# What is a tabletop exercise, and how do we run one?

A tabletop exercise is a meeting in which the people who would handle an incident talk through a realistic scenario step by step, without touching any system. A facilitator presents the situation in stages: an alert late in the evening, a ransom note on Monday morning, a journalist calling, the backup turning out to be encrypted too. At each stage the team says what it would do, who would decide and whom it would call. Ninety minutes with the managing director, IT, communications and whoever handles legal matters is enough. The value lies in the gaps you find: a phone number nobody has, a decision nobody is allowed to take, a log nobody keeps. Write them down and fix them, then repeat the exercise once or twice a year. A scenario based on a real alert or on a past incident teaches more than a generic one.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/what-is-a-tabletop-exercise

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What is the difference between an event, an alert and an incident?](https://netsenx.com/en/faq/difference-between-an-event-an-alert-and-an-incident)
- [How do we tell a real incident from a false alarm?](https://netsenx.com/en/faq/how-to-tell-a-real-incident-from-a-false-alarm)
- [How do we decide how serious an incident is?](https://netsenx.com/en/faq/how-to-decide-how-serious-an-incident-is)
- [Who makes the decisions during a cyber incident?](https://netsenx.com/en/faq/who-makes-decisions-during-a-cyber-incident)
- [What does management have to decide in the first day of a cyber incident?](https://netsenx.com/en/faq/what-management-decides-in-the-first-day-of-an-incident)