Most organizations have an incident response plan. It was written carefully, approved, and saved in a shared folder. Since then, a few of the people named in it have changed roles, a vendor has been replaced, and at least one phone number no longer works. Nobody has noticed, because nobody has needed it yet.
That is the real risk with an untested plan. It is not that the plan is wrong. It is that nobody knows which parts are wrong until the moment they are needed, usually late at night, with fewer people available than the plan assumes.
A tabletop exercise is the simplest way to find out. The team sits together, walks through a realistic incident step by step, and talks through what each person would do. No systems are touched. Nothing is shut down. The only thing being tested is the plan and the people behind it.
Why do it before year end
The end of the year is a good time for three reasons. First, the holiday weeks are when most organizations run with the fewest people, which is exactly the condition a real incident tends to find. Second, any gaps the exercise uncovers can still be written into the 2027 budget instead of waiting another year. Third, in healthcare and financial services, auditors and examiners often ask for evidence that the incident response plan has been tested. A documented exercise answers that question.
Five steps to run one
1. Pick one realistic scenario
Choose a single incident that could plausibly happen to your organization. Ransomware on a core system during a holiday week is a common choice. A breach at a vendor that holds your data is another. Keep it to one scenario. Trying to cover everything in one session usually means covering nothing well.
2. Invite the right people, not just IT
An incident is a business event. Include the people who would make decisions in a real one: leadership, legal or compliance, communications, operations, and the owners of the affected systems. In healthcare, include someone who can speak to patient care. If a key vendor would be involved, consider inviting them too.
3. Reveal the scenario in stages
Do not hand out the full story at the start. Give the group the first sign of trouble, let them respond, then add the next development. A help desk ticket becomes locked files, which becomes a ransom note, which becomes a call from a reporter. Staging it this way shows how decisions hold up as the picture changes.
4. Ask about decisions, not technology
The most useful questions are rarely technical. Who has the authority to take a system offline? Who calls the cyber insurance carrier, and when? Who decides whether patients, customers, or regulators need to be notified? Where is the plan if the network it is stored on is down? Pauses and disagreements are not failures. They are the findings.
5. Write down every gap and give it an owner
Assign someone to take notes throughout. Within a week, turn those notes into a short report: what worked, what did not, and what will change. Each gap gets an owner and a date. Without that last step, the exercise was a conversation. With it, the plan is better than it was.
What usually comes up
Every organization is different, but the same gaps appear again and again.
- Contact lists that are out of date, including vendors and after hours numbers.
- No clear answer on who can declare an incident or approve shutting systems down.
- A plan stored only on systems that would be unavailable during the incident.
- Vendor contracts that say little about how quickly a vendor must notify you.
- Backups that exist, but with no tested answer to how long a full restore would take.
None of these require a large project to fix. Most need a decision, a document update, or a phone call.
Keep it small and keep it regular
The first exercise does not need an outside facilitator or a full day. Two hours, one scenario, and the right people in the room are enough to learn a great deal. The value comes from doing it, writing down what you found, and doing it again next year with a harder scenario.
A plan that has been tested once, imperfectly, is worth more than a polished plan nobody has opened.
System Custom Consultants works with healthcare, financial services, and public sector organizations on cybersecurity and business continuity. If your incident response plan has not been tested in a while, start a conversation at systemcustom.com.
