For the exercise file
The three-hour agenda, and the report that comes after it
A cybersecurity tabletop exercise you can run with your own leadership team, plus the after-action report skeleton, annotated with what an underwriter looks for in each section. The exercise is 3 hours with laptops closed, built around four timed decisions. The report it produces has eight sections, and one of them is a page you cannot sign for yourself.
Read this first
This will not produce a third-party attestation. Everything here is yours to run and yours to keep. What it cannot give you is an independent witness. When you run the exercise yourself, the report is an account you have written about your own company. That is useful for finding gaps and it is the right way to build the habit.
It is not what a carrier means when the application asks whether your incident response plan has been tested. Beazley's Canadian form makes the split visible: one tick box for Have a plan and a separate one for Tested in last year (Beazley Cyber Application, Canada). You can fill the first from your own records. The second is a claim about an event, and nobody independent is attesting that it happened. If you need that, the last section says how. If you do not, use this and ignore it.
The one rule that makes it work
No solving. The facilitator's job is to keep asking who decides and by when. The moment the room starts fixing the technical problem, the exercise is over and you are in a normal IT meeting. Write the fix down as a finding and push the decision.
It sounds simple and it is the hardest part of facilitating. A room of capable people will always prefer the problem they know how to solve, and the technical problem is the one they know how to solve. The exercise is only worth its three hours if the room stays on the decisions it has never had to make.
NIST puts the format plainly. A tabletop exercise is one where personnel meet in a classroom setting or in breakout groups to discuss their roles during an emergency and their responses to a particular emergency situation (NIST Special Publication 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities). Nothing is attacked and no system is touched. It is a conversation with a scenario and a clock.
What you need
- 6 to 12 people. Below 5, the disagreements that make the exercise worth running do not surface.
- The people who actually decide. Whoever runs the company, whoever signs payments, whoever owns operations, whoever owns IT, whoever talks to clients, and legal counsel if you have one. If nobody in the room can authorise a payment or phone a client, you are rehearsing the wrong meeting.
- A facilitator who is not participating, and a scribe whose only job is to write down what was decided and at what time.
- 3 hours, laptops closed, phones face down.
- Your incident response plan, on paper. If it only exists in a system the scenario has just taken offline, you have your first finding for free.
Neither the facilitator nor the scribe should be the person who wrote the incident response plan, because that person will defend it.
What we see in the room
From the exercises behind this template. None of it is a technical failure.
| What happens | What to do about it |
|---|---|
| "We rely on our provider to tell us what is wrong and we will take their direction." | Technical and executive rooms both say it, and it ends more exercises than anything else. If the plan is to take direction from a vendor, the exercise has to test the hour when the vendor is the one who is unreachable. |
| The room solves the technical problem and never reaches a decision. | That is what the one rule is for. The facilitator has to enforce it out loud, more than once, and it gets harder as the room gets more senior. |
| A first-time room decides fast. An experienced room decides slowly. | Rooms with something to prove act on the first alert. Rooms that have done this before wait for validated alerts from more than one source and a second pair of eyes. Neither is wrong. The report should say which one you are. |
| Nobody writes down times. | How long the room took to make each call is the single most useful number in the report, and it cannot be reconstructed afterwards. Give the scribe that one job and nothing else. |
The three-hour agenda
| Elapsed | Block | What happens | Decision point |
|---|---|---|---|
| 0:00 to 0:15 | Framing and ground rules | What this is and what it is not. Nobody is being tested. Read out the one rule. | None yet |
| 0:15 to 0:25 | Scenario brief | Read the scenario aloud. Nobody has seen it before, including the people who own the systems in it. Questions only, no solutions. | None yet |
| 0:25 to 0:55 | Inject one: what do we actually know? | The first hour of a real incident is contested facts. Make the room separate what is known from what is assumed, and name who owns finding out. | Who is running this, and what is the first thing they need. |
| 0:55 to 1:30 | Inject two: the decision that costs money | Take systems down and stop trading, or stay up and carry the risk. If nobody can authorise it, that is the finding of the day. | Whoever can actually authorise it says so out loud. The scribe writes the time. |
| 1:30 to 1:40 | Break | Take it. The second half is where the useful failures happen. | None |
| 1:40 to 2:10 | Inject three: somebody outside is asking | A client, a regulator, a journalist, or an employee posting about it. | Who speaks, who approves the words, and what you are willing to say before you know the full picture. |
| 2:10 to 2:35 | Inject four: are we finished? | Systems are back. Data may still have left the building. | What "over" means, who signs off on it, and what you owe anyone whose data was in it. |
| 2:35 to 3:00 | Hot wash | Round the room, one thing each. People rarely say what they are thinking, which is usually "I should have read the updated plan" and "I do not know what my role is now." Ask for those two directly. | None. This is where the findings come from. |
Times are elapsed, not clock times. The injects are written for ransomware. Swap the content and the shape holds for email compromise or a vendor breach. Each inject produces a decision, a decider and an elapsed time, which are the three columns that cannot be written after the fact.
The after-action report, section by section
| Section | What goes in it | What a carrier looks for |
|---|---|---|
| 1. Cover and summary | The date, the duration, the scenario in one sentence, the organisation, and who facilitated. | The date and the duration first. A three-hour exercise and a forty-minute walkthrough are not the same event. |
| 2. Scope and scenario | What the scenario was, why you chose it, and what you deliberately left out. | Whether the scenario matches your real exposure. Ransomware at a firm whose real risk is a fraudulent payment reads as bought off a shelf. |
| 3. Participants and roles | Everyone who attended, by role rather than by name, plus anyone invited who did not come. | Whether the people who can authorise money, call clients and stop operations were there. IT-only attendance says an incident is still treated as an IT problem. |
| 4. Timeline of decisions | Each decision point, what was decided, who decided it, and how long it took from the inject. | Elapsed time. This is the section that separates an exercise that happened from one that was written up. |
| 5. What worked | The things the plan got right, said plainly and without hedging. | A sign you are not performing self-criticism. A report with no positives reads as a document written to be shown to somebody. |
| 6. Findings and gaps | Each gap, what caused it, and what it would have cost. "Nobody could authorise a payment over fifty thousand without the CFO, who was on a plane" is a finding. "Communication could be improved" is not. | Specificity, and whether the gaps are the kind a leadership exercise surfaces. All-technical findings suggest the session never left the IT layer. |
| 7. Recommendations, prioritised | Each one with a named owner and a date, ordered by how much risk it removes and how soon. | Owners and dates. A recommendation with neither is a wish. Next year’s first question is which of these closed. |
| 8. Attestation | A signed statement that the exercise took place, on that date, for that duration, with those participants, facilitated by the person signing it. | The signature, and whose it is. This page turns the document from a self-assessment into evidence. It is the only page you cannot sign for yourself. |
The right-hand column is what an underwriter or an auditor is actually looking for, which is not always the part you found interesting. This is the structure of the report we deliver, in the same order.
What to decide afterwards
Run it in house first. It costs you three hours and it will find things.
Invite the people listed above and use the agenda as written. Write the report the same day. Put an owner and a date on every recommendation before anyone leaves, because after the exercise is where most of them fall apart: disorganised, nobody accountable, findings passed around like a hot potato. Whoever runs the company should own this, not IT, for the same reason the facilitator should not be the plan's author.
Then read the incident response question on your renewal application one more time.
If it asks whether you have tested your plan, the report you just wrote answers it. If it asks for evidence that you did, or your largest client's security questionnaire does, the attestation page is the part you cannot produce, and the only part with a lead time.
Why the Canadian baseline is not enough on its own
The Canadian Centre for Cyber Security's baseline controls ask every organisation with fewer than 500 employees to keep a written incident response plan: Organizations should assume that cyber security incidents will occur and have a plan on how to respond and recover from them. (Canadian Centre for Cyber Security, Baseline Cyber Security Controls for Small and Medium Organizations V1.2). They do not ask you to test it. Your carrier does. Those are two different questions and only one of them needs somebody else in the room.
Session length, room size and turnaround are our own delivery standard. This is a template, not insurance or legal advice. Your carrier's application and your own regulatory obligations are the only authority on what you are required to do.