The question is not whether you tested it. It is what closed.

Marsh found organisations that regularly run tabletop exercises and breach drills are 13 percent less likely to have a material cyber event (Marsh McLennan, Incident response planning emerges as key cybersecurity control, 2025). IBM found 52 percent of organisations with a response plan have never reviewed it, or have no set period for reviewing or testing it (IBM Security, Cyber Resilient Organization Report, with the Ponemon Institute, 2020).

Four questions, and the answers that survive a follow-up

Four questions for the board to ask, with a good answer and a weak one for each

Ask	A good answer sounds like	A weak answer sounds like
When did we last test it, and who was in the room?	A date, a duration, and the roles there, including whoever authorises payments.	"We run one annually." No date, and a room that was entirely IT.
What did it find, and which findings are closed?	An owner and a date on each finding, and a count of how many closed since last time.	"The report is with the security team." A report is not a corrective action.
What did we tell our insurer, and can we prove it?	The question as the application words it, the answer given, and the artifact behind it.	"The broker handled it." The signature on that application is the company's.
Who signed to say it happened?	An independent facilitator on an attestation page, with credentials a carrier knows.	Somebody who reports to the person assessed. Management attesting to itself.

Why the second question is worth asking twice

The failure we see most often is not that the exercise goes badly. It is what happens after: the report lands, it becomes a line item, and the people given the findings are never asked again.

The US Department of Homeland Security's inspector general found that without a process to implement corrective actions, problem areas identified in a national exercise recurred in the real response to Hurricane Katrina, and again in the next national exercise two years later (US Department of Homeland Security Office of Inspector General, OIG-09-53, April 2009, page 7). Federal doctrine says corrective actions should be specific, measurable, achievable, relevant, and time-bound (FEMA, Homeland Security Exercise and Evaluation Program doctrine, 2020). A finding with no owner and no date is none of those.

To close the last row

MyTabletops runs a 3-hour facilitated exercise, writes the report inside 15 days and signs the attestation. Fixed price. If your carrier does not accept the report, we revise it until they do, at no cost and with no time limit. Start on the contact page.