Glossary · Business continuity
Tabletop Exercise
A discussion-based rehearsal in which a team walks through its response to a simulated scenario to test plans and roles.
What a tabletop exercise is
A tabletop exercise gathers the relevant people to talk through how they would respond to a realistic scenario, such as a ransomware outbreak or a site outage. It tests whether plans are clear, roles are understood, and decisions can be made, without disrupting live systems. In German practice the format is known as a Planbesprechung.
How it runs
A facilitator presents the scenario in stages and adds new information, so-called injects, as the discussion unfolds: the backup turns out to be encrypted too, a journalist calls, a supplier cannot be reached. Participants state what they would do, which plan they would open and whom they would inform. An observer records decisions, open questions and gaps between the plan and what people actually did.
What it delivers
- An exercise report with the scenario, the participants, the timeline and the observations.
- A list of actions with owners and dates: plans to correct, contacts to update, training to run.
- Evidence that plans were exercised, which ISO 22301 clause 8.5 and BSI Standard 200-4 require of a working BCMS.
Tabletop exercises are the cheapest exercise format and the usual first step before functional and full-scale exercises. Running one per critical scenario each year is a common cadence.