Can our MSP run our tabletop exercise?

Yes. Nothing prevents it, they will probably run a good session, and they know things about your environment that an outsider has to be told. The one thing they cannot do is independently confirm that your incident response was tested, because your incident response includes them. That matters only if somebody outside your organisation is going to read the record, and if nobody is, this is a straightforward yes.

Where does the limitation actually come from?

Not from a rule. We went looking for one specifically and it does not exist. None of the regulations, carrier applications or vendor security questionnaires we reviewed requires incident response testing to be conducted or witnessed by an independent party. Every instrument asks whether the plan was tested. None asks who ran it.

The limitation comes from what the document can say afterwards.

Compare how the same regulator handles a different control. New York’s financial services rule requires penetration testing by a qualified internal or external party (NYDFS, 23 NYCRR 500.5(a)(1), 2023), permitting internal staff as long as they are qualified. The payment card industry’s own testing guidance goes a step further and says qualified internal resources or a third party may do it as long as they are organizationally independent.

Both of those name the concept. Neither applies it to incident response testing, where the regulations name no party at all.

So the profession clearly understands organisational independence and has decided, so far, not to require it here. Which leaves it as a question about evidential weight, and evidential weight is decided by whoever reads your file.

What can and cannot be said

	Your MSP runs it	An outside facilitator runs it
A real exercise happened	Yes	Yes
Findings are genuine	Yes	Yes
The scenario fits your environment	Often better	Good, after reading your plan
Satisfies an auditor	Yes, with documentation	Yes
Satisfies a customer questionnaire	Usually	Usually
Can state the facilitator was independent of the response	No	Yes

Five rows the same, one different. That is the honest shape of it, and anybody telling you the first column is worthless is overselling.

What the room tends to say

There is a reason this question matters more than it looks, and it comes out of the exercises behind this template rather than out of a standard.

The post-incident phase is where rooms come apart. It gets disorganised, nobody owns the findings, and they get passed around. Executives stay high-level and lean on whichever technical person is present.

And in both technical and executive rooms, the sentence that keeps arriving is a version of the same thing: we rely on our third party to tell us what is wrong, and we will take their direction.

That answer is the finding. If the plan resolves to waiting for an outside provider to say what happened, then the thing being tested is partly the provider. Having that provider facilitate the session means the room’s central assumption is never examined, because the person who would have to challenge it is running the discussion.

That is not about anybody’s integrity. It is that you cannot stress-test a dependency with the party you depend on holding the pen.

The arrangement that works

Involve them, and separate the roles.

Your MSP is frequently the best-placed organisation to help build the scenario, because they know which systems are fragile and what an outage would actually look like. Ask them for that. Have them in the room as a participant, answering as they would on the day, which is more useful than having them observe.

Then have somebody else facilitate and write the record. That way the assumption about relying on them gets tested rather than assumed, and the document at the end can say something about independence that their document cannot.

If no external reader is ever going to see it, ignore all of this and let them run it.