How often should we run a tabletop exercise?

Once a year is the floor, and it is a floor with named authors rather than a habit. Beazley’s Canadian application measures it, New York’s financial services regulator writes it down for the entities it licenses, and the renewal cycle itself enforces it, because the question comes back every year and last year’s exercise ages out of the window it was run for. Treat one exercise a year as the default. Run a second when the plan, the people or the obligations have changed enough that the last exercise no longer describes your company.

Who actually says once a year?

The most direct authority is a tick box. Beazley’s Canadian application asks whether your incident response plan has been Tested in last year (Beazley Cyber Application, Canada, 2026), which is not advice about cadence but a question with a date attached. Answer it in March and the box covers the previous twelve months from March, not from your last renewal. An exercise that cleared last year’s application by a month can miss this year’s entirely.

The regulatory version comes from New York, whose financial services rule requires the entities it licenses to test their plans at least annually. It almost certainly does not bind you, and the exact wording, along with why it matters anyway, is on our page about what tested means. No Canadian law of general application names a cadence at all, which the parent page covers in full.

If annual is the floor, what is the default in practice?

No schedule at all, for more than half. In IBM’s survey of security and IT professionals, more than half (52%) of those with security response plans said they have never reviewed or have no set time period for reviewing or testing those plans (IBM Security, Cyber Resilient Organization Report, 2020). That figure is why the question appears on applications in the first place. A form does not ask about things everyone already does.

When does a second exercise in the same year earn its keep?

When what was tested no longer exists. If the findings from the last exercise were closed properly, the plan changed, and the record on file describes a superseded document. A rewritten plan has not been tested; its predecessor was.

When the people change. The exercise tests a specific room: the roles that attended, the person who held authority to spend, the one who owned the client call. If those seats have turned over, the record describes the previous occupants.

And when the obligations change: a new enterprise client with an incident clause in the contract, a new regulator, a first cyber policy with conditions the old one did not carry. Each of those changes what the room would have to decide, which is the thing the exercise measures.

None of this requires a standing quarterly programme. It requires a date on the calendar once a year, and a willingness to move it earlier when one of those changes arrives first.