependencies, a target time to restore service and an acceptable data loss target. Leave unknowns visible. A target is a planning decision; it does not prove that recovery has been demonstrated.

Keep the exercise controlled

Use the participant pack for the starting situation and agenda. Keep later developments and facilitator notes in the facilitator pack. Discuss decisions without changing real systems, invoking emergency services or contacting actual clients.

Capture outcomes and follow-up

Record attendance, objectives reviewed, safe workarounds, validation and reconciliation criteria. Convert gaps into improvements with responsible roles and dates. Schedule a deliberate retest when appropriate; there is no universal cadence in this tool.

Connect only the reviewed results

Optional free saving keeps the entire project private. Enabled firm workspaces keep facilitator records restricted. A designated reviewer can deliberately publish an after-action report, edit the details intended for the firm and connect its corrective work to continuing risks. Publishing does not copy facilitator notes or grant completion to an action.

Source & applicability

NIST-34 — SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems

Supports continuity planning, business impact analysis and recovery priorities. Federal contingency guidance used as planning background, not a specific RIA legal mandate.

SEC-registered and state-registered firms may have different obligations. Have the appropriate professionals review what applies to your firm. No regulatory determination is made here.