What does a business continuity tabletop exercise look like?
A facilitated discussion, three to four hours, in which your leadership team is given a disruption and has to run the business through it out loud. No systems, no keyboards, no restoration work. That hands-on version exists too: in what NIST calls a functional exercise, people perform their actual duties in a simulated environment, and it typically lasts several hours to several days (NIST Special Publication 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, 2006). It is a different exercise. The session is built around the decisions the plan assumes somebody will make, and its job is to find out whether those people agree on who makes them.
What is the agenda?
The US government’s Ready.gov handbook for this describes a recommended three- to four-hour, scenario-driven, facilitated exercise (Ready.gov, Business Continuity Plan Test Facilitator and Evaluator Handbook, 2023). Ours runs 3 hours, inside that range. The running order below is ours, not the handbook’s.
| Segment | Roughly | What happens |
|---|---|---|
| Opening | A quarter of an hour | Ground rules, and the rule that matters: no solving |
| Scenario brief | Ten minutes | The disruption is read out. Questions only |
| Inject one | Half an hour | It lands. Who declares it, and who is told |
| Inject two | About thirty-five minutes | It does not resolve. What stops, what goes manual, and who authorizes it |
| Break | Ten minutes | |
| Inject three | Half an hour | Customers and suppliers start asking. Who speaks, and what gets promised |
| Inject four | About twenty-five minutes | Recovery sequencing, and the decision to return to normal |
| Hot wash | About twenty-five minutes | What the room thought went well, and what it wants changed |
The hot wash comes last, so it is the easiest segment to cut when the session runs long, and it is where whoever is recording collects what they missed before the room leaves.
Three scenarios, and the decision each one forces
| Scenario | The decision it forces |
|---|---|
| Ransomware has encrypted the systems that run your core operation. Backups are viable. Restoration will take days | Which operations restart first, and who is authorized to decide that against a client-facing commitment |
| A supplier or cloud service you depend on is down with no restoration estimate | At what point you switch to a manual process, and who signs off on running it without the usual controls |
| You lose a site for a week during your busiest period, with people, records and equipment inside it | What you stop doing entirely, and who tells the customers affected |
Pick the one that matches where you are most exposed, not the one that is most dramatic. OSFI’s phrasing, written for federally regulated financial institutions, is useful outside that sector: tests should use a range of severe but plausible scenarios, including concurrent scenarios and those of longer duration (OSFI, Guideline E-21, Operational Risk Management and Resilience, 2024).
Longer duration is the part to insist on. A disruption that resolves by lunchtime tests almost nothing.
Who has to be in the room?
The people who would actually decide. For a continuity scenario that usually means the chief executive or managing partner, finance, operations, one technical lead, communications, and whoever owns the customer relationships. Legal if the scenario touches data or contractual commitments.
Two roles sit outside the group. Somebody facilitates and somebody records, and they are not the same person. In the published handbook, facilitators provide situation updates and moderate discussion while evaluators gather the data that becomes the report (Ready.gov, Business Continuity Plan Test Facilitator and Evaluator Handbook, 2023).
What does the report record?
Decisions, and the conditions under which they were made. The same handbook specifies what to capture: who made the decision, what occurred, why it was made, how it was made, and what the outcome was.
Written that way, a finding survives being read by somebody who was not in the room, which is the only test that matters for a document going to an insurer, an auditor or a board.
One more thing to record: which plan each finding belongs to. A continuity scenario built on a cyber disruption produces findings against both plans, and separating them at the time is much easier than separating them later.
How is this different from a cyber tabletop exercise?
The scenario is chosen to reach the operating question rather than to stop at the technical response. A cyber exercise can end when the threat is contained. A continuity exercise only starts being useful there, because the interesting decisions are about running the business while the systems are still down.
How long should a business continuity tabletop be?
Three to four hours, which is what the handbook published on Ready.gov recommends and what a leadership group can actually hold. Ours runs three.
Should IT be in the room?
One technical lead, yes, to answer what is and is not possible. More than that and the session turns into a restoration planning meeting, which is a useful meeting and a different one.