Facilitators present a scenario — ransomware, data breach, provider outage, regulatory notification — and inject developments over time. Participants describe what they would do, revealing gaps in playbooks, authority, communication paths, and external dependencies before a real event exposes them.
Key points
Decision-forcing scenariosChoose scenarios that force real trade-offs — payment, disclosure, shutdown, regulator contact — and record who decided what and why.
Real decision-makersExecutives, legal, communications, IT, and affected business owners, not only the security team.
Important limitationA tabletop tests plans and understanding, not technical controls. Agreement in a conference room does not prove the same actions work under real time pressure and incomplete information.