Executive Tabletop Kit: The 90-Minute Cyber Crisis Simulation Every Leadership Team Needs Before the Next Attack
A 90-minute executive tabletop kit with a realistic scenario, decision checkpoints, and debrief notes to tighten governance and speed.
When a crisis hits, executives don’t need more slides—they need muscle memory. This 90-minute tabletop kit gives you a compact scenario, clearly timed decision points, and a debrief template so your leaders practice who decides what, when to disclose, and how to speak—without improvising.
H2 #1 — 90 minutes that simulate real pressure
This tabletop compresses a high-stress incident into three acts: Detect → Decide → Disclose. Each act introduces new facts, forces prioritization, and tests alignment across Legal, Security, Comms, and the Business.
- Alarms, partial outage, suspicious note.
- Evidence freeze, insurance notice, LE touchpoint.
- First exec brief: “what we know / don’t know”.
- Exfil suspected; legal triggers mapped.
- Pay/no-pay screen; restore options & downtime.
- Audience sequencing draft; holding lines.
- Employees memo; regulator plan; media prep.
- Board asks: materiality, cost, reputation.
- Go/No-go on public posting; next 24h plan.
Tabletop pacing
Facilitation tip: keep all new “intel drops” on cards. Read them aloud at preset minutes 10, 35, and 65 to keep realism and pace.
H2 #2 — Legal & governance rails that shape every move
Use a lightweight decision register under counsel to capture each choice, owner, and rationale. Map legal triggers early and update with confidence levels: Confirmed / Probable / Under Investigation.
- Privilege guardrails for forensics & drafts.
- Sector/state notice mapping; timers started?
- Sanctions & insurance constraints on payments.
- Materiality screen if publicly listed.
- One master narrative for all variants.
- Sequencing by risk: employees → affected individuals → regulators → media.
- Approved holding lines; no speculation.
- Daily update cadence (times set upfront).
Legal Map Completeness ~66%
Forensic Confidence ~50%
Comms Readiness ~83%
H2 #3 — Run sheet & facilitator prompts (step-by-step)
- Minute 0–5: Set roles, objectives, rules (no hindsight, timeboxed decisions).
- Minute 5–10: Intel Drop #1 (outage + suspicious note). Teams draft first 3 actions.
- Minute 10–20: Legal hold, insurer notice, LE touchpoint; define “facts matrix”.
- Minute 20–30: Exec huddle #1: downtime, customer impact, early comms posture.
- Minute 35: Intel Drop #2 (exfil suspected + third-party dependency).
- Minute 35–55: Sanctions screen; restore options; audience sequencing draft.
- Minute 55–65: Prepare employee memo + talking points; board questions.
- Minute 65: Intel Drop #3 (regulator outreach + reporter inquiry).
- Minute 65–80: Go/No-go on disclosure; finalize holding lines & approvals.
- Minute 80–90: Hot debrief: wins, gaps, 30-day fixes.
| Decision | Owner | Time | Rationale |
|---|---|---|---|
| Notify insurer & use panel IR | GC | T+15 | Policy terms & coverage preservation |
| Employee memo timing | Comms | T+60 | Safety, rumor control, continuity |
H2 #4 — Debrief kit (optional deep dive)
Collect debrief data within 24 hours. Score each domain (0–5) and convert to a color heatmap for the board.
Privilege discipline, notice mapping, sanctions screen.
Score: 4/5
Containment speed, log capture, restore path.
Score: 3/5
Sequencing, clarity, consistency across channels.
Score: 5/5
Customer continuity, vendor coordination, executive alignment.
Score: 3/5
- Finalize sanctions checklist + counsel-approved ransom decision tree.
- Pre-approve holding lines; publish internal comms cadence SOP.
- Harden backup immutability; document surgical restore steps.
- Stand up a privileged evidence repository with access controls.
Examples/Models — ready-to-use snippets
Multiple file servers show extensions change; a note demands payment in crypto. EDR flags lateral movement overnight. Payroll vendor reports API timeouts affecting 20% of transactions.
- Scope & status (what we know/don’t).
- Business impact (downtime, customers).
- Legal posture (triggers, materiality).
- Comms plan (audiences, timing).
- Financials (vendors, exposure, insurance).
- Decisions needed in next 24h.
We detected suspicious activity affecting certain systems and activated our response plan. Please avoid external storage, report unusual emails to security@company, and follow MFA reset prompts. We will share updates at 10:00 and 16:00 daily.
Common mistakes to avoid
- Skipping timeboxes: discussion expands to analysis paralysis.
- Unprivileged channels: evidence and drafts scattered outside counsel.
- Misaligned narratives: different “facts” across audiences.
- No sanctions check: pay/no-pay talk without legal screen.
- Late employee comms: rumors and leaks fill the vacuum.
- Vendor sprawl: non-panel firms jeopardize insurance terms.
Conclusion
A crisp 90-minute tabletop builds reflexes you can trust. With a paced scenario, documented decisions, and a focused debrief, leaders practice the exact moves they’ll need on the worst day—faster alignment, better disclosures, and less damage. Put this kit on the calendar and run it quarterly.
Quick Guide — Executive Tabletop Kit (90 Minutes)
- Minute 0–5: Set roles (Incident, Legal, Comms, Exec), objectives, timeboxes, and “no hindsight” rule.
- Minute 5–10: Intel Drop #1 (service outage + suspicious artifact). Open privileged channel; launch evidence hold.
- Minute 10–20: Notify insurer (panel IR), law-enforcement touchpoint, define facts matrix (Confirmed/Probable/Under Investigation).
- Minute 20–30: Exec huddle #1: downtime, customer impact, restore options; decide update cadence.
- Minute 35: Intel Drop #2 (possible exfil + critical vendor dependency). Run sanctions screen; outline audience sequencing.
- Minute 35–55: Draft holding lines; prepare employee memo; map notice triggers by sector/state.
- Minute 55–65: Board questions rehearsal (materiality, cost, reputation, operations).
- Minute 65: Intel Drop #3 (regulator inquiry + reporter call). Approvals path; go/no-go on disclosure.
- Minute 65–80: Finalize decision register, owner, timestamp, rationale. Confirm next 24h plan.
- Minute 80–90: Hot debrief: wins, gaps, top fixes; assign owners and deadlines.
FAQ
1) How many people should be in the tabletop?
6–10 decision-makers: Incident Lead, GC/Legal, Comms, CIO/CISO, HR/Operations, and one Executive Sponsor. Observers are silent.
2) What materials do we prepare in advance?
Role cards, intel drops, decision register template, master narrative shell, employee memo shell, regulator letter shell, and a sanctions checklist.
3) How do we keep privilege intact during an exercise?
Run under counsel; use a privileged channel and label working drafts accordingly; keep scenario outputs in a privileged repository.
4) How realistic should intel drops be?
Include ambiguity: partial logs, third-party issues, conflicting signals. Each drop must force a timeboxed decision with incomplete data.
5) What are the success criteria for the session?
Decisions made on time, one narrative across audiences, clear owners for filings and comms, and a 30-day improvement list with deadlines.
6) How do we score performance?
Use a 0–5 rubric for Legal, Security, Comms, and Business impact; convert to a color heatmap for the board debrief.
7) How often should we run this?
Quarterly for leadership; semi-annual cross-functional drills for managers and call-center teams using the same artifacts and cadence.
Legal Grounding & References
- Sanctions & ransom pathways: U.S. guidance warns of sanctions risk for payments to blocked actors; document legality checks and alternatives under counsel.
- Public companies: Assess materiality promptly; if material, prepare a Form 8-K cyber incident disclosure within the required window after determination.
- Health data (HIPAA): Breach Notification Rule sets notice triggers and timelines for individuals, HHS, and sometimes media.
- Financial sector (GLBA / FTC Safeguards): Security program requirements and FTC breach-reporting thresholds may apply.
- State breach laws: Multi-state notice content/timelines vary; use a matrix with statutory cites and clock start conditions (acquisition vs. access/exfil).
- Insurance: Follow panel/vendor requirements; preserve coverage with timely notice and documented cooperation.
- Law enforcement: Early touchpoint recommended; maintain reference numbers and contact log for filings and insurer.
Final Considerations
Keep the session fast, realistic, and privilege-aware. Drive toward one facts matrix, one narrative, and timeboxed approvals. End with a short, owner-assigned plan that tightens disclosure discipline, backup recovery, and comms readiness before the next quarter.
Important Notice: This tabletop kit is general information to help executives practice coordination in crisis scenarios. It is not legal advice and does not create an attorney-client relationship. Laws, regulations, and disclosure duties vary by industry, state, and listing status and may change over time. Before acting, consult qualified counsel, your cyber insurer, and relevant authorities.