Tabletop exercise
A tabletop exercise is a facilitated discussion in which participants work through a hypothetical incident to examine their responsibilities, decisions, and response plans.
Practice the decisions
A tabletop exercise brings the people responsible for a plan into a structured conversation. A facilitator presents a scenario and introduces new information as participants explain what they would do. NIST describes this as a discussion-based exercise, with observations and recommendations captured afterward.
For account recovery, the useful question is often who can approve a change when the normal verification route is unavailable. Include the support, identity, and application owners whose responsibilities the scenario actually touches. Choose the decision you want to practice before adding incident details.
What the discussion can establish
A tabletop can uncover disagreements about who authorizes containment, which records responders need, or how teams reach each other outside normal hours. Participants should explain how they would make those decisions using the actual response plan.
Saying “we would revoke access” does not show that the control ends an active session. Use a separate technical test to check that behavior. Keep the discussion findings and technical test results distinct in the exercise report.
Assign follow-up work
Record the scenario, the information supplied, the decisions participants described, and the evidence they still need. NIST’s exercise guidance recommends an after-action report and follow-up changes to the plan where appropriate.
Give each important follow-up an owner and a clear way to check that it is done. If the escalation route is unclear, update the contact procedure and test the route. If a technical control is in doubt, arrange an authorized technical test.