To run a tabletop exercise for business continuity, gather your crisis team for two hours around one realistic scenario, release timed injects, let players decide with the plans they really have, rate what you observe against set criteria, then hold a hot wash and write an after-action report with owners and deadlines. This kit gives you each piece, ready for an SME or a group entity.
A tabletop exercise is a discussion-based simulation in which decision-makers work through a disruption scenario step by step, without touching production systems. It tests roles, decisions, plans and communication rather than technology, which makes it the usual first step of an exercise programme, before functional tests, failover tests and full-scale simulations.
An inject is a scripted piece of information (a phone call, an email, a news item, a system message) released at a set time to move the scenario forward and force a decision.
Download, free and without sign-up: Excel workbook (.xlsx) · after-action report template (.docx).
What is in the kit?
| Component | Purpose | In the download |
|---|---|---|
| Agenda and ground rules | Keep the session to 120 minutes | Agenda sheet |
| Role cards | Who plays, who runs the game, who observes | Roles sheet |
| Scenario and 11 timed injects | Ransomware on the ERP, with an IT provider and a supplier angle | Injects sheet, one row per inject |
| Observation grid | Rate 11 criteria on a 1 to 4 scale, with evidence | Observation sheet |
| Holding statement and audience map | Crisis communication for a small company | Report template, annex |
| Hot wash guide and after-action report | Turn findings into tracked actions | Report template (.docx) |
How to run a tabletop exercise for business continuity in two hours?
A tabletop is won or lost in preparation: vague objectives, a scenario that ignores your real systems or observers who do not know what to look for will empty it of value.
| When | Task | Owner |
|---|---|---|
| 6 weeks before | Sponsor agrees 2 or 3 objectives (for example: "activate the crisis team within 20 minutes", "identify our notification duties", "test the customer communication") | Business continuity lead |
| 4 weeks before | Adapt the scenario: real system names, real provider and supplier names, your BIA values (MTPD, RTO, RPO) | Facilitator |
| 2 weeks before | Invite players and their deputies, brief observers on the grid | Facilitator |
| 1 week before | Dry run of the injects with the simulation cell | Facilitator, simulation cell |
| Day of the exercise | Room, screen, printed inject cards, blank crisis log, current plans on paper | Facilitator |
Agenda for the day (T = minutes from the start of the session):
| Session time | Block | Content |
|---|---|---|
| T+0 to T+10 | Briefing | Objectives, scope, ground rules, roles, starting situation |
| T+10 to T+92 | Play | 11 injects; every decision written in the crisis log |
| T+92 to T+115 | Hot wash | Round table, first findings from observers |
| T+115 to T+120 | Close | Top three actions, owners, date of the report |
Ground rules to read out at T+0:
- No fault, no blame: we test plans and arrangements, not people.
- Play with the documents and contacts you really have; if something is missing, say so, it is a finding.
- Scenario time runs faster than real time; the facilitator announces each jump.
- If it is not in the crisis log, it did not happen.
- Any message that leaves the room starts with "EXERCISE EXERCISE EXERCISE"; no real call to customers, media or authorities unless agreed beforehand.
How to set up a crisis management team for the exercise?
Keep the core team small: five to seven people with decision power, each with a named deputy. In an SME one person may hold two roles, but every role must be covered. The team needs written activation criteria, a meeting place and a fallback channel that does not depend on the systems under attack, and a scribe who keeps the crisis log.
| Role | In the exercise | In a real crisis | SME tip |
|---|---|---|---|
| Facilitator | Runs the clock, delivers injects, does not play | n/a | Someone outside the crisis team, or an external person |
| Simulation cell (1 or 2) | Plays the IT provider, customer, journalist, attackers, authorities | n/a | Can be the facilitator for small groups |
| Observers (1 to 3) | Fill in the observation grid, never intervene | Internal audit, peers | Pick people who will own follow-up |
| Crisis lead | Decides, sets priorities, arbitrates | Same | Managing director or deputy |
| Operations / business lead | Workarounds, order and delivery priorities | Same | Head of operations or logistics |
| IT lead | Technical response, link with the IT provider | Same | Internal IT or the provider's account manager |
| Communication lead | Internal and external messages, spokesperson support | Same | Often the managing director's assistant or marketing |
| Legal / DPO / compliance | Notifications, contracts, evidence, insurance | Same | External counsel on call if no in-house lawyer |
| HR | Staff information, welfare, rumours | Same | |
| Finance / purchasing | Supplier contracts, insurer, cash | Same | |
| Scribe | Timestamped log of facts, decisions, actions | Same | Never the crisis lead |
For a fuller description of each role, activation and the first 60 minutes, see crisis management team roles.
The scenario: ransomware hits the ERP on a Monday morning
Starting situation (read at T+10). The Company makes and distributes spare parts: 180 staff, one plant, one warehouse, around 400 business customers. Its ERP (orders, stock, invoicing, payroll) is hosted and managed by an external IT service provider, which reaches the ERP through a permanent remote-access link. Email and telephony run in the cloud. It is Monday, 07:40.
| Session time | Scenario time | Inject (what players receive) | Delivered by | Expected decisions and actions | Lead |
|---|---|---|---|---|---|
| T+10 | Mon 07:40 | The warehouse manager calls: ERP screens show a ransom note; picking and label printing have stopped. | Simulation cell, phone | Qualify the event, open the crisis log, apply the activation criteria, convene the crisis team, confirm the crisis lead | Crisis lead, IT lead |
| T+17 | 07:55 | The IT provider emails: encryption detected on several client environments, including yours; investigation under way; it advises cutting the remote-access link. | Simulation cell, email | Isolate (cut the link), preserve evidence, reach the provider's incident contact, check the contract (service levels, notification duty, security obligations) | IT lead, purchasing |
| T+25 | 08:30 | Status sheet: email and phones work; ERP, invoicing and warehouse labels are down; 140 orders due today. Your BIA gives order-to-delivery a maximum tolerable period of disruption of 48 hours. | Facilitator | Activate the continuity workarounds (manual order intake, paper picking lists), rank customers, set the rhythm of crisis meetings | Operations lead |
| T+33 | 09:00 | Staff are messaging each other; an employee has posted a photo of the ransom note on a social network. | Simulation cell, screenshot | First message to all staff (what we know, what to do, what not to post), ask for removal of the post, brief reception | Communication lead, HR |
| T+40 | 09:30 | The backup console, hosted by the provider, is also encrypted. An offline copy from last Wednesday exists. | Simulation cell | Measure the data gap against the RPO, choose a recovery path, plan re-entry of orders from emails and paper, keep evidence | IT lead, finance |
| T+48 | 10:00 | The attackers claim they copied payroll and customer files and threaten to publish them. | Simulation cell, email | Start the personal data breach assessment and log the time of awareness; check whether NIS2 or DORA reporting applies; name who notifies and who decides | Legal / DPO, crisis lead |
| T+55 | 10:30 | The largest customer's buyer calls the sales director: will Tuesday's delivery be made, is our data affected? Wants a written answer by noon. | Simulation cell, phone | Use the approved customer message, make no speculative promise, check contractual commitments, give one point of contact | Communication lead, operations lead |
| T+63 | 11:00 | Ransom demand: payment in cryptocurrency within 72 hours. | Simulation cell, email | No decision under pressure: apply the policy, inform the police and the cyber insurer, take legal and specialist advice, do not negotiate alone | Crisis lead, legal, finance |
| T+70 | 11:30 | A local journalist calls reception: "We hear you have been hit by a cyberattack. Can you confirm?" | Simulation cell, phone | Route to the spokesperson, use the holding statement, log the call | Communication lead |
| T+78 | 14:00 | The IT provider's own crisis team is overwhelmed: your environment will not be restored before Thursday. A raw-material supplier says your electronic orders have not arrived since Monday morning. | Simulation cell, email and phone | Escalate with the provider at management level, decide on an alternative (clean rebuild, another provider), switch supplier orders to email or phone, review exit and substitution options | IT lead, purchasing |
| T+85 | 16:00 | The owner (or the group head office) wants a one-page situation report by 17:00 and asks whether group-level communication is needed. | Facilitator | Write the situation report (facts, impacts, decisions, needs, next steps), apply the group escalation criteria, align messages | Crisis lead |
| T+92 | 17:00 | End of play: the facilitator freezes the scenario. | Facilitator | Crisis lead states the decisions for the next 24 hours and the time of the next meeting; the scribe closes the log | Crisis lead, scribe |
Notification clocks to check at T+48 (facilitator note): under Article 33 of the GDPR, a personal data breach is notified to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Essential and important entities under NIS2 send an early warning within 24 hours and an incident notification within 72 hours (Article 23(4)). Financial entities under DORA follow the time limits of Delegated Regulation (EU) 2025/301: initial notification within 4 hours of classifying an incident as major, and no later than 24 hours after becoming aware of it. EU incident reporting rules are being revised in the "Digital Omnibus", so check the texts in force on the day of your exercise.
Spare injects if the team moves too fast: the deputy crisis lead is on holiday and unreachable; the cyber insurer requires its own incident response firm; a second group entity uses the same IT provider. More scenarios: 10 crisis exercise scenarios.
Observation grid
Rating scale: 1 not demonstrated, 2 partially demonstrated (major gaps), 3 demonstrated with minor gaps, 4 fully demonstrated, N/O not observed. Every rating needs evidence: a time, a quote, a document.
| # | Criterion | What good looks like | Rating | Evidence |
|---|---|---|---|---|
| 1 | Activation and escalation | Crisis team convened within the target time, using written criteria | ||
| 2 | Roles and leadership | Every role held, deputies known, the crisis lead arbitrates | ||
| 3 | Situational awareness | A shared picture updated at each meeting; a situation report produced | ||
| 4 | Use of plans and BIA | Continuity plan, BIA values and contact lists opened and used | ||
| 5 | Decision-making | Decisions logged with time, owner and rationale; none left hanging | ||
| 6 | Supplier management | Provider contract, service levels and escalation contacts found; alternatives considered | ||
| 7 | Regulatory notifications | Duties identified, time of awareness logged, owner named | ||
| 8 | Internal communication | First staff message within the target time, consistent with the external line | ||
| 9 | External communication | Holding statement approved; customers, suppliers and media handled by named people | ||
| 10 | Recovery priorities | Recovery order follows BIA priorities | ||
| 11 | Crisis log | Complete enough to rebuild the timeline afterwards |
How to run crisis communication for a small company?
One voice outside, one sender inside. The managing director is usually the spokesperson; the communication lead drafts; reception and sales receive a short script and redirect every question. Nobody else speaks to the media.
| Audience | When | Channel | Owner |
|---|---|---|---|
| Staff | Within the first hour, then at each update | Email or SMS if available, team leaders, notice boards | Communication lead, HR |
| Key customers | Before they hear it elsewhere | Call from the account manager, written follow-up | Operations / sales |
| IT provider and suppliers | As soon as dependencies are known | Phone, then email | IT lead, purchasing |
| Authorities (data protection authority, CSIRT or competent authority, police) | Within legal deadlines | Official channels | Legal / DPO |
| Cyber insurer | As early as the policy requires | Insurer hotline | Finance |
| Media | On request (reactive) | Holding statement | Spokesperson |
| Owner or group head office | As soon as escalation criteria are met | Phone and situation report | Crisis lead |
First holding statement (template):
On [date] at [time], [Company] detected a cyber incident affecting some of its IT systems. We immediately activated our crisis procedures and are working with [specialists / our IT partners] to restore operations safely. [Deliveries / customer service] [continue / are temporarily disrupted]; affected customers are being contacted directly. We are checking whether personal data is involved and will inform the people concerned and the authorities as required. Next update: [time]. Contact: [name, email, phone].
Rules: facts only, no speculation on the cause or the attackers, never blame the provider in public, no figure that has not been validated, the same facts inside and outside, and every message timestamped and kept. Financial entities must have crisis communication plans and at least one person tasked with the public and media function (DORA Article 14). A ready-made plan: crisis communication plan template.
What changes in a group-wide crisis management framework?
In a group, the exercise also tests the link between the entity and head office. A simple framework has three tiers and written escalation criteria.
| Tier | Decides on | Typical members |
|---|---|---|
| Group crisis team (strategic) | Reputation, group communication, financing, decisions affecting several entities | Group CEO or delegate, group communication, legal, finance, CISO |
| Entity crisis team (tactical) | Local response, workarounds, local customers and staff | Entity manager and the roles above |
| Specialist teams (operational) | IT recovery, cyber response, site emergency | IT, provider, security |
Escalate to the group when: more than one entity is affected; a shared IT provider, service or supplier is involved; a regulatory notification or media exposure is likely; the impact exceeds a financial threshold set by the group; or a ransom is demanded. Share one crisis log format and one situation report format, let the group validate external statements, and keep local command with the entity unless it is transferred explicitly. To exercise this, add two or three head-office people as a "group cell" from T+78. ISO 22361:2022 gives guidance on strategic crisis management.
Hot wash and after-action report template
Hot wash (20 minutes): each player names one thing that worked and one thing to fix; observers give their top three findings; the facilitator says whether each objective was met, partly met or not met. Write the report within two weeks.
| Section | Content |
|---|---|
| 1. Identity | Date, scenario, objectives, participants, scope |
| 2. Summary for management | Half a page: objectives met or not, top three risks revealed |
| 3. Timeline | Key facts and decisions, taken from the crisis log |
| 4. Observation results | Rating per criterion, with evidence |
| 5. Strengths | What to keep |
| 6. Findings and root causes | What failed and why (plan, training, tool, contract) |
| 7. Action plan | Table below |
| 8. Documents to update | Plans, contact lists, contracts, templates |
| 9. Next exercise | Type, date, scenario, what will be harder |
| # | Finding | Action | Owner | Due date | Requirement | Status |
|---|---|---|---|---|---|---|
| 1 | Provider's incident contact not in the plan | Add 24/7 contact and escalation path to the plan and the contract | Purchasing | [date] | ISO 22301 §10.1 | Open |
How does the kit map to ISO 22301, DORA and NIS2?
| Reference | What it asks, in short | What this kit covers |
|---|---|---|
| ISO 22301:2019, §8.5 Exercise programme | A programme of exercises and tests on appropriate scenarios with clear objectives, followed by post-exercise reports and improvement actions | One scenario-based exercise of the crisis team and plans, with report and actions; the multi-year programme remains yours to plan |
| ISO 22301:2019, §8.6 and §10.1 | Evaluation of business continuity documentation and capabilities; corrective action | Observation grid, after-action report, action plan |
| ISO 22398:2013 | Guidelines for planning, conducting and improving exercises | Structure: objectives, roles, scenario, evaluation, report |
| DORA Art. 11(6)(a) | Test ICT business continuity and ICT response and recovery plans at least yearly; entities other than microenterprises include cyber-attack and switchover scenarios | Cyber-attack scenario at decision level. A tabletop does not test switchovers: plan a technical test as well |
| DORA Art. 11(6)(b) | Test the crisis communication plans (Art. 14) | Communication injects, holding statement, audience map |
| DORA Art. 24 and 25 | Testing programme for entities other than microenterprises, with "scenario-based tests" among the listed tests, independent testers and remediation of issues | Scenario-based test, facilitator independent from players, tracked actions |
| Delegated Regulation (EU) 2024/1774, Art. 25 | ICT business continuity tests on severe but plausible scenarios, including ICT third-party services, challenging governance and crisis communication assumptions | IT provider angle, escalation and communication injects |
| NIS2 Art. 21(2)(c) | Business continuity, such as backup management and disaster recovery, and crisis management | Backup inject, crisis team, communication |
| Implementing Regulation (EU) 2024/2690, Annex points 4.1.4 and 4.3.4 | For cloud, data centre, managed service and other listed digital providers: test the continuity, recovery and crisis management plans | Same kit, with the provider in the players' seat |
If you would rather run the injects and the decision log in a tool, ResiPlan has a crisis gaming module.
FAQ
How long should a tabletop exercise last?
Two hours suits a first exercise: about 80 minutes of play and 20 minutes of hot wash. Beyond three hours, attention drops; split into two sessions instead.
How often should we run one?
Financial entities under DORA must test ICT business continuity plans at least yearly (Art. 11(6)). ISO 22301 asks for a planned programme. A yearly tabletop, plus an exercise after any major change, is a reasonable baseline for an SME.
Is a tabletop exercise enough for DORA or NIS2?
No. It tests decisions and communication. Switchovers, backup restores and recovery times need technical tests.
Should our IT provider take part?
Yes, if you can. A provider in the room shows quickly whether contracts, contacts and recovery promises match reality.
Who should facilitate?
Someone who will not be needed as a player and who can keep the clock. An external facilitator helps for the first exercise.
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 5, 11, 14, 24 and 25, EUR-Lex
- Commission Delegated Regulation (EU) 2024/1774, Article 25, EUR-Lex
- Commission Delegated Regulation (EU) 2025/301, Article 5, EUR-Lex
- Directive (EU) 2022/2555 (NIS2), Articles 21 and 23, EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690, Annex section 4, EUR-Lex
- Regulation (EU) 2016/679 (GDPR), Article 33, EUR-Lex
- ENISA, NIS2 Technical Implementation Guidance
- ISO 22301:2019, Business continuity management systems, Requirements
- ISO 22398:2013, Guidelines for exercises
- ISO 22361:2022, Crisis management, Guidelines