What’s an Incident Response Tabletop Exercise, and How Can It Help Keep Your Company Secure?

Do You Have the Right Plan in Place for Handling a Data Breach?

The moments after a cybersecurity crisis are filled with important decisions that impact the direction that the event will take. If you’re not properly prepared, it’s easy for things to go off track. An incident response tabletop exercise, or IR tabletop exercise, is a great method to proactively get your team on the same page.

When it comes to cybersecurity, being prepared goes a long way. Of course, there are many facets to maintaining cybersecurity, and the larger your organization is, the more thought and planning you’re going to need to put into effective strategies and methods to keep your data and your network safe. That’s why many companies choose to start with an incident response tabletop exercise. In these exercises, you get to hypothetically play out how your team would handle solving a cybersecurity crisis and get an expert analysis of your response.

Imagine this: your company’s data is breached. You’ve just found out and are realizing that personal customer information has been exposed. Do you know what your next step is? Who’s in charge of leading a team to address the breach? Companies around the country are faced with a real-life version of this situation every day, and often, they don’t have a strong plan in place to start recovering.

This is what makes IR tabletops a great starting point. These exercises reveal weaknesses in your existing systems and processes and show you where improvements can be made. Companies start with this service as a way to gain their footing and provide direction for where they should take their cybersecurity efforts. For publicly traded companies or companies with compliance requirements, incident response plans are a required exercise and help open up discussion on where their cybersecurity focus should be.

So, why is an IR tabletop so important? With cybersecurity attacks on the rise, it’s always good to know how your team will respond in a time of crisis. It’s easy to say that you know what you would do if something happened, but once your data is breached, if you’ve never experienced it before or gone through an exercise, the situation will devolve into chaos. A lack of experience leads to these tough situations taking longer to resolve than they should, and your company is losing more money the longer it takes.

A data breach crisis recovery often falls apart due to a lack of communication and not having the right decision-makers involved. Whenever you’re dealing with a severe problem like this, the most important thing is that everyone knows what their role is — meaning they know the overall plan, the steps, and who they need to communicate with to understand the correct process. Otherwise, you’ll end up with everyone doing their own recovery effort, rather than working together as a cohesive team to solve the problem in an effective manner.

An IR tabletop exercise establishes correct communication by laying out who is in charge of what steps and here’s the key — the overall leaders might not be who you think. While IT teams will be heavily involved in the recovery process, they’re not the ones making decisions.

This role will always fall to executive leadership because many of these choices are business focused — not technology focused. IT teams are going to be triaging the situation, but there are many other factors involved in fixing the problem. If legal teams need to be involved, someone has to make the decision to contact them and then work with them. Insurance carriers may need to be contacted. If a server needs to be shut off, it’s an executive who decides, and an IT member will execute turning it off. And if customer data was exposed, someone has to be the face of letting them know. These are all tasks that IT is not equipped to handle — tasks that have to be decided by executive teams.

So when you sit down to go through your IR tabletop exercise, you’ll need to make sure that everyone who will touch a part of the process is present. That means your IT team and your executive leadership team should be involved.

How Does an Incident Response Tabletop Exercise Work?

Before you get ready to sit down and go through your exercise, your IT security partner will likely meet with you to discuss the different types of scenarios that you can run through. You’ll want to look for a partner, like Inversion6, who will take the time to understand the specific risks that your company faces and develop an appropriate situation based on this information. This is key to ensuring that the exercise is beneficial because it wouldn’t do anyone any good to go through a scenario that won’t likely happen.

Once you’ve developed the right situation to run through, your partner will come in to act as the facilitator in the IR tabletop exercise. They won’t be involved in the process (the entire exercise will be run by your team), but they will be able to help things progress by answering technical questions that your team may encounter — like if you see a block in the firewall, they will tell you yes or no.

After the exercise is complete, you’ll receive an action report that gives an overview of your exercise, what went well, and what needs to be improved. You’ll also get an action plan with specific things you can do to be better prepared should a real crisis occur. Your plan might include a detailed communication plan or a better way for your team to know who to call. From here, you can start building a better response plan for any cybersecurity crisis you may run into, and have confidence that your team will be able to react in an appropriate manner.

If you’re ready to take a proactive step toward your cybersecurity strategy, Inversion6 can help. Whether an IR tabletop exercise is a necessity based on compliance or you just want to make sure you’re ready in the event that something happens, you can trust our experts to help you develop a smarter plan. We’ll work directly with your team to identify your needs and build actionable plans that you can build a foundation upon. Get in touch with us today to learn more about how an IR tabletop exercise can be an introduction to better cybersecurity for your organization.