Test the plan without interrupting operation.
A tabletop exercise simulates an incident through progressive events and incomplete information. Participants discuss the decisions they would make, what evidence they would require, who they would involve, and how they would manage conflicting priorities.
Possible scenarios
- ransomware with system unavailability;
- email compromise and fraudulent payment;
- data breach with uncertain initial information;
- attack on a provider or cloud service;
- blocking of an operational or industrial process;
- pressure from customers, media and institutional subjects.
Preparation and management
NESQ defines objectives, participants, scenario, inject and observation criteria. During the exercise it facilitates the comparison without turning it into an exam. Information flows, escalation, decision authority, dependencies and use of existing procedures are observed.
Output
- structured minutes of decisions and critical points;
- gaps in roles, contacts, playbooks and communications;
- corrective actions ordered by priority;
- recommended updates to response and continuity plans;
- proposal for a subsequent verification exercise.
Value emerges when management, IT, security, communications, legal, privacy and operational functions participate together: a cyber crisis affects the entire organization.