What to Do After a Cyber Tabletop Exercise

After a cyber tabletop exercise, the step before closing the action list is to write one change that requires testing the first alert handoff again.

In Cyber Storm V, 85% of after-action questionnaire respondents had cyber incident response plans. Yet the official report recorded confusion about external information-sharing thresholds. This was a distributed operational exercise, rather than a discussion-only tabletop. Its findings show why a completed plan must specify when a handoff needs another test.

A cyber tabletop exercise is a guided discussion of how people would respond to a simulated cyber incident, using their plans and assigned roles.

A tabletop reveals who must hand information to whom

A useful tabletop makes an incident response plan easier to challenge. An analyst explains what would prompt an alert. A service owner explains who can stop an affected service. An executive explains what information would support that decision. Participants can identify missing contacts and conflicting duties without disrupting a working system.

NIST SP 800-84 describes the follow-up: capture observations in an after-action report, then use recommendations to update the plan. This gives the exercise a practical result. The report can preserve a disagreement that would otherwise disappear when participants leave.

Record the handoff that stalled. Replace a finding such as “improve communications” with the exchange that needs fixing. For example, write that the analyst could not identify who would approve suspending a customer service. Record the missing approval route and assign the correction to someone who can change it.

Include what the receiving person needs. A technical alert might identify an affected account but omit which customer service depends on it. The receiver might need that connection before approving an interruption. The report should capture that missing information, rather than merely add another person to the distribution list.

Keep agreement separate from demonstrated performance. Participants might agree that they would use an alternate communications channel. That agreement does not show that duty staff can sign in or reach the approver through it. Record exactly what the discussion established and what still needs a practical check.

This distinction matters for incidents that need executive decisions. Technical staff must know when an operational problem requires someone with wider authority. The executive must receive enough information to act.

Ask the three receivers to check the same proposed handoff. Their different needs can expose an incomplete correction. This is part of leadership under pressure: deciding who needs which facts before someone must make a consequential choice.

Your cyber tabletop agreed who sends the alert. What change would make that handoff fail? Start the Walk →

What changes would make the rehearsed handoff unreliable?

An action list records work to finish. It can say that a contact was added or a procedure revised. It may say nothing about the conditions under which those changes remain usable. The next problem can arise after every action has been marked complete.

Watch changes to people, access and tools. Consider a proposed alert route through a shared incident workspace. It depends on the duty analyst having access, the approver receiving the alert and both people recognising the request. A new identity provider could change sign-in requirements. A changed duty rota could put an unfamiliar person in either role.

Write a retest condition beside that route: if responder sign-in rules change, test access with the current duty account before relying on the workspace. This is a proposed local rule, not a universal standard. Choose a condition that someone can observe through normal change management.

Check the assumptions behind the handoff against its last test. If the test used an administrator account, it may say little about access for an ordinary duty analyst. Write that limitation beside the result. A later access change should prompt a check with the person and account expected to respond.

Connect the trigger to an existing record. The identity change ticket can prompt the check. A staffing change can prompt a contact and authority check. A new incident platform can prompt a notification test. This avoids creating a separate monitoring system for information the organisation already has.

NIST SP 800-84 recommends exercises after relevant organisational changes or plan updates, as well as periodic exercises. The practical question is which part of the response those changes affect. Repeating the whole tabletop can miss a broken sign-in route that a short access test would expose.

Choose a test that can answer the question. Discussion can establish who should authorise containment. It cannot establish whether a disabled corporate identity will still permit emergency access. That question needs a controlled test of the access route. Protect working systems and agree the limits before attempting it.

The same distinction applies to outsourced monitoring. If the provider changes its notification process, check how an alert reaches the current recipient. If the service owner changes, rehearse the approval exchange. Monitoring a decision means checking the conditions behind it, including conditions that change without an incident.

Cyber Storm V: response plans versus sharing thresholds

Cyber Storm V involved more than 1,200 participants. Live play ran from March 8 to March 10, 2016. An exercise hotwash followed on March 11. Players operated from distributed locations. This case concerns operational exercise findings, not evidence that a tabletop alone proved response capability.

The report identified unclear thresholds for external sharing, uncertainty about recipients and confusion over available mechanisms. Some departments shared information internally but did not reach other departments. This left an incomplete view of impacts and contributed to separate response actions.

The relevant lesson for tabletop follow-up is to make the information exchange specific. A plan can name a reporting route while leaving its activation condition unresolved. The next exercise should examine whether the sender and receiver interpret that condition consistently.

Test the point where another team must act. A proposed local follow-up could use a sample alert about suspected misuse of a privileged account. Ask the receiving service owner what additional facts would support a containment decision. Record whether the alert identifies affected services, current uncertainty and the person authorised to approve the response.

This proposed exercise would not reproduce Cyber Storm V. It would apply its documented information-sharing lesson to a smaller cyber handoff. A team could then test the actual notification route separately. Neither result should be presented as proof that all incident communications will work.

A general crisis exercise review asks whether the scenario left important matters untested. The narrower task here is to preserve each cyber handoff as people and systems change. Check which later change would invalidate the evidence already collected.

Attach a retest trigger to each critical handoff

Start with the handoff whose failure would most delay a response decision. Keep its record beside the existing action in the improvement plan. State the sender, receiver, required information, last test and the change that requires testing it again.

Name the person who notices the change. An incident response lead can own the handoff, but may not approve identity changes or staffing decisions. Assign the identity administrator or team manager to notify that lead when the relevant condition occurs. A trigger without a route to its owner will not reliably prompt action.

Specify what the owner does next and who receives an unresolved failure. For an access change, the owner could arrange a controlled sign-in and notification test. If it fails, escalate to the person authorised to approve an alternate route. Give that person the affected handoff and the remaining limitation.

NIST SP 800-61 Revision 3 includes exercises involving relevant third parties and calls for incident response plans to be maintained and improved. Where a supplier owns part of the exchange, include its current contact and service arrangements in the retest.

Close a correction with evidence of its use. A revised document can close a wording problem. An observed alert reaching the intended receiver can close a delivery problem. Keep the test date and its limits. If an important condition changes, reopen that evidence before depending on it.

The Universal Decision-Making Method connects a decision to what must be monitored after implementation. After a cyber tabletop, that means specifying what will prompt another check. The completed action list should tell the next duty team when its tested handoff needs testing again.

Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.