Among the benefits, tabletop exercises simulate a real-life attack so firms can put incident response plans to the test, including decision-making processes, communications and technical measures. When done well, tabletop exercises can expose blind spots and help response teams "build the muscle memory needed to act fast when the real thing hits", says Adam Harrison, managing director in the cyber security practice at FTI Consulting. So what types of tabletop exercises are available and how can you use them in your business?
Financial institutions are facing a new reality: cyber-resilience has passed from being a best practice, to an operational necessity, to a prescriptive regulatory requirement. Crisis management or Tabletop exercises, for a long time relatively rare in the context of cybersecurity, have become required as a series of regulations has introduced this requirement to FSI organizations in several regions, including DORA (Digital Operational Resilience Act) in the EU; CPS230 / CORIE (Cyber Operational Resilience Intelligence-led Exercises) in Australia;
A paper plan is just theory - its value emerges only under pressure. Now it's time to move from planning to proving by testing your plan under controlled conditions. A poorly prepared test can be worse than no test at all - it creates chaos, demoralizes your team, and fosters a false sense of security. This article is your blueprint for preparing to test your BCP, ensuring the process is organized, insightful, and ultimately strengthens your crisis response capabilities.