What is a tabletop exercise, and should the board take part?
A tabletop exercise is a guided discussion of a realistic incident, and yes, the board should take part at least once a year. A facilitator describes a scenario step by step, for example a ransom note on every screen on Monday morning, and the participants decide what they would do: who leads, who calls the insurer, when to report to authorities, whether to stop production, what to tell customers. No systems are touched. The value lies in finding gaps while they are cheap to fix: missing phone numbers, unclear authority to take decisions, backups nobody has tested. Write down the findings and who fixes each one. Real NetSenX alerts, with time, devices and destinations, make a good starting point for a scenario that fits your own network.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.