Tabletop Testing for Resilience

There are different test types to choose from, including:

• Tabletop tests: Employees participate in an actual exercise during a scenario-based, role-playing exercise. Everyone involved practices their roles and responsibilities during an emergency, such as an earthquake, hurricane, or active shooter.
• Plan reviews: Similar to a business continuity plan audit. The BCP team and the C-level management or department heads get together to review the plan and decide if any components are missing or need revision.
• Walk-Through/Simulation Tests: A simulation test combines real recovery actions, like data loss, restoring backups, live testing of redundant systems, network outage, physical recovery, emergency notification, and other relevant processes.

In this blog, we'll focus on tabletop testing. With guidance from Agility recovery manager Alysha Hester, we will explore what a tabletop test is, what scenarios it's best suited to address, and how you can use tabletop testing to enhance your organization's resilience. 

What Is a Tabletop Test?

A tabletop test is a walkthrough of an actual disaster scenario - like a hurricane, active shooter, or power outage - in real time. This walkthrough allows businesses to talk through reactions and strategies to ensure that department strategies are aligned with all areas of the organization.

The walkthrough also allows organizations to gauge individual teams' readiness levels if a disaster were to occur at that moment.

What Are Tabletop Tests Used For?

Organizations use tabletop tests to test for gaps in written continuity plans. They allow businesses to explore the scenario and identify any dark corners in those plans, providing the opportunity to answer any questions before experiencing an actual event.

Why Do Businesses Use Tabletop Tests?

Tabletop tests are useful for several reasons, including:

• Identifying recovery gaps in plans, resources, and communication strategies
• Implementing new training protocols for safety that are identified post exercise
• Meeting compliance requirements

According to expert Alysha Hester, "I would say the main reason businesses use tabletops is to deep dive into a specific potential disaster to determine findings that could be further explored after the exercise. Once a post-event investigation has been completed, plans would be updated accordingly (and then the cycle of testing starts over so you can explore if these new adjustments provided greater resilience during a disaster."

Pros and Cons of Tabletop Testing vs. Other Types of Tests

Why implement tabletop exercises instead of other types of tests and exercises? Ultimately, we advise utilizing all types of exercises, but tabletop tests are a great place to start.

Pros:

• Test the specific people and processes documented in your organization's BCP
• Can be done virtually to conveniently include all staff (including hybrid employees or third-party vendors/MSPs)
• Low- to no-cost option

Cons:

• Creating exercises internally can be extremely time consuming and take some creative thought. 

  For additional value, consider involving a 3rd party perspective in facilitation if you feel your tabletop exercises have become more of a check-the-box type of event or a BCP/incident response read-through.

  Alysha Hester
  Agility Recovery Test & Declare Manager

• Tabletop tests can't test the physical components of the recovery, so it still may be unknown if some IT and manual processes will function as expected at the time of the disaster as discussed in an exercise.

After the Tabletop Exercise

So you've completed your tabletop exercise - now what?

One of the most critical outputs of any test or exercise is identifying gaps and areas for improvement. These could include realizing there is no personnel redundancy, not knowing how to get in touch with remote employees, or not having enough people who know how to access important information.

Document this information and use it to update your organization's business continuity plan. Then, be sure to update your organization on any new plans and procedures. In doing so, you'll be more prepared for any interruption that may affect the business.

Ready to get started? Agility provides free tabletop exercise templates; we can also create a custom tabletop exercise and run it with your organization. Reach out to us today!