Tabletop exercises

I have had the opportunity to conduct numerous tabletop exercises with executive teams of different types of organizations of all shapes and sizes. The teams all came from different places in terms of awareness and maturity, but all of them provided value for the participants. It is one thing to have a plan for how to respond to a breach. It is quite another to ensure everyone has clarity on their role and the confidence to execute in a high-stress situation.

Tabletop exercises should not be conducted as an evaluation, they should instead be conducted as a learning opportunity. The first mistake I see people make is to run them as a test of whether people know what to do. This causes unnecessary stress and limits learning. I find it to be more effective to step through the response to a real-world scenario while asking participants to challenge the plan and find better ways to respond. We have found meaningful insights from team members going through the process...