A one-hour incident exercise
You don’t need a consultant or a full day. One hour, one scenario and the right five people show where your plan breaks.
Most incident response plans are tested for the first time during a real incident. A tabletop exercise is a cheaper way to find the holes: people sit around a table and talk through a made-up incident, step by step.
An hour is enough if you keep it tight:
- Invite five people: IT, a manager who can make decisions, someone from finance, someone who talks to customers, and whoever handles legal.
- Pick a realistic scenario: “Monday 8 am, all file servers are encrypted and there’s a ransom note.”
- Every ten minutes, add a twist. The backups are also encrypted. A journalist calls. The CEO is unreachable.
- At each step ask: who does what, how do they reach each other, what information do they need?
- Write down every “we don’t know”. That’s your to-do list.
Do it twice a year with different scenarios. It’s the most useful hour of security work I know.