Incident rehearsal

Cybersecurity tabletop exercises that put your incident response plan to the test

A cybersecurity tabletop exercise is a facilitated discussion in which your leadership walks through a realistic incident, such as ransomware or a redirected payment, and decides who does what, hour by hour. We design the scenario around your organization, lead the session, record every decision and gap, and update your incident response plan from the after-action report.

Ask us to call you back Book the free audit

Four managers of a small firm around a white meeting table, two of them in their sixties, closed laptops and coffee mugs in front of them, a plain clock on the wall — The exercise happens around a table, and the systems stay untouched.

A person here calls you back the same business day, usually within an hour.

Written permission first
A report in plain words
Checked again after the fix

What a cybersecurity tabletop exercise is

A cybersecurity tabletop exercise is a discussion-based rehearsal of an incident. The people named in your incident response plan sit together, a facilitator presents a scenario and asks questions, and the group works out roles, coordination and decisions. NIST’s guide to test, training and exercise programs, SP 800-84, describes it exactly so and adds that a tabletop is discussion-based only and does not involve deploying equipment or other resources.¹

Your network stays untouched. The exercise tests the plan, the contact list and the judgement of the people who will use them, which is why it is a cost-effective way, in NIST’s words, to check that a plan is viable and implementable in an emergency.¹

Format: a guided conversation around one scenario, with new facts introduced as the story moves on
Participants: the decision makers and the people who would carry out the plan
Duration: NIST gives typically two to eight hours, and two to four for senior-level sessions¹
Result: an after-action report and a list of changes to the plan

One exercise from scenario to updated plan, repeated at least once a year.

Why exercise your incident response plan: what the Cyber Centre asks

An incident response plan proves itself only when the people in it have rehearsed it. The Canadian Centre for Cyber Security asks organizations to “test, revisit, and revise your incident response plan annually to keep it effective,” and its ransomware playbook recommends a tabletop exercise so that everyone knows their role and required actions if ransomware strikes.²³

The same playbook gives the reason in one line: “A practiced plan will help you make good decisions when under the pressure of managing a real incident.”³ The Centre’s baseline controls for organizations with fewer than 500 employees start with a written plan that names who handles incidents, kept as an up-to-date hard copy.⁴

What Canadian guidance asks of an incident response plan, and what an exercise checks
Guidance	What it says	What the exercise checks
Baseline control BC.1	A written plan that details who is responsible for handling incidents, with an up-to-date hard copy⁴	Whether the named people are still there, reachable and clear on their part
ITSAP.40.003, January 2026	Test, revisit and revise the plan annually; develop exercises to test the plan and response²	Whether the plan still matches how the organization works today
Ransomware playbook ITSM.00.099	Conduct a tabletop exercise so participants know their roles and required actions in a ransomware attack³	Who decides on shutting systems down, calling the insurer and speaking to staff and clients

Ontario public sector: rehearsing the 72-hour report under O. Reg. 51/26

For school boards, colleges, universities, children’s aid societies and the public hospitals covered by O. Reg. 51/26, an exercise is the safest place to rehearse the regulation’s reporting clock. A critical cyber security incident must be reported to the Ministry’s Chief Information Security Officer “as soon as reasonably practical but no later than 72 hours after the entity has confirmed that it occurred.”⁵

The regulation sets reporting duties and leaves exercises to each organization. One of its tests for a critical incident is that it “requires or results in significant efforts to recover digital information or related infrastructure or activation of cyber security incident response plans,” so the plan and the report are linked.⁵ In the exercise we time the moment of confirmation, check that the primary point of contact or the alternate can file, and walk through the items the report must contain, from the date and time of the incident to the type of information affected. The O. Reg. 51/26 page covers the rest of the regulation.

Ransomware tabletop exercise and other scenarios we run

You choose the scenario; we shape it to your systems, your suppliers and your calendar. A short, concise scenario usually works better than a long one, NIST notes, because participants otherwise spend their time dissecting the story and lose sight of the objectives.¹ Scenarios stay with the facilitator and are written for your organization alone.

Four scenarios and the decisions each one tests
Scenario	Decisions it tests	Who must be at the table
Ransomware on the file server	Isolating systems, keeping evidence, calling the insurer, restoring from offline copies, the ransom question	Leadership, IT provider, finance
A supplier’s bank details changed by email	Stopping the payment, calling the bank, checking the mailbox for forwarding rules, telling the supplier	Finance, the person who approves payments, IT provider
Personal information exposed	Assessing the harm, the privacy breach rules that apply, notices to people and regulators, records to keep	Privacy officer, leadership, communications
Locked out of email and cloud accounts	Working without email, out-of-band contact lists, recovering administrator access	Leadership, IT provider, office manager

Who should attend an incident response tabletop exercise

Everyone with a role in the incident response plan should attend, and the session is pitched to their level. NIST recommends exercising senior-level and operational-level teams separately at first, because their responsibilities differ, and then together to validate coordination between the groups.¹

We bring the two exercise roles NIST describes: a facilitator who leads the discussion and a note-taker who records what happens, called the data collector in SP 800-84.¹ The U.S. Cybersecurity and Infrastructure Security Agency structures its exercise packages around the same roles of planners, facilitators and evaluators, and participants, and includes an after-action report.⁶

The owner, executive director or senior manager who makes the final calls
Finance, for payments, the insurer and any ransom question
Your IT provider or IT lead
The privacy officer, and for O. Reg. 51/26 bodies the primary point of contact and the alternate
Whoever speaks to staff, clients, parents or the media

How the exercise runs, from first inject to after-action report

A tabletop exercise runs in five stages: preparation with the organizer, a short briefing, a scenario that unfolds through injects, an immediate debrief, and a written report that feeds the plan. Each stage leaves a written trace.

1. Preparation

An interview with the organizer, a read of your current plan, the insurance policy’s notification section and the contact list, and agreement on objectives and scenario. Management approves the date, as NIST advises before any exercise.¹

2. Briefing

Scope, ground rules and the starting situation: an ordinary weekday morning and the first sign that something is wrong.

3. Injects and decisions

New facts arrive in stages: a ransom note, a call from a client, a journalist’s email, a backup that fails to mount. The group decides, and the note-taker records each decision, who made it and what information was missing.

4. Hotwash

Right after the discussion, a short debrief, which NIST calls a hotwash: what went well, where more training is needed and which parts of the plan need updating.¹

5. After-action report and plan update

A written report with the purpose, participants, scenario, observations and recommendations, as SP 800-84 describes it, followed by the changes to your plan and contact list.¹

What you have in hand after the exercise

You finish with a tested plan, a record of what the test showed and a short list of things to fix, each with a name and a date.

An after-action report: what worked, where the gaps are and who does what
Your incident response plan updated or completed, with a contact list that includes the insurer’s claims line, the Canadian Centre for Cyber Security, local police and the regulator that applies to you
An action list with owners and target dates
A proposed date for the next exercise

How often to run a tabletop exercise

Once a year is the baseline, since the Cyber Centre asks for an annual test and revision of the incident response plan.² NIST adds the moments when an extra exercise pays off: after organizational changes, after updates to the plan and after new guidance is issued.¹

For a small organization that usually means one leadership exercise a year, plus a short session when a key person leaves, the IT provider changes or the insurer adds conditions to the policy. We propose the next date in the report so the rhythm survives staff turnover.

The limits of the exercise

A tabletop exercise is run on paper: we attack nothing, scan nothing and change nothing on your systems. The plan remains yours, and your leadership approves the final version. Observations about individuals stay in the room and out of the report, which records decisions and gaps.

If a real incident starts, the exercise stops and our incident response takes over. Technical tests such as penetration testing are separate work, offered on request.

Why a contracted team: the risks of running the exercise alone, with a chatbot or a freelancer

Run internally, an exercise tends to confirm what everyone already believes. The person who wrote the plan facilitates it, colleagues avoid awkward questions, and the gaps that matter, such as the backup nobody has restored or the insurer nobody has called, stay unspoken.

A chatbot can draft a scenario in seconds. It knows nothing of your suppliers, your insurer’s notification clause or who in the room actually holds the administrator password, and it leaves no one accountable for updating the plan afterwards.

A freelancer can lead a lively session and move on. The after-action report, the plan changes and the next exercise date need someone answerable under a signed agreement.

A contracted team works from a scope letter, brings a neutral facilitator and a note-taker, and hands you a report and an updated plan you keep.

Five plain reasons to trust us with this

A registered Canadian company
INNOVA CONSULT LTD., federal corporation 1522612-1, based in Ottawa. itopsi is its brand.
In practice since 2013
The group behind itopsi has run legal and marketing practices since 2013. Its founder has worked in law and compliance for more than 14 years.
We run servers of our own
Our own servers and more than 80 websites are checked for known vulnerabilities every day.
Insured
Commercial general liability insurance of CAD 1 million is in force.
Your scope, your report
A fixed scope in a signed letter before any work starts. Licences and equipment at cost, with no vendor commission. The report belongs to you.

How the work goes

Five steps, in the same order every time.

Before any test, you sign a scope letter: what we test, on which dates, who to call, and what we must leave alone.

Your signature comes first

Step 1

We agree what to check

A short call, or the form at the foot of this page. Together we decide which website, server or office systems we look at.

Step 2

You sign the scope letter

It sets the targets, the dates, the contacts, and what we must leave alone. Work starts only once it is signed.

Step 3

We check, and write it down

One report in plain words for you, with the technical detail attached for whoever looks after your systems.

Step 4

We fix it

We make the repairs ourselves, or together with your current IT provider or web developer.

Step 5

We check again

A second check confirms that each problem is closed.

What it costs

Each job is a different size, so each one gets a fixed quote once the scope is agreed. You see the price in writing before any work starts.

Ask for a quote →

A fixed quote once the scope is agreed
The price in writing before work starts
A second check after the fixes

Questions

Questions owners ask us

Your question is missing? Leave your number and ask it in your own words.

Ask on a call

What is a cybersecurity tabletop exercise?

It is a facilitated discussion in which the people named in your incident response plan walk through a realistic incident, such as ransomware or payment fraud, and decide who does what. NIST describes tabletop exercises as discussion-based only, with no equipment deployed, so your network stays untouched. The result is an after-action report and a list of changes that make the plan workable on a real bad day.

Who should attend a tabletop exercise?

Everyone with a role in the plan: the person who makes final decisions, finance, the IT provider or IT lead, the privacy officer and whoever speaks to staff and clients. For Ontario bodies under O. Reg. 51/26, the primary point of contact and the alternate belong at the table. NIST suggests separate sessions for senior and operational teams at first, then a combined one to test coordination.

How long does a tabletop exercise take?

NIST gives a typical range of two to eight hours, with senior-level sessions usually running two to four. For a small organization our sessions are usually half a day or less, plus a preparation interview beforehand and the after-action report within the timeline set in the scope letter. Longer formats, or two sessions for senior and operational teams, are agreed in advance.

Do we get a written incident response plan?

Yes. If you have a plan, we update it from what the exercise showed; if you have none, we write it for your organization and test it in the same engagement. Either way you receive the plan, a contact list with the insurer, the Canadian Centre for Cyber Security, local police and your regulator, and an action list with owners and dates. Your leadership approves the final version.

How often should we run a tabletop exercise?

At least once a year. The Canadian Centre for Cyber Security asks organizations to test, revisit and revise their incident response plan annually. NIST also recommends an exercise after organizational changes or plan updates. A new IT provider, the departure of a key person or new conditions in your cyber insurance policy are good moments for a shorter extra session.

Does O. Reg. 51/26 require a tabletop exercise?

The regulation itself sets a cyber security program, two senior contacts, a maturity assessment with its summary and a 72-hour report for critical incidents, and it leaves the choice of exercises to each organization. It names the activation of incident response plans among the signs of a critical incident, so a rehearsed plan and a rehearsed report make the 72-hour deadline far easier to meet.

How much does a tabletop exercise cost?

The price depends on the number of scenarios and sessions, how many people take part, whether we update an existing plan or write a new one, the language and whether the session is in person or online. After a 30-minute conversation we put a fixed price for the agreed scope in a scope letter, with the date of the exercise and the report.

Tell us what worries you.

Leave your name and a number. A person here calls you back the same business day, usually within an hour, and asks what you want checked. Would you rather start on your own? The free audit takes about three minutes.

Book the free audit instead

Same day callback
Written permission first
Fixed quote