How to Test a Cyber Incident Response Plan: A Practical Tabletop Exercise for UK SMEs

A cyber incident response plan can look excellent until somebody has to use it.

The contact list is complete. Roles are assigned. Recovery priorities are documented. Then the exercise begins and the group discovers that the deputy did not know they were the deputy, the IT provider needs approval nobody can give, and the alternative communications channel has never been set up.

That is not a failed exercise. It is a successful discovery made before a real incident.

In our previous guide, we explained what a cyber incident response plan should include. The next step is to test whether the people, decisions and supplier relationships inside that plan work together.

For many small and medium-sized organisations, a focused tabletop exercise is the most practical place to start.

What is a cyber incident tabletop exercise?

A tabletop exercise is a structured, discussion-based session. Participants are given a realistic cyber incident scenario and talk through what they would do as the situation develops.

Nobody attacks the live network. It is not a penetration test and it does not prove that every technical control works. Instead, it tests whether people understand the response plan, can make decisions, know how to communicate and can work with internal and external partners.

The NCSC describes cyber incident exercising as a controlled, scenario-based opportunity to practise, evaluate and improve incident response plans. Its free Exercise in a Box resource includes ready-made exercises for organisations, including SMEs.

A tabletop exercise should strengthen an existing plan. If your organisation has no reporting route, named lead or basic response process, build those foundations first.

Choose one clear objective

Trying to test everything at once produces a busy conversation and few useful conclusions. Decide what the exercise needs to reveal.

For example:

• Can staff report a suspected incident through a trusted route?
• Can the business and its IT provider agree containment actions quickly?
• Can leadership prioritise essential services when some systems are unavailable?
• Can the organisation communicate if Microsoft 365 is inaccessible?
• Do supplier, insurance and regulatory contacts work in practice?
• Can the business make and record time-sensitive decisions?

A useful objective is specific enough to observe. “Improve cyber resilience” is too broad. “Confirm who can authorise the isolation of a compromised Microsoft 365 account outside working hours” is testable.

Put the right people in the room

A cyber incident is rarely an IT-only problem. A proportionate SME exercise may include:

• the business incident lead and deputy
• the internal IT contact or technical lead
• the managed IT or cyber security provider
• an operational leader who understands critical services
• the person responsible for communications
• the data protection, compliance or legal contact where relevant
• a facilitator who controls the scenario and records findings

Not everybody needs to attend every exercise. Choose participants around the objective. If the scenario affects payroll, include somebody who understands payroll. If it centres on a supplier compromise, include the person who manages that relationship.

Senior participation matters when the exercise tests decisions that only leadership can make. Do not send somebody to observe on behalf of the person who would actually authorise a shutdown, emergency spend or customer communication.

Use a believable business scenario

The scenario should feel possible without becoming so technical that business participants disengage.

One useful starting point is an impersonated IT-support call. A finance employee grants remote access to someone claiming to be from the helpdesk. Shortly afterwards, unusual activity appears in the account.

Other options include ransomware affecting shared files, a stolen laptop containing sensitive information, a warning from a critical software supplier, suspicious email forwarding rules or the loss of access to Microsoft 365.

Connect the scenario to a real business pressure. It is payroll day. A major tender is due. A care team needs access to records. The incident begins shortly before the weekend. These details reveal how technical decisions interact with operational priorities.

Do not use confidential real incidents or turn the session into a disguised performance test. The aim is to examine the system, not embarrass individuals.

Build the exercise in stages

Present the scenario in small updates, often called injects, rather than revealing everything at the start. This lets the group make decisions with incomplete information, as it would in a real incident.

A simple 60 to 90-minute exercise could follow this structure:

Stage 1: Detection and escalation

The employee reports the suspicious support call. Ask:

• Which trusted channel do they use?
• Who receives the report?
• What information is captured?
• Who contacts the IT provider?
• When is the business incident lead involved?

Stage 2: Containment and business impact

The provider finds suspicious activity and recommends isolating the device and restricting the account. The finance team may lose access during a critical process. Ask:

• What can the provider do immediately?
• Which step needs business approval?
• Who can approve it if the main contact is unavailable?
• Which essential activity is affected?
• What workaround is available?

Stage 3: Wider consequences

Add evidence that information may have been accessed, or remove the normal email and Teams channels. Ask:

• How will the response team coordinate securely?
• Who assesses reporting, contractual and insurance duties?
• Who communicates with staff, customers or suppliers?
• What facts can be confirmed, and what remains uncertain?
• When is the next decision point?

Stage 4: Recovery and review

The immediate threat is contained, but one service must be restored. Ask:

• Which business activity comes back first?
• What evidence is needed before restoration?
• Can the required data be restored from a known clean point?
• Who approves the return to normal operations?
• What will be monitored afterwards?

The NCSC's guidance on creating cyber exercises recommends defining objectives, participants and measures, using a suitable scenario and injects, and capturing evidence and lessons afterwards.

Make the exercise safe and useful

Set expectations before starting. Participants are there to use the current plan, identify uncertainty and say when they do not know an answer. The facilitator should keep the discussion moving but should not solve the scenario for them.

Use the processes, contact details and supplier arrangements that exist today. If somebody says, “We would call the insurer”, ask where the number is kept and who is authorised to call. If the provider says it would isolate an endpoint, ask whether that action is covered by the agreement and needs approval.

Record decisions and assumptions in the same way the organisation expects to during a real incident. Note the time, what was known, the options considered, the decision made and its owner.

Avoid testing live containment or recovery actions unless they have been separately planned and controlled. A tabletop exercise discusses what would happen. Technical simulations and restore tests need their own safeguards.

Measure gaps, not performance theatre

The result should not be a pass or fail score designed to reassure leadership. Useful findings are specific and actionable.

Examples include:

• the out-of-hours provider number is missing from the offline plan
• the deputy has no authority to approve account isolation
• nobody owns customer communications
• the team assumes the backup can meet a recovery time that has not been tested
• the insurance policy requires an early contact that is absent from the checklist
• the response team has no alternative to corporate email and Teams
• the supplier contract does not define who preserves evidence

Separate observations from actions. Every agreed improvement needs an owner, a target date and a way to confirm completion. Review the response plan once those actions are closed, not just immediately after the exercise.

Include your IT provider, but keep the business in the lead

If technology is outsourced, the exercise is one of the best ways to test the join between the organisation and its provider.

The provider should be able to explain what it detects, who receives alerts, how it escalates, what containment authority it holds and when additional incident-response expertise is needed. The business should explain operational priorities, decision rights, communications and risk acceptance.

A managed IT support service may contribute essential technical knowledge, but an incident exercise also needs business leadership. A cyber security control that generates an alert is useful only if the right people know what happens next.

For exercises involving significant operational, financial or regulatory impact, consider whether specialist support is appropriate. The NCSC maintains a Cyber Incident Exercising scheme for assured providers delivering tailored tabletop and live-play exercises. Do not assume that general IT support and an assured cyber exercise are the same service.

Test recovery separately

A tabletop may expose assumptions about backups, but discussion alone does not prove that recovery works.

Identify the data and services that the scenario relies on, then arrange controlled restore tests. Confirm who can initiate a restore, where clean copies are held, how long the process takes and whether the restored service supports the actual business activity.

This connects the response plan to backup and disaster recovery. A successful backup job is an input. A safe, timely and usable restoration is the outcome the business needs.

Repeat with purpose

The first exercise will not settle every issue. Repeat it after major changes to people, systems, suppliers or business processes, and after material weaknesses have been corrected. Vary the objective and scenario rather than replaying the same script for a better score.

A small business does not need to simulate a national crisis. It needs to find the next avoidable delay, unclear authority or recovery assumption before a real incident does.

The most valuable phrase in a tabletop exercise is often:

“We have never actually tried that.”

That sentence turns an assumption into an improvement opportunity.

Turn your response plan into a working process

Cloud Agile can help you review the technology, responsibilities, supplier boundaries and recovery dependencies behind your incident plan.

Talk to Cloud Agile about cyber resilience and identify the questions your next exercise should answer.

Frequently asked questions

What is the difference between a tabletop exercise and a penetration test?

A tabletop exercise is a discussion-based test of people, decisions and response processes. A penetration test examines technical weaknesses through authorised testing. They answer different questions and may both form part of a wider security programme.

How long should an SME cyber tabletop exercise take?

A focused first session can often run for 60 to 90 minutes, plus preparation and follow-up. The right length depends on the objective, number of participants and complexity of the scenario. It is better to test one important process well than rush through every possible incident.

Who should facilitate the exercise?

Use someone who can control the scenario, remain neutral, ask follow-up questions and capture evidence. That may be an appropriately experienced internal person or an external specialist. For higher-impact or more complex exercising, consider an NCSC-assured Cyber Incident Exercising provider.

Should our managed IT provider attend?

Usually, yes, where the exercise tests detection, escalation, containment, recovery or supplier hand-offs. The provider should not replace business decision-makers, communications owners or advisers whose roles are also being tested.

Is the NCSC Exercise in a Box free?

Yes. Exercise in a Box is a free NCSC resource with scenarios and materials to help organisations plan, run and review cyber exercises. It is designed to be usable by organisations including SMEs.

What should happen after the exercise?

Produce a short record of findings and agreed actions. Assign each action to an owner with a target date, update the response plan and supplier arrangements, complete any controlled technical tests, and schedule a follow-up to confirm the improvements are in place.