Does SOC 2 or ISO 27001 require a tabletop exercise?

Neither standard requires a tabletop exercise by name, and neither requires an outside facilitator. What both require is that your incident response works the way you say it does, and that you can show it. A documented exercise is the ordinary way to produce that evidence, which is why almost everyone inside an audit ends up running one. The distinction matters because it tells you what you are actually buying: an artifact trail, not a compliance ritual.

What does SOC 2 ask for?

SOC 2 reports against the AICPA’s Trust Services Criteria. The common criteria dealing with incidents run from CC7.3 to CC7.5: deciding whether a security event is actually an incident, responding to it through a defined incident response programme, and recovering (AICPA, 2017 Trust Services Criteria with Revised Points of Focus (2022), TSP Section 100, 2022). The middle one is where an exercise usually maps.

The criteria name no format, no cadence and no facilitator. They describe what has to be true, and your auditor decides whether your evidence shows it.

Two things get published wrong about this often enough to flag.

The version. The governing document is the 2017 criteria with revised points of focus published in 2022. There is no 2026 edition, and anything citing one is not worth reading.

The facilitator. No SOC 2 requirement makes an outside facilitator mandatory. An internally-run exercise with complete documentation satisfies the criterion. We sell independence and we would still rather you heard that from us than discovered it later.

What does ISO 27001 ask for, and what happened to A.16.1.5?

The 2022 edition handles incidents through Annex A controls 5.24 to 5.28: planning and preparation, assessment and decision on events, response to incidents, learning from incidents, and collection of evidence (ISO/IEC 27001:2022, Annex A, 2022). People control 6.8 covers event reporting.

Now the correction, because a great deal of published material gets this backwards.

You will read that control A.16.1.5 was withdrawn. That is wrong, and it confuses two different things.

The 2013 edition of the standard was withdrawn and replaced by the 2022 edition. That part is true and ISO says so. The control was not withdrawn. Response to information security incidents still exists, under exactly that title, renumbered to Annex A 5.26.

So if an assessor asks which control your exercise evidences, the answer in a current certification is 5.26, and a consultant telling you the requirement disappeared is reading a three-year-old summary of an edition change.

Worth being precise about our own basis here. The formal mapping between the 2013 and 2022 control sets lives in an annex of ISO/IEC 27002:2022, which is paywalled and which we have not read. The argument above rests on the control titles, which are identical, and on ISO’s own record of the edition being replaced rather than the control being deleted.

How do the two compare for what you need to produce?

	SOC 2	ISO 27001:2022
Where incidents live	Common criteria CC7.3 to CC7.5	Annex A 5.24 to 5.28
Names tabletop exercises	No	No
Names a cadence	No	No
Requires an external facilitator	No	No
What the assessor wants	Evidence the programme operates as described	Evidence the control is implemented and effective
Typical evidence	Report, scenario, attendance, date, findings, closure	The same, plus how it feeds the management review
Where exercises usually map	The response criterion	5.26, sometimes 5.27 for the learning half

The columns are more alike than the market suggests. If you are doing both, one exercise and one report serves both files.

What does the evidence package actually look like?

Five items, and the fifth is the one that fails.

The after-action report. The scenario document, so the assessor can see what was tested. An attendance record by role. The date. And the findings, with something showing each one was tracked to closure.

Organisations produce the first four routinely and stop. An exercise with four findings and no evidence that anyone did anything about them shows that you ran a session, not that your incident response programme operates. Public exercise doctrine sets the same bar: government after-action templates carry columns for the corrective action, the responsible organisation, a named contact, a start date and a completion date.

If your report has findings without owners, the cheapest fix available to you is adding the owners.

Why does the request usually arrive as a list of names?

Because compliance functions think in participation, and that is a useful signal.

When a compliance team drives the request, it tends to arrive specifying who must be in the room instead of what must be tested. Somebody has read a control, worked out which roles it implicates, and written the list.

That is not a misunderstanding on their part. The requirement they are satisfying genuinely is about participation, and an after-action report records participation by role, which is exactly what they will hand to the assessor. It does mean the scenario is often an afterthought, and it is fair to push back gently: a room full of the right people working a scenario nobody chose carefully will produce a thin report.

Ask what control the exercise is evidencing. The answer shapes the scenario, and it makes the report land better with whoever eventually reads it.

When in the audit cycle should you run it?

Earlier than most people do, and the reason is the difference between the two SOC 2 report types.

A Type I report describes controls at a point in time. A Type II report covers a period, usually between three and twelve months, and asks whether the controls operated throughout it. If your exercise happens in the last fortnight of a Type II window, you have evidence that the control existed. You have much thinner evidence that it operated, and none at all that the findings were tracked to closure, because there has been no time for closure to happen.

The practical sequencing: run the exercise early in the observation window, track the findings during it, and let the closure evidence accumulate while the window is still open. The same report then carries two things instead of one.

For ISO 27001, the equivalent trap is the management review. An exercise whose findings never reach that review is a control that ran without feeding anything, and a competent auditor will notice the loop is open.

So should you pay for one?

If the only reader is an auditor, probably not. Run it internally, document it properly, track the findings, and you will satisfy both standards.

Pay for it when the report has a second audience: an underwriter, an enterprise customer’s security reviewer, or a claims reviewer a year from now. Those readers weigh a self-produced record differently, and that difference is the only thing the fee buys.

One thing to keep straight about framework mapping

If somebody offers you an exercise report with your findings mapped to MITRE ATT&CK or the NIST Cybersecurity Framework, that is a real and useful thing, and it is a separate piece of work from the exercise itself. It takes analyst time after the session and a read of your own plan beforehand.

Ours sits in the Extended Exercise Record, which also carries clock times against the timeline and a comparison of what your written plan says against what the room actually did. It suits a regulated firm or anyone who expects a regulator or claims reviewer to read the file. For a SOC 2 or ISO 27001 evidence request, the standard report answers the question on its own.