What a carrier-ready tabletop costs

Fifteen days from the session to the delivered report. That is a commitment, not an average. If a scheduling problem on our side puts it at risk we tell you before the session, not after it.

Eight sections: a summary, the scope and scenario, participants and the role each played, a timeline of the decisions the room made, what the room did well, findings with a severity against each, prioritised recommendations each with a named owner and a date we set, and the signed attestation page. An appendix maps the report to the questions a renewal application asks, so a broker can attach it without a covering note.

Yes. The Extended Exercise Record adds three things: the observed decision timeline with a clock time against every entry, MITRE ATT&CK mapping on the scenario with NIST CSF 2.0 mapping on the findings and recommendations, and a line-by-line comparison of your written plan against what the room actually did, with your plan marked up. It is $8,000 as an add-on and it is included in the Annual Readiness Program. It earns its price when the next reader of the report is a regulator, an auditor or a claims reviewer rather than an underwriter. Ask on the scoping call and we will walk you through a full sample.

Because the second exercise costs us far less than the first. The documentation review, the participant mapping and the scenario architecture are already done, and the facilitator already knows your business. So the second tabletop and the Extended Exercise Record are priced at what they cost us to deliver rather than at what the first engagement was worth. It is not a discount on the tabletop, it is a different product with a different cost base.

On the Annual Readiness Program, re-onboarding is included. A new CFO or a new head of communications is brought up to speed on the scenario history and the open recommendations before the next exercise, at no additional cost. On a single Carrier-Ready Tabletop there is nothing to re-onboard into, because the engagement has ended.

Your documentation and everything discussed in the session stay private to your organisation. We do not use exercise material to train public AI models, we do not reuse your scenario with another client, and we do not name you as a client anywhere without written permission. You decide what documentation we see before we see it.

The session itself is three hours. Around it sit the scoping call, the documentation handover and the readout, roughly five hours spread across a few weeks and mostly not the same people twice. Building the scenario, running the room and writing the report happen on our side.

Technical testing of any kind. A tabletop tests decisions, not systems, so penetration testing, red teaming, vulnerability scanning and disaster recovery failover all sit outside it. We also do not write or rewrite your incident response plan. We test the one you have and tell you in the report where it breaks.

Both figures are Canadian dollars and both cover preparation, facilitation, the report and the attestation. Applicable taxes appear on the invoice. Sessions run remotely by default and the price is the same either way. If you want the room in person, travel is quoted at cost and you see that number before you commit to anything.