Lesson 5.50: Tabletop exercises
A tabletop exercise walks the people who would run a real crisis through a realistic scenario, one development (inject) at a time, without touching any system. It tests decisions, roles and communication, and it almost always reveals something nobody had thought about. Its value lies in what happens afterwards: action items with owners and dates. In the lab you review Northwind's ransomware tabletop: the injects, the decisions and when they were taken, the gap the exercise exposed, and the action list, which you complete so every item has an owner and a due date.
15 min
You will learn to
- Explain what a tabletop exercise tests
- Read injects and the decisions taken
- Measure decision timing
- Find gaps and unowned actions
- Complete an action plan with owners and dates
Key terms
- Tabletop exercise (TTX)
- A discussion-based walk-through of a crisis scenario with the people who'd handle it.
- Inject
- A new development introduced during the exercise to force decisions.
- Facilitator
- The person who runs the exercise, releases injects and keeps time.
- Hot wash / after-action review
- The debrief right after the exercise: what worked, what didn't, what to change.
- Action item
- A specific change with one owner and a due date.
← Shared responsibility in the cloud · All lessons · Ransomware: making the decision →