Glossary term
Tabletop Exercise
Subject: Risk Management, Business Continuity and Resilience
Also known as: table-top exercise, discussion-based exercise
A tabletop exercise is a discussion-based simulation in which participants talk through how they would respond to a described crisis, to test plans, roles and decisions without disrupting real operations.
Explanation
A facilitator presents a scenario, such as a ransomware attack or a site fire, and adds new facts in stages. Participants from operations, IT, legal, communications and senior management say what they would do and who they would call. Nobody moves systems or evacuates anyone. The aim is to find gaps in plans, unclear responsibilities and weak links between teams, and observers record these for follow-up. It is cheaper and quicker than a live drill or full failover test, and suits leadership groups. The trade-off: it it shows decisions and assumptions but not whether technology really works. Regulators often expect exercises of this kind, and many organisations run them once or twice a year. Teams that have argued through a scenario once tend to find the right phone number faster when a real one arrives.
Example
A university convenes its senior team for two hours. The facilitator announces that student records have appeared for sale online, then adds that journalists are calling. The group finds that nobody knows who may approve a public statement and that the regulator's notification window is shorter than assumed. Gaps are logged, owners assigned and the plan updated.
Not to be confused with
- Disaster Recovery Testing
- Recovery testing actually restores systems to prove they work. A tabletop exercise only discusses the response.