Tabletop exercises: How to put your incident response plan to the test

A consultant contacts support. She’s on-site with a client and can’t log in to the platform her own company built and sold to them – the platform the client relies on for its compliance work. Shortly afterwards, two more tickets come in. It all looks like business as usual until it emerges that a large number of customers are affected, and some have lost data.

That was the scenario we used when we recently ran a tabletop exercise for our own incident response organisation. Most of what happened was covered in the response plan. The real test was whether people would turn to it once things started moving fast – and they didn’t always.

In the webinar “When the response plan is put to the test” (in Danish), product expert Lone Forland and Jakob Holm Hansen, CPO at NorthGRC, share what we learned. Both are members of our incident response team. Lone wrote the scenario and led the exercise, while Jakob, a former information security consultant, has helped many organisations run response exercises.

You can watch the webinar recording here (in Danish).

The timing was no coincidence. On 24 September 2026, the Danish Security and Intelligence Service (PET) raised its assessment of the threat to Danish businesses, and the same day, the Danish Energy Agency called on energy companies to update their response plans and run exercises. The higher the risk, the more it matters that everyone knows who does what – and who tells whom.

Start at the table

Jakob recommends the tabletop exercise as the place to begin, ideally soon after the plan has been written. It serves two purposes: uncovering gaps in the plan and training people to use it.

“Nobody can use a response plan that’s simply been handed to them. You have to have practised,”
says Jakob Holm Hansen.

The response team sits round a table, a facilitator presents a scenario step by step, and participants talk through what they would do. Once the format is second nature, you can move on to more demanding exercises:

Write the scenario like a good thriller

The scenario needs to be serious enough that you would genuinely call in your response team, and realistic enough that nobody waves it away. There’s no need for a bomb in the middle of the office. A scenario that starts with three support tickets will put your escalation procedure to the test, too.

Lone likens it to writing a crime novel: the reader shouldn’t know whodunnit on page one. So build in a few red herrings to keep the team from solving the crisis within fifteen minutes.

Choose the scenario based on your risk assessment – the service your business depends on, or a department you know to be vulnerable. For us, our GRC platform was the obvious starting point. A utility company might rehearse an attack on its OT systems, and a public body a personal data breach.

Write the scenario with the person who knows most about how the problem would be solved. We wrote ours with our CTO – and in the story, we put him on a flight to Tokyo with no wi-fi while everything fell apart. In reality, he was sitting in the room taking notes.

A realistic scenario also guards against the biggest pitfall.

“The worst thing that can happen in an exercise like this is that people start debating and questioning the scenario,” says Lone Forland.

At that point, the response itself never gets rehearsed.

Get the right people round the table

Alongside the facilitator, the crisis management team needs to take part, as it has the mandate to make quick and sometimes costly decisions. Communications belongs there too, since almost every incident calls for messages to customers, the press or the authorities. The same goes for the business side – the head of customer service, for instance, who is often first to spot the problem.

Ask observers to take notes and give them a template: When was the response activated? When did the management team assemble? Was the plan used? Also check that the scenario gives everyone in the room a role to play.

Planning your first tabletop exercise? Our consultants can build a realistic scenario based on your own risks, facilitate the exercise, and lead the debrief, so you come away with a clear list of improvements to your response plan. Get in contact with a consultant here.

Keep it close to real life

Open by making it clear that this is an exercise and the plan is what’s being tested, so everyone can relax and focus on the task. Explain the format as well, participants should speak up whenever they can help. During our exercise, some people expected to be called on when it was their turn, whereas the idea is for everyone to react to events as they unfold.

Push for concrete answers. “At this point, I’d ask Communications for a plan” doesn’t cut it. Ask which customers need to be told, when, and what you can say to them. The gaps reveal themselves in the detail. In our exercise, for example, it turned out that gathering contact details for every customer in a particular segment would take a long time.

Feed participants one piece of information at a time. We created mock-ups of support messages and chats that showed how the situation was steadily worsening: sales staff couldn’t hold customer meetings, and support was overwhelmed. Give people plenty of time, and resist the urge to hint at the solution.

The debrief is the whole point

An exercise always produces something useful – either gaps to close or confirmation that the plan holds up. Work through the findings:

• Was the response activated – and when?
• Was the incident logged in your incident management system?
• Were the authorities notified correctly and within the deadline?
• Could people find the plan and log in to the system where it’s kept?

The deadlines are worth rehearsing specifically, because the clock starts the moment you become aware of the incident:

Evaluate the exercise itself, too. Lone’s note to self was that next time she would give participants more time to find workable solutions and spend longer explaining the format at the outset.

Our most important finding was about the plan.

“Our participants didn’t always look at the response plan when we’d expected them to – even though we knew the answers were in there,” says Lone.

The team still came through well, but the plan needs to be easier to find and use.

Hero-based response won’t hold up

The fact that the team managed without the plan may sound like good news. Jakob calls it hero-based response:

“Hero-based response means relying on having the right people in the room who can make the right decisions without making mistakes. That’s something you simply can’t count on.”

He has seen how fragile that approach is. At one client, the head of digital handled a tabletop exercise with ease. Three weeks later, a major real-life incident struck, and the same manager froze completely and had to be sent home. Because the organisation had practised, the others knew who should take over, and the incident was dealt with.

Five tips for your first exercise

1. Call it an exercise and make clear that the plan is what’s being tested.
2. Explain the format before you start.
3. Write the scenario with the person who knows the subject best.
4. Give your observers a template.
5. Evaluate the exercise itself as well.

From findings to improvements

Findings only add value once they become actions with an owner and a deadline. In our platform, you log incidents in the incident module, which takes you from first response through to closure. For personal data breaches, the platform automatically creates tasks to notify the authority and the individuals affected, and follow-up points can be added as tasks on the incident.

Writing a convincing scenario and facilitating the exercise takes time and experience. Our consultants can support you at every stage: designing a scenario based on your risk assessment, running the exercise with your response team and leading the debrief, so the findings turn into concrete actions.

Ready to put your own response plan to the test? Talk to our consultants about a tabletop exercise.