Tabletop Exercises



According to the National Institute of Standards and Technology (NIST):

“Although it is important to have plans in place to help an organization respond to and manage various situations involving information technology (IT), it is equally important to maintain these plans in a state of readiness. This includes having IT personnel trained to fulfill their roles and responsibilities; having plans exercised to validate their policies and procedures; and having systems tested to ensure their operability.”


Let’s get you ready.

Tabletop Exercises

What is a Tabletop Exercise?

The purpose of a Tabletop Exercise is to ensure your organization is wholly prepared to respond to a real-world negative or malicious incident that would otherwise pose a significant threat to your daily operations, sensitive data, customer confidence, and/or organizational reputation. 

The approach of a Tabletop Exercise involves a disaster simulation and “tabletop” discussion about how to respond.

The benefits of such an exercise include clarifying roles, responsibilities, and procedures that can help expedite effective response and recovery in the event of a real incident, while minimizing operational disruption and costly consequences. 

The general flow of a BAI Security Tabletop Exercise is…

1. We gather with your key emergency management personnel and present a realistic emergency scenario.

2. In the course of your team’s discussion about their response, we evaluate your organization’s practical readiness to effectively deploy response and recovery procedures against NIST and FFIEC standards, as well as your own response plan.

3. The results of the Tabletop Exercise reveal specific gaps in critical policies and procedures that could undermine an effective response, and subsequently exacerbate negative consequences.

4. We conclude with custom recommendations that allow your team to proactively address weaknesses and improve your organization’s ability to swiftly and effectively respond to a real incident.

All evaluations below are based on FFIEC and NIST standards and are available as independent services or as options within our IT Security AssessmentIT General Controls Audit or HIPAA Security Risk Assessment

These vital evaluations also grow with your organization. Select what fits your needs now, with the freedom to change year-to-year as your security and compliance priorities mature. 

Incident Response

An effective response to a negative incident can be the difference between a brief outage and significant losses.

This exercise tests your organization’s readiness to quickly restore operations. We will sequentially address six (6) major response areas to uncover gaps and provide recommendations for more effective incident handling.

Business Continuity

Prepare for a real-world incident in the safety of a “no-fault” learning environment.

This simulation helps your Business Continuity Team identify gaps in policies and procedures for incident handling, internal coordination, and information sharing. You can then integrate new learnings about best practices into emergency plans and operations.

Disaster Recovery

Put your Disaster Recovery Team to the test with this low-cost, low-risk simulation.

This tabletop exercise is a highly effective way to proactively assess emergency plans. We will help you identify operational gaps across eight (8) key recovery areas and provide custom recommendations that allow your team to shore up their ability to effectively rebound from a real incident.


Meet the Team Still Shot