Terms of service

Who these terms are with

MyTabletops, operating from Ontario, Canada. In this document "we" and "us" mean MyTabletops, and "you" means the organisation engaging us. Using this site means you accept these terms. Engaging us for an exercise means you accept them as the basis of that work, alongside the engagement letter, which takes precedence wherever the two differ.

What we agree to do

• Review the incident response, business continuity and communications documentation you choose to give us.
• Build a scenario for your organisation and your sector.
• Facilitate a 3-hour live session with the participants we agree on.
• Deliver a written after-action report within 15 days of the session.
• Issue a signed attestation recording the date, the duration and the participants.
• Revise the report under the Carrier Acceptance Guarantee, on the terms set out on our pricing page, which form part of these terms.

What the attestation attests to

This is the clause worth reading twice, because people occasionally hope it says more than it does.

The attestation confirms that a facilitated exercise took place, on a stated date, for a stated duration, with stated participants, run by an independent facilitator who did not build or operate the controls being tested.

It attests that the test happened. It does not certify that your organisation is secure.

Nobody can certify that, and a document claiming to would be worth less than one that does not. The value of the attestation is that a third party is putting their name to a fact, and facts are only worth attesting to when the person signing has not overreached.

What we do not do

• We do not give legal advice. Nothing on this site or in a report is legal advice. Breach notification decisions in particular need your own counsel.
• We are not insurance brokers or advisers. We do not place, recommend or advise on insurance, and we are not licensed to. We write a document your insurer reads.
• We do not perform technical testing. No penetration testing, red teaming, vulnerability scanning or disaster recovery failover. A tabletop tests decisions, not systems.
• We do not write or rewrite your plans. We test the plan you have and report where it breaks.
• We do not remediate. Findings come with owners and dates. The owners are yours.

What we need from you

Accurate documentation, participants who actually hold the decision-making authority the scenario requires, and someone empowered to answer scoping questions. An exercise run with stand-ins for the people who would really decide produces a report that describes a room you do not have.

You are responsible for having the right to share the documentation you give us.

Fees, scheduling and cancellation

Fees are fixed and agreed in the engagement letter before work starts. Prices shown on this site are in Canadian dollars and applicable taxes are added at invoice. Invoices are due within thirty days.

Sessions can be rescheduled at no cost with at least fourteen days' notice. Inside fourteen days we will always try to accommodate a move, because incidents and board meetings do not schedule themselves, but the preparation is already done by then and we may charge for it.

Confidentiality

It runs both ways. We keep your documentation, your session and your report confidential on the terms set out in our privacy policy. We ask that you keep our scenario material, methodology and templates confidential in return, and that you do not distribute them outside your organisation.

Who owns what

Your report and your attestation are yours. Use them with carriers, brokers, auditors, customers and your board without asking us.

Our scenario library, methodology, report structure and templates remain ours. Receiving a report does not license you to run our exercise commercially for anyone else.

Site content is ours. Documents we publish as free downloads may be used and shared inside your organisation, and by partners with the branding intact.

Liability

Written plainly rather than buried, because burying it would be the wrong move for a company selling honest reporting.

We are liable for our own work: for running the exercise competently and reporting accurately what happened. Our total liability for any claim arising from an engagement is limited to the fees you paid us for that engagement.

We are not liable for the consequences of a security incident, for an insurer's decision to issue, renew, decline or price a policy, or for an auditor's or customer's conclusions. Those are decisions other people make using many inputs, and we are one of them.

Nothing here limits liability that cannot be limited by law.

Governing law

These terms are governed by the laws of the Province of Ontario and the federal laws of Canada that apply there. The courts of Ontario have exclusive jurisdiction, and both of us submit to them.

Changes

We may update these terms. The date at the top changes when we do. Terms in force when your engagement letter was signed govern that engagement, so a change here never alters work already agreed.

Reaching us

[email protected]. One business day, and a person rather than a ticket number.