Run a useful incident tabletop
Prepare the discussion, capture decisions, and leave with owned improvement actions.
Content and source check: October 1, 2026 · Operational suggestions
Set a bounded objective
Pick one fictional scenario and a 30-, 60- or 90-minute session. Identify the decisions you want to practice, such as escalation authority, continuity options or provider coordination. Include the roles needed to make those decisions.
Prepare two packs
Review the facilitator brief and injects before the session. Give participants the participant pack, which contains ground rules, the starting situation and a general agenda. It omits the facilitator brief, later injects and facilitator notes from the exported file itself.
Facilitate the uncertainty
Introduce each inject at its exercise minute, not as an actual incident timestamp. Ask participants to explain what they know, what they would verify, who can authorize a decision and what the operational impact could be. Do not make changes to real systems during the exercise.
Handle communications carefully
Use factual internal updates and an explicit approval route for external statements. Route notification obligations and applicability questions to counsel and compliance. This tool deliberately does not calculate legal notification deadlines or decide which rules apply.
Turn observations into actions
Capture decisions and their reasoning during the discussion. Finish with a short debrief. For each improvement, record a finding, responsible role, priority, due date and status. Schedule a separate check that the action was carried out. The exercise itself is not proof of readiness or compliance.
Source & applicability
NIST-84 — Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities
Describes designing, conducting and evaluating exercises for organizational IT plans. Exercise methodology background, originally in a federal context. Our fictional scenarios and minute allocations are product-authored suggestions.
SEC-registered and state-registered firms may have different obligations. Have the appropriate professionals review what applies to your firm. No regulatory determination is made here.