Call us on 03450 21 21 51
Call us on 03450 21 21 51
Share this article
Planning for the unexpected is critical when it comes to ensuring your organisation has what it takes to survive over the long-term. No road to success is entirely smooth, and with cybersecurity concerns at an all time high across a range of sectors and industries, knowing how to react in the face of an incident is paramount to your organisation’s resilience.
That’s where business continuity planning comes in. Working to a robust framework and strategising for turbulent times or unplanned disruption can ensure that you respond effectively to situations that might catch others off-guard.
Tabletop exercises are an important part of developing and testing any business continuity plan. Let’s take a look at why they are valuable, how they can be run and how they can benefit your organisation.
A tabletop exercise is a discussion-based informal session where teams are able to talk through their roles, responsibilities and responses in the event of a business emergency or incident. Employers and employees alike can walk through a multitude of example scenarios in order to get business continuity plans off the written page and make them more tangible.
Through trial and error it is possible to make disaster recovery and business continuity plans more robust, helping to avoid catastrophic errors in the heat of a real-life situations such as: failing to call the emergency services at the appropriate time or failing to shut off the water supply at source when a flood is identified.
It also makes it easier to pass vital business continuity planning information throughout the business without having to simulate a full-scale disaster.
As such, businesses are increasingly utilising tabletop exercises as part of their IT security protocol. While business continuity is not restricted to cyber-attack incidents alone, it is clear that attacks are on the rise and represent a higher risk than many other incidents for organisations of all sizes. Designing an incident response plan is highly beneficial to both dealing with the fallout, but tabletop exercises help you put this plan to the test based on real-world scenarios.
In order to ensure your tabletop exercise is as beneficial as possible, you need to first consider, which threats are most likely and how they might play out – so that you can choose an exercise that warrants a team walkthrough.
It is important that the exercise doesn’t simply become a generic breach response outline; instead it needs to involve your employees unpacking the organisation’s specific priorities in response to a scenario. Remember that business continuity threats don’t just impact your IT and security assets, but involve all staff. Asking pertinent questions like: Is the plan written so anyone can follow it without requiring additional information? Is an important part of this process.
Simply assuming that key IT personnel or senior management will be on hand to execute a plan is a common mistake. After all, if the only team members on site are entry level staff or middle managers, they should be just as capable of getting the wheels of incident response in motion.
As a result, representatives from legal, marketing, sales, customer support and human resources teams need to be involved in any tabletop exercises – both to ensure their expertise is incorporated into the development of future business continuity plans and that they are aware of the exercise outputs.
When choosing an incident to walk through in your exercise, be sure to create a scenario that stress tests employees in a variety of ways. Should you choose to make this a cybersecurity threat, try accounts documented by government agencies and industry publications rather than the sensationalist and superficial accounts contained in the mainstream media.
Remember, you are testing the capabilities of people as well as technology. Everyone in your team needs to feel comfortable and on board with your plans. Think of your tabletop exercise as a classic RPG (role-playing game) where everyone needs to understand the part they are playing.
Tabletop exercises are a safe space for suggestions to be made, tested and, if necessary, abandoned, without reprimand. This helps to add to the overall purpose of business continuity planning, which is to generate confidence and peace of mind when it comes to organisational threats.
From phishing attempts and supply chain attacks to ransomware, cybercrime can take on many forms, and each instance spells different consequences for your organisation. By having an effective plan in place – and testing that plan to be sure it works – you can lessen the damage and ensure your business is able to survive whatever might be coming your way.
