Cybersecurity Tabletop Exercises for Stronger Incident Readiness

A cybersecurity tabletop exercise is designed to answer these questions before a real incident forces decisions under pressure.

A tabletop exercise is a discussion-based simulation of an incident. It does not directly test whether an endpoint agent blocks malware or whether a backup restores successfully. Instead, it tests whether people, decision rights, plans, communications, and business continuity arrangements work together as an incident unfolds.

This matters because incident response is not solely an IT activity. NIST treats incident response as an integral part of cybersecurity risk management and aligns incident-response considerations across the Cybersecurity Framework functions of Govern, Identify, Protect, Detect, Respond, and Recover, with continuous improvement. NIST SP 800-61r3

A useful exercise brings the right people together around a realistic scenario, provides information in stages, and asks participants to make the decisions they would make during a live event.

The facilitator may introduce new facts, often called *injects*, as the exercise progresses. For example, a suspicious sign-in alert becomes encrypted file servers; unavailable file servers become a production outage; and the outage becomes a claim that sensitive data has been copied.

The objective is not to catch people out. It is to expose assumptions safely and identify where the response needs to improve.

This is important because an incident can develop across IT, cloud services, identities, operational technology, suppliers, and communications channels. NIST notes that successful incident response depends on participation by internal and external parties with varied roles and responsibilities, including leadership, legal advisers, service providers, and business owners. NIST SP 800-61r3

Many organizations have an incident response plan stored in a document repository. Fewer have tested whether contact numbers work, whether executives agree on shutdown authority, or whether business units can operate without their usual systems.

The gaps are usually operational rather than theoretical.

A plan may say "escalate to management" without defining the severity threshold, escalation route, or decision required. It may name an external incident-response provider without confirming the retainer, authorization process, access arrangements, or evidence-handling expectations. It may list backups without identifying the recovery order for essential services.

Ransomware can expose these gaps quickly. Ransomware and data-extortion incidents may involve both encryption and data theft, requiring organizations to manage service restoration and potential data exposure at the same time. CISA recommends maintaining and regularly exercising an incident response and communications plan that addresses ransomware and data-extortion scenarios, while prioritizing isolation of affected systems and restoration from clean environments. CISA Ransomware Guide

A tabletop exercise changes the conversation from "Do we have a plan?" to "Can we make sound decisions using this plan at 2:00 a.m.?"

Consider a fictional regional distribution business with headquarters in Riyadh, a UAE sales and logistics operation in Dubai, Microsoft 365 collaboration services, cloud-hosted customer systems, and an on-premises ERP environment supporting warehouse dispatch.

The scenario begins on a weekday morning.

The security team receives alerts showing repeated sign-ins to a privileged account from an unfamiliar location. Soon afterward, an administrator reports that multi-factor authentication prompts were approved unexpectedly.

At this stage, teams should establish a shared incident record, define an initial severity rating, and begin a disciplined update cadence. The goal is to prevent fragmented conversations across email, chat groups, and personal phone calls.

Thirty minutes later, users in Riyadh and Dubai report inaccessible shared folders. The ERP application becomes unstable, and a ransom note appears on several servers. The attackers claim they copied commercial documents and employee records before encrypting systems.

Now executive decision-making begins.

The technical team may recommend isolating affected network segments, disabling selected accounts, or taking systems offline. The business may warn that doing so will delay orders, invoices, and deliveries. Neither perspective is wrong. The exercise should test whether the organization can make a documented risk decision rapidly, based on business impact rather than hierarchy or intuition.

CISA's ransomware guidance recommends determining which systems are affected and isolating them immediately. Where several systems or subnets appear affected, network-level isolation may be necessary. CISA Ransomware Guide

By midday, warehouse staff cannot confirm inventory availability. The UAE operation is receiving customer calls, while the Saudi finance team cannot access invoice records. A journalist contacts the communications team claiming that a criminal group has published the company's name.

The key question is not whether the company can produce a perfect public statement. It is whether communications are controlled by verified facts and approved through a clear process.

A tabletop should be focused enough to create meaningful decisions and broad enough to include the people who own the consequences.

A focused exercise with well-designed objectives is generally more useful than a meeting that attempts to test every aspect of incident readiness at once.

A scenario that matters to the organization will prompt better decisions than a generic "virus on a laptop" story. Cyberactics can support this work through incident-response, risk, compliance, and advisory services that help organizations structure exercises around their operational priorities.

A realistic exercise does not begin with a complete incident report. Participants should receive incomplete evidence and evolving information. This tests their ability to distinguish facts, assumptions, and decisions that can wait.

For example, the facilitator may tell the group that a ransomware note exists but that data exfiltration has not yet been confirmed. Later, an inject may reveal unusual outbound data transfers or a message from the threat actor. This creates a realistic tension between the desire for certainty and the need to act quickly.

The exercise team should reflect the organization, not just its IT department.

The CEO, managing director, CIO, or another designated executive should understand their role in approving major business-risk decisions, allocating resources, and setting the tone for communications. Leadership may need to approve actions such as pausing critical services, engaging external advisers, or prioritizing recovery of one business function over another.

The incident commander coordinates response activity, maintains the incident timeline, drives decisions to the correct owners, and ensures that teams work from a common operating picture. This role should not be confused with the most senior technical person in the room.

These participants assess alerts, contain affected systems, investigate identity compromise, preserve evidence, coordinate with a SOC or managed security service provider, and plan recovery. They should be prepared to explain the operational consequence of each containment option in plain business language.

Business-unit leaders decide which services are most important, what manual workarounds are feasible, and what customer commitments must be protected. Their presence prevents technically sound recovery plans from restoring the wrong services first.

These teams guide regulatory, contractual, evidentiary, privacy, and insurance considerations. They should not be expected to determine technical scope alone, but they need a rapid way to receive verified updates and make decisions.

Communications leaders prepare internal and external messaging. HR may need to guide staff communications, remote-work procedures, employee data considerations, and support for teams working extended hours.

Where relevant, include or simulate the roles of cloud providers, cyber insurers, external counsel, digital forensics firms, and managed security partners. A response plan that depends on an external party should define who can authorize engagement and how quickly they can be reached.

The most valuable part of a tabletop exercise is often the difficult choice between two imperfect options.

These questions should produce named decision-makers, not general agreement. NIST notes that leadership may have decision-making authority for high-impact response actions, including shutting down or rebuilding critical services, while incident handlers investigate, contain, and restore operations. NIST SP 800-61r3

During a real cyber incident, silence can create a vacuum that employees, customers, and social media may fill with assumptions. Premature statements, however, can create legal, regulatory, and reputational problems.

The exercise should also test out-of-band communication. If corporate email, collaboration tools, or identity services are unavailable, how will the response team communicate securely?

Organizations operating across Saudi Arabia, the UAE, and the wider GCC should avoid assuming that one incident-response process automatically meets every local requirement. A regional response may involve different offices, service providers, decision-makers, contractual commitments, and operating conditions, even when the technical incident is shared.

In Saudi Arabia, the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC 2-2024) apply to Saudi government agencies and their affiliated entities, as well as private-sector entities that own, operate, or host Critical National Infrastructures. Other entities are strongly encouraged by the NCA to use the controls as good practice. In-scope entities should ensure that their incident-response, business continuity, and disaster-recovery arrangements address the applicable controls. The NCA's implementation guidance includes documented cybersecurity requirements within business continuity management, plans for cybersecurity incidents that may affect continuity, disaster recovery plans, and executive-management support. NCA Essential Cybersecurity Controls NCA ECC Implementation Guidance

In the UAE, expectations depend on the organization's jurisdiction and sector. Dubai Government Entities are subject to the Dubai Electronic Security Center's Information Security Regulation, which is intended to support continuity of critical business processes and minimize information-security risks and incidents. Authorized Persons regulated by the Financial Services Regulatory Authority in ADGM must immediately notify the FSRA of incidents affecting their operations and must notify it no later than 24 hours after becoming aware of, or receiving information that reasonably suggests, that a material cyber incident has occurred. Dubai Electronic Security Center regulations ADGM IT Risk Management

The UAE's National Cybersecurity Strategy sets a national direction around governance, protection, innovation, capability building, and partnership. It should not be treated as a substitute for identifying the obligations that apply to a particular organization, emirate, regulator, or sector. UAE National Cybersecurity Strategy

For a Saudi-UAE business, a good tabletop scenario should include a clear decision point: *Which legal or regulatory owners assess notification duties in each operating jurisdiction, and how will the group maintain a coordinated but locally appropriate response?*

For organizations with operations across the GCC and wider MENA region, exercises should also account for practical regional realities. These can include distributed leadership teams, cross-border suppliers, local customer-support operations, different working patterns, and the need to maintain a common incident picture when the response is coordinated from more than one location.

This is not merely a compliance exercise. It helps prevent a regional incident from becoming disorganized when different offices, service providers, and decision-makers are working under different requirements.

A ransomware exercise should not end with "restore from backup." Recovery involves sequencing.

Business continuity plans may identify priority processes, but a tabletop tests whether those priorities still make sense during a cyber event. A system with a short recovery target may not be the first one that can be safely restored. Conversely, a manual process that appears workable on paper may fail after several days of high transaction volumes.

An exercise without follow-through becomes a meeting rather than a resilience improvement activity.

Each corrective action should have an owner, target date, priority, and measurable completion condition. "Improve incident response" is not an action. "Update the major incident playbook to define authority for isolating the ERP environment, obtain executive approval, and rehearse it in the next exercise" is.

NIST emphasizes that lessons learned during incident response should be shared as they are identified and used to improve cybersecurity risk-management activities. NIST SP 800-61r3

A cyber incident is not the moment to discover that the incident commander cannot reach the CEO, the insurer requires a specific notification process, recovery priorities are disputed, or the communications team has no approved holding statement.

Tabletop exercises make these weaknesses visible while the cost of fixing them is manageable.

Cyberactics supports organizations across Saudi Arabia, the UAE, the GCC, and the wider MENA region through managed cybersecurity and SOC services, incident response, and compliance, risk, and advisory services. A structured tabletop exercise can help turn incident-response plans into a practiced, business-led capability. For a structured starting point, see our guide to Managed Cybersecurity for GCC SMBs.