CHECKLIST

Want to run your own tabletop exercise to improve your organization’s cybersecurity? Follow these steps.

1. Determine what you would like to test.

• Be specific

• Prioritize high likelihood/high consequence risks

2. Designate a group leader to run the exercise.

• Manage time, conversation, and interest

• Document key lessons

3. Create a plausible storyline that includes the threat you want to handle. 

• Use a storyline/realistic scenario

• Generate ideas from real-life experience

• Use online resources (@badthingsdaily on Twitter)

4. Gather the staff that would be responsible for managing this threat, plus observers.

• Assemble diverse group of participants from different departments

• Non-participating observers should take notes

5. State the outcome of the exercise at the beginning. 

• Clearly state the desired outcome (i.e. improve response to online harassment)

• Set expectations for time (2-3 hours) 

• Determine virtual or in-person setting

6. Walk the staff through the scenario and ask for their responses, step by step. 

• Take turns asking team members how they would respond

• This is a learning experience, not a time for criticism

• Participants may have feedback for other teams, and that’s OK

7. Document gaps, concerns, and weak points in the threat response.

• List the areas that need improvement

• Keep an open mind

• Thoroughly document the results of the exercise

8. Use the knowledge you've gained from the tabletop exercise to identify areas of concern and develop strategies to reduce those risks. 

• Make time for a discussion within 24 hours

• Identify the key areas of concern (top five)

• Develop strategies to address those concerns