Service · Facilitated, half a day
Find out what your people do before it matters
A tabletop exercise walks the people who would actually handle an incident through a scenario built for your business, hour by hour, and records where the plan broke. Nothing goes near your live systems. This tests decisions, not firewalls: who declares the incident, who calls the customers, when the 72-hour clock to the ICO starts, and what happens when the leak came from an AI system nobody had listed.
From £2,650
plus VAT for a half-day facilitated exercise and the written recordFixed fee
72 hours
from becoming aware to notifying the ICO — and most teams cannot say in the room when "aware" wasUK GDPR Article 33
6 to 15
people: IT, operations, communications, HR, legal or finance, and whoever would speak to customersWho attends
1 record
a decision log and findings report an insurer accepts as evidence of incident-response rehearsalWhat you keep
Who this is for
Organisations that have an incident-response plan and have never run it, and organisations that do not have one and suspect that matters. It suits the operational layer — the people who would be on the call at 7am — rather than the board, which has its own governance session. Insurers increasingly ask at renewal whether the plan has been exercised in the last twelve months; a dated record from this exercise answers that question.
Regulated firms use it to evidence operational-resilience testing. NHS suppliers and trusts use it against the incident-management outcomes in the DSPT. Cyber Essentials Plus does not require it, but the organisations that pass Plus and then have a bad week are usually the ones that never rehearsed.
What we actually do
A scenario built for your business, not a generic deck.
- One call with your IT or operations lead to learn your systems, suppliers and customers
- A scenario chosen from ransomware, supplier breach, AI data exposure, payment-diversion fraud or one you propose
- Complications timed to your real dependencies: the payroll run, the clinic list, the month-end
Three hours working the incident in stages, with the facilitator adding pressure as it unfolds.
- Who declares, who leads, who is told, and in what order
- The moment the 72-hour clock starts, and whether anybody noticed
- What you say to customers, staff, the press and your insurer, and who is allowed to say it
- Every decision logged with the time and the person who made it
The written record, and the list of what to fix.
- A findings report: where the plan, the delegations and the contact lists broke
- The decision log, in the form insurers ask for at renewal
- A prioritised fix list with a suggested owner for each item
- A dated confirmation letter for questionnaires and renewals
Why not run it yourselves?
You can, and you should. Our tabletop exercise packs exist for exactly that: card decks, a facilitator's guide, complications and a decision log, and the ransomware scenario is free. The facilitated exercise is for when you want an outsider running it — because the people who wrote the plan cannot see its gaps, because the exercise needs to be recorded by someone with no stake in how it went, or because the board has asked for evidence that it happened and would rather that evidence did not come from the IT manager.
What it costs
One scenario, one half-day, up to fifteen participants, at your offices or online, with the written record.
From £2,650 + VATHalf a day
Multi-site organisations, a full-day exercise with two scenarios, or an exercise that includes your key suppliers are priced on scope. Travel beyond the North West of England is charged at cost and agreed beforehand.
The same scenarios in pack form, with everything you need to run them internally.
FreeRansomware scenario · £145 + VAT for all three
See the tabletop exercise packs → Many organisations run the free pack first and book the facilitated version once they have seen what it turns up.
What actually happens, and when
First conversation
No charge. We establish who would be in the room, whether a plan exists, and what the organisation most needs to learn. If you would be better served by the free pack, we say so.
Within a week
A scoping letter with the fixed fee, the date, and the proposed scenario. Participants receive a one-page pre-read and nothing else — the point is to see what they do, not what they revised.
Your effort
One hour with your IT or operations lead before the day. Participants give up half a day. Nobody prepares a presentation.
The exercise
Three hours with a break, in stages, with complications added as you go. Nothing is scored against individuals and nothing is filmed.
Within five working days
The findings report, decision log and fix list. A thirty-minute call to walk through them with whoever owns the plan.
Afterwards
The findings are yours. We do not rewrite your plan, because we would then be assessing our own work; we will tell you exactly what it needs to say.
Questions we are usually asked
Does anything touch our live systems?
No. The whole exercise is conversation, cards and a clock. Nobody logs into anything. If you also want a technical test, that is penetration testing, which we arrange separately through an accredited partner.
We do not have an incident-response plan yet. Is this pointless?
The opposite. Running the exercise without a plan shows you, in three hours, exactly what the plan needs to contain, in the words of the people who would use it. It is the fastest way to write a plan that is actually yours.
Can our IT provider or MSP take part?
Yes, and they usually should, because in a real incident you will be on the phone to them within the first hour. They take part as participants. We do not share the scenario with them in advance.
Will our insurer accept the record?
The decision log and confirmation letter are written to answer the renewal question "has your incident-response plan been tested in the last twelve months, and how". Whether it affects your premium is the insurer's decision.
How is this different from the board session?
The board and executive governance session tests the board's oversight: the decisions only directors can take, and the record that they took them. This exercise tests the response team's operations. The two are designed to be run six months apart and the findings feed each other.
There is no charge for the first conversation and no obligation at the end of it.