Incident Response Planning & Tabletop Exercises
A written, tested incident response plan, built and rehearsed before you need it, not figured out for the first time during a real incident.
Who this is for: Businesses that want a tested plan in place, not to be figuring out who calls whom for the first time during an actual breach.
The Problem
Most businesses only discover their incident response plan doesn’t work by testing it during a real incident, which is the worst possible time to find the gaps.
Our Solution
We build a written incident response plan and test it through a realistic tabletop exercise, so the gaps get found on a Tuesday afternoon, not during an actual breach.
What's included
- Written incident response plans
- Ransomware and business email compromise playbooks
- Data breach procedures
- Escalation procedures and contact trees
- Communications plans (internal, client, regulatory)
- Tabletop exercises (ransomware, data breach, BEC, insider threat, cloud compromise scenarios)
A tabletop exercise typically takes two to four hours and walks your team through a realistic scenario step by step, see our write-up on what these exercises actually look like. It’s consistently the fastest way to find out a written plan’s escalation contact left the company eight months ago.
Benefits
- Gaps found in a drill, not during a real incident
- Clear escalation paths so nobody’s guessing who to call
- Documented evidence of preparedness for regulators and insurers
Our Process
Understand
Learn your business, systems, and current level of preparedness.
Draft the Plan
Build a written incident response plan.
Build Playbooks
Create scenario-specific playbooks (ransomware, BEC, breach).
Run a Tabletop
Test the plan against a realistic scenario.
Refine
Update the plan based on what the exercise reveals.
Proven results: See what a tabletop exercise actually involves and why two to four hours is usually enough. See the write-up →
Frequently asked questions
How long does a tabletop exercise take?
Usually two to four hours for a small or mid-sized business, enough to walk through a realistic scenario without consuming a full day.
Do we need a written plan before running a tabletop exercise?
It helps but isn’t required, a tabletop exercise is often exactly what reveals the gaps a written plan should address.
Especially relevant for
Related services
Incident Response
24/7 breach containment, forensic timeline, and recovery when every minute counts.
fingerprintDigital Forensics
Reconstructing exactly what happened, with evidence handling that holds up for insurers, regulators, and legal proceedings.
gpp_badRansomware Response
Containment, a fact-based pay-or-restore decision, and recovery, for a ransomware incident happening right now.
Not sure if this is the right fit?
Tell us what's worrying you. We'll tell you what actually needs fixing first.