Do you need a tabletop exercise for cyber insurance?

Need is the wrong word, and separating its three meanings answers the question. Nothing legally requires a tabletop exercise. No carrier application found in research names the format, or the word tabletop, anywhere in its incident response question. What applications do ask is whether the plan has been tested, and at least one Canadian form asks whether it was tested in the last twelve months. An exercise is the ordinary way to make that answer true and provable. So: not required, frequently asked about, and measurably useful on its own terms.

Is it required by law?

No, and anybody telling a Canadian mid-market firm otherwise is overselling.

There is no Canadian statute obliging a fifty to three hundred person law firm, clinic, manufacturer or software company to exercise its incident response plan. Federal financial institutions answer to OSFI’s technology and cyber risk guidance. Financial services firms licensed in New York fall under a rule that does mandate testing. A Canadian mid-market business sits outside both.

The Canadian Centre for Cyber Security recommends it, which is different from requiring it. Its emergency preparedness guidance tells organisations to Run a tabletop exercise with the key employees identified in the plan (Canadian Centre for Cyber Security, Improving cyber security resilience through emergency preparedness planning, ITSM.10.014, 2026). That is advice from the national cyber agency, not an obligation, and the Cyber Centre publishes no kit of its own to do it with.

Is it asked about on the form?

The testing is. The format is not, and the distinction matters when you are deciding what to buy.

No carrier application found in research uses the words “tabletop exercise” or “simulation” inside its incident response question. Carriers ask whether the plan is tested. The closest any of them comes to naming a cadence is Beazley’s Canadian form, which asks whether the plan has been Tested in last year (Beazley Cyber Application, Canada, 2026).

So the honest position is that you need a tested plan and a record of the testing. A tabletop exercise is how most organisations produce both, because it is the cheapest format that genuinely stresses decisions. It is not the only one, and nobody is checking that you chose it.

Does it actually reduce risk, or is it a paperwork exercise?

This is the part where most pages on this subject wave their hands, so here is the one solid number.

Marsh McLennan’s Cyber Risk Intelligence Center analysed cybersecurity controls against claims data and found that organizations that regularly engage in tabletop exercises and scenario-based breach response drills are 13% less likely to experience a material cyber event than those that do not (Marsh McLennan, Incident response planning emerges as key cybersecurity control, 2025).

Two things about that figure are worth holding onto.

It is a correlation drawn from insurance claims data, not a controlled trial. Organisations that run drills regularly are probably doing other things well too, and Marsh would say the same.

And 13 percent is a real effect but not a dramatic one. Incident response planning sits in Marsh’s top five most effective controls, behind network hardening, endpoint detection and response, logging and monitoring, and awareness training (Marsh McLennan, Incident response planning emerges as key cybersecurity control, 2025). If your endpoint coverage is patchy, fix that first. This is not the highest-leverage thing you can do with a security budget, and pretending otherwise would be dishonest.

What it is, uniquely among that list, is the control that produces a document somebody outside your organisation can vouch for.

What are you actually buying?

Three different things, and people conflate them.

A tested plan. The plan gets stressed by people who would have to use it, and the gaps surface while the stakes are hypothetical.

A record. A dated document naming the scenario, who took part and what was found. This is what answers the application question.

A witness. Somebody independent of your response confirming the exercise happened.

The first two you can produce yourself, and a self-run exercise with good notes gets you both. The third you cannot, by definition.

Worth being precise here, because it is widely overstated: none of the regulations, carrier applications or vendor questionnaires we reviewed requires that incident response testing be run or witnessed by an independent party. None of them says who has to do it. What independence changes is not compliance, it is evidential weight, and whether that matters depends entirely on who you expect to read the file.

When is the answer genuinely no?

Some cases, and it is worth naming them.

If your renewal is three weeks away and the form is already with the broker, running an exercise now will not change this year’s answer. Answer honestly, schedule one for the quiet part of the cycle.

If you have never written an incident response plan, write one first. An exercise against no plan is still useful, but it is a different exercise with a different purpose, and describing it as testing your plan would be a stretch.

If money is tight and your endpoint detection coverage is incomplete, Marsh’s own ranking says spend it there.

And if nobody is asking, and you simply want to get better at responding, run one yourself. The Canadian Centre for Cyber Security recommends exactly that, public exercise packages exist to do it with, and the finding you get from a self-run session is just as true as one from a facilitated session. What it will not do is answer a question somebody else is asking about you.

What does a carrier actually do with the answer?

Two things, at two different moments, and the second one is the reason to care.

At quoting, the answer is one input among a dozen control questions. It contributes to a picture. On its own it rarely moves a number much, and anybody promising you a specific premium effect from a single line is inventing.

At claim, the file gets read again, closely, by somebody whose job is to check that what was represented matches what existed. That is the moment an unprovable yes becomes a problem, because the forms themselves say misrepresenting a material fact can be grounds for rescinding the policy, and rescission means the policy is treated as though it never existed.

So the value of the exercise is not really about price. It is that one line on the form stops being a question you would rather not be asked about later.

Worth keeping the scale honest, though. This is a narrow, specific benefit. It is not insurance against an incident, it does not make a claim more likely to be paid on its merits, and it is not the biggest thing you could do for your security position this year.

What does a room learn from it?

Something that does not show up in the report, usually.

The most revealing part of an exercise is not what people say during the scenario. It is what surfaces in the hot wash afterwards, and it tends to be a version of two thoughts: that they should have read the updated documentation, and that they do not actually know what their role is for incidents now and need to go and sort that out with their own team before a real one.

Neither of those is a technology problem. Both are the sort of thing a room only says out loud after it has just watched itself struggle for three hours, which is the argument for running the exercise rather than circulating the plan again.