How do you test an incident response plan?

Four ways, in ascending order of cost and disruption: a walkthrough, a tabletop exercise, a functional exercise, and a full-scale exercise. A walkthrough reads the plan aloud with the people named in it. A tabletop puts a scenario in front of them and makes them decide out loud. A functional exercise has them do parts of it for real in a simulated setting. A full-scale exercise does the whole plan. Most organizations of fifty to three hundred people should run a tabletop, because it is the cheapest method that puts the decisions under pressure, and pressure is the thing being tested.

What counts as a test?

Strictly, by NIST’s definition, exercising a plan is not testing at all.

NIST draws a line that, by its own account, many people do not observe. A test is an evaluation tool that uses quantifiable metrics to validate the operability of a system or system component in an operational environment specified in an IT plan, and the guidance says plainly that the term “test” is reserved for testing systems or system components; it is not used to describe “exercising” plans (NIST Special Publication 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, 2006).

By that definition, restoring a backup and timing it is a test. Sitting your leadership team down with a ransomware scenario is an exercise. Both get called testing widely, including on every insurance application we have read.

Do not correct anyone about this. The distinction is worth knowing for one reason only: it tells you what a method can prove. A test produces a number. An exercise produces a record of what people decided. The question on your renewal application is about the plan, so what it wants is the second kind of evidence, whatever word the form uses.

What are the four methods?

Worth saying up front that the naming is not standardized, and NIST says so itself: there are many conventions for categorizing exercises, with some people using “tabletop” for discussion-based exercises in general and others reserving it for one specific format (NIST Special Publication 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, 2006). If a vendor’s four categories do not match these four, that is a vocabulary difference and not a disagreement.

Walkthrough. The plan is read through with the people named in it, section by section, checking that the contacts are current and the steps make sense. NIST’s exercise guide does not define this one. It is still the right first move for a plan nobody has read since it was written.

Tabletop exercise. NIST’s definition: discussion-based exercises where personnel meet in a classroom setting or in breakout groups to discuss their roles during an emergency and their responses to a particular emergency situation, where a facilitator presents a scenario and asks questions, and which is discussion-based only and does not involve deploying equipment or other resources (NIST Special Publication 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, 2006).

Functional exercise. People validate their operational readiness for emergencies by performing their duties in a simulated operational environment, exercising specific parts of the plan such as communications, emergency notifications or equipment setup (NIST Special Publication 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, 2006).

Full-scale exercise. NIST treats this as the largest functional exercise rather than a separate category: A comprehensive exercise of an entire IT plan is sometimes known as a full-scale exercise (NIST Special Publication 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, 2006).

For Canadian readers, the Cyber Centre skips the taxonomy for the incident response plan and gives one instruction: Run a tabletop exercise with the key employees identified in the plan (Canadian Centre for Cyber Security, Improving cyber security resilience through emergency preparedness planning, ITSM.10.014, 2026).

How long does each take and who has to be in the room?

Method	Typical duration	Who has to be there	Disruption
Walkthrough	Not set by NIST	Whoever owns the plan, plus the role holders named in it	None
Tabletop	two to eight hours, and two to four hours at senior level	The people who would actually decide: executive, legal, communications, technical lead	A morning to a day
Functional	several hours to several days	The same people, plus whoever operates the systems being exercised	Real, and it has to be scheduled around the business
Full-scale	Not set separately by NIST	Everyone in the plan	Significant

The durations for the two exercise types are NIST’s own (NIST Special Publication 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, 2006). The senior-level figure is the one to notice. A leadership tabletop sits at the short end of the range.

What evidence does each produce?

This is the column that decides which method you need.

Method	What it proves	What it leaves behind	Enough for a carrier, in our view?
Walkthrough	The document is current and the contacts work	Notes, if somebody took them	Weak. Better than nothing
Tabletop	The people named in the plan can make its decisions under time pressure with incomplete information	A dated report: scenario, participants by role, decisions, findings	Yes, where the report exists
Functional	A specific capability works when used, not just when described	The report, plus operational artifacts such as call logs and system evidence	Yes, and more than asked for
Full-scale	The whole plan holds together end to end	Everything above, at scale	Far more than asked for

Nothing is produced automatically. NIST describes the mechanism: immediately after the discussion the facilitator and data collector run a debrief, often called a hotwash, asking participants in which areas they felt they excelled, in which areas they could use additional training, and which areas of the plan should be updated, and those comments should be captured in the after action report (NIST Special Publication 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, 2006).

Skip the debrief and the exercise still happened. It just left nothing behind.

The same scenario, run four ways

A finance mailbox is compromised and a payment instruction has already gone out. Here is what each method would and would not surface.

Method	What it would surface	What it would miss
Walkthrough	That the plan names no owner for contacting the bank, and that the after-hours number for the finance lead is out of date	Whether anyone would actually think to call the bank in the first hour
Tabletop	That three people each believed somebody else was authorized to recall the payment, and that nobody raised the insurer’s notice clause until prompted	Whether the recall mechanism works, and how long it takes
Functional	How long the mailbox forensics actually take, and whether the communications template survives contact with a real customer list	The executive decision-making, if the exercise is scoped to the technical path
Full-scale	All of it, including the handoffs between teams that nobody rehearses	Nothing much. That is why it costs what it costs

Notice that the tabletop finds the decision failures and the functional finds the mechanical ones.

Which method satisfies a carrier, and which satisfies an auditor?

Both are best answered with the same thing, which is a dated record, and the carrier forms we have read specify no method.

Cowbell’s application asks whether the organization has an incident response plan tested and in-effect (Cowbell Cyber Risk Insurance Renewal Application, Prime 250, 2021). Beazley’s Canadian form gives two tick boxes, Have a plan and Tested in last year (Beazley Cyber Application, Canada, 2026). Neither names a format, a duration or a facilitator.

For an auditor, keep the same record with a different emphasis: the report, the scenario, the attendance, the date, the findings and evidence that the findings were closed.

On cadence, the clearest thing available to a Canadian reader is one Cyber Centre publication, which says to Test, revisit, and revise your incident response plan annually to keep it effective (Canadian Centre for Cyber Security, Developing your incident response plan, ITSAP.40.003, 2026). NIST’s own answer is looser, asking for events periodically; following organizational changes, updates to an IT plan, or the issuance of new TT&E guidance; or as otherwise needed (NIST Special Publication 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, 2006).

So the method is your choice and the record is not. Pick the cheapest method that puts real pressure on the decisions, then spend the effort on writing it down properly.

What does a test find?

What it is built to surface is the joins.

Decision authority is one. Somebody has to approve disconnecting a system, paying or refusing, or telling a customer, and a live room can reveal that two people each thought it was the other. Escalation timing is another: the plan says escalate, and nobody has agreed what starts the clock. Then the outside calls, which is where the insurer’s notice clause and outside counsel can get discovered late.

Little of that is visible in a document review. It appears when the people are in the same room and have to commit to an answer in front of each other.

What do you do with the findings?

In our experience this is where exercises most often fail, and they fail after the hard part is over.

In the exercises behind this template, the report becomes the achievement. It is delivered, it usually sits with the client, and the recommendations are rarely actioned. The exercise turns into a line item, we did a tabletop, and the teams given the findings never come back to the facilitator. It is the single most common failure we see after an exercise, and it is not a criticism of anyone in particular, because it is a documented pattern rather than a local one.

The US Department of Homeland Security’s inspector general found the same pattern at national scale. Without a process to identify and implement corrective actions, problem areas identified in a national exercise recurred in the real response to Hurricane Katrina, and again in the next national exercise two years later (US Department of Homeland Security Office of Inspector General, OIG-09-53, 2009).

Federal exercise doctrine answers it with one test. FEMA’s summary of the doctrine says SMART ensures that corrective actions are developed to be Specific, Measurable, Achievable, Relevant, and Time-bound (FEMA, Homeland Security Exercise and Evaluation Program (HSEEP) 2020 Revision information sheet, 2020). A finding with no owner and no date fails that test.

So the practical close is short. Every finding gets a name and a date before the room empties. The plan gets a revision number and the revision log records what changed. And the report goes in the file where the renewal application can reach it, because in twelve months the only thing anybody can check is what you wrote down.