If you have a leadership role with a company, you might’ve heard of a tabletop exercise before. No, I’m not referring to the strength training exercise that will get you washboard abs.
What I’m actually talking about are the discussion-based collaborations where team members go over their roles and steps of an emergency response plan.
They simulate an emergency scenario that would disrupt business operations, so that team members know how to handle and remedy the situation.
Cybersecurity breaches are one instance where these tabletop exercises are important. Companies need the best preparation to deal with a data breach, and these collaborative sessions help ensure that.
So how do you go about creating a simulation for your team to prepare for worst-case scenarios? Here are ten tips to keep in mind that help you create the perfect data breach tabletop exercise template.
Table of Contents
Tailor to The Right Audience
Data breach tabletop exercises can look different depending on the participating department and team. For instance, management would have different responsibilities than their employees. And of course, the technical team will have more involvement than other departments.
Depending on who will be doing the exercise will determine what components to include. Certain scenarios may have different processes and outcomes depending on who participates.
Involve All Necessary Parties
Since you need to tailor the exercise to the right audience, you need to also ensure that you’re including all necessary parties in the exercise. Anyone who has a role in the scenario’s response must be present for the tabletop exercise.
Otherwise, there will be gaps in the process. This would make for ineffective or incomplete outcomes. There isn’t a way to know that a response will be successful if not everyone is present for the simulation.
Maybe Bob, who didn’t receive an invite to the discussion, would’ve forgotten that he was the responsible party for disabling an employee’s user access after they stole client-facing information. Since he wasn’t at the discussion, there was no way for your team to verify if he did or didn’t know what his role was in the response. Instead, your team just assumed he knew.
Because of this, if an incident like that ever did happen, it poses a greater risk because the employee would still have access to data that they shouldn’t. But if Bob was at the tabletop exercise then the team would realize that he wasn’t aware of his responsibility, and that risk would get corrected.
Review Each Person's Role
A perfect data breach tabletop exercise will review each person’s role before starting the simulation. That way, everyone knows what steps they need to take to successfully address the situation.
In that case, they don’t end up like Bob who would have forgotten what to do. Reviewing the roles before the simulation makes for the best possible outcomes.
We can compare it to a game plan for the NFL Super Bowl. The football teams don’t practice for the game without first going over their plays. Otherwise, their practice won’t be effective and players will be out on the field clueless about what to do.
The same goes for your team when preparing for cybersecurity incidents. If you’re practicing with a tabletop exercise, then everyone needs to know their role in the game plan.
Allow for Enough Time
Your team should never rush through these exercises. Make sure to allow enough time for these scenarios so that they’re thorough.
Rushing through anything is bound to cause mistakes. If you don’t slow down to focus on the details of the scenario and response, it’s more likely to miss an important step. Because of this, there needs to be enough time to complete the exercise.
Review Objectives and Outcomes
Before starting, do a run-through of what the objectives and outcomes should be. This helps reinforce what everyone’s role is.
What is the goal of this exercise? What should the result look like?
Going over these gives the participants a better understanding of how to respond to a situation within the exercise. If they know that XYZ should happen in the end, they’ll be able to figure out getting to that point throughout the exercise.
For instance, if the scenario was how to respond to a ransomware attack, explain what the outcome should be. Protecting data at any cost? Restoring operations as quickly as possible? A combination of both? Depending on what the outcome your company wants may determine what the response is, such as if it includes paying the ransom or negotiating with the hacker.
Identify Probable Scenarios
Here’s where the bulk of the tabletop exercise starts.
The main purpose of the exercise is to identify potential emergency scenarios that your company will need to respond to.
Once you identify these scenarios, then your team can work through them to determine their preparedness. Because each scenario is different, not every exercise will look the same. One scenario may require a completely different response than another.
Because of this, it’s important to go through different possibilities so that your team is ready for anything, especially when it comes to cybersecurity. Just some scenarios could include…
A vulnerability with a third party vendor
An employee stealing client information
Employee falling for a phishing scam
Network vulnerability resulting in a ransomware attack
A stolen device that hosts client data
The list goes on. Since each of these would have a different response plan, each scenario can be its separate tabletop exercise. This ensures that the team knows how to respond to various problems.
Anticipate and Embrace Unforseen Outcomes
When I say that you should embrace unforeseen outcomes, I’m not saying you should hope for an incorrect response or a problematic result. But these exercises aren’t meant to be perfect.
That’s why you’re doing them in the first place. The whole point is to discover any flaws in the plan before an incident happens. After all, 95% of data breaches occur because of a mistake by an employee.
So it’s unrealistic to expect perfection going into these data breach tabletop exercises. But practice will make perfect so that these breaches caused by human error don’t happen.
Instead, anticipate unforeseen outcomes arising during a tabletop exercise. When this happens, embrace that result as an opportunity to improve. It’s better that these issues come up during a trial run before an incident does occur.
That way, everyone can work through these issues to improve their preparedness for a real scenario.
Recap The Session
After working through the scenario, you might think the exercise is over…not quite.
Every exercise needs a wrap-up. To use an athletic metaphor one more time, do you think that a runner heads straight home after a workout? No, of course not. They first have to cool down, stretch, and maybe even ice…all of the “extras” that prevent them from getting hurt during a race.
You can apply the same mentality when it comes to these exercises. Right after going through the scenario, you need to do the “extra” work before everyone goes back to their daily tasks. Wrapping up the session by recapping everyone’s roles, what happened during the simulation, and the outcome reiterates the process and what the perfect incident response should look like.
Document Findings
But hold on, we still aren’t done. Even after recapping the simulation, there’s more work to do to ensure you have the perfect data breach tabletop exercise.
I mentioned before how these simulations will uncover discrepancies that you might not have known existed. Because of this, it’s best to document them for future reference. This way, the team can revisit the exercise steps to ensure that they’ve perfected the plan and don’t make the same issues.
Repeat The Exercise Frequently
Finally, the last step is to repeat the exercise frequently. Since you’ve documented the findings, you can refer back to previous exercises each time you repeat them. That way you can see how the response plan may have changed or improved.
Since practice makes perfect, repetition will improve the success of handling any incidents. It reiterates each person’s role in a response plan so they remember exactly what to do. And if any steps of the plan do change, revisiting these exercises is a good chance to inform the staff of those changes.
Conclusion
By now, you’re ready to start implementing the perfect data breach tabletop exercise. Any company that deals with sensitive data should be using these simulations.
It’s one of the best ways to determine your team’s preparedness and go over all details of how to respond to an incident. Since these are discussion-based practices, there’s no pressure if an unforeseen issue comes up.
These scenarios are the best time to determine any flaws in the response plan so that the team can remedy them before an actual situation occurs.
