"Run a cyber drill this year" tends to land on the IT lead, the CISO or whoever owns compliance. Most people first think of a phishing simulation or a backup restore test, but what usually stalls a real incident is not the technology. Ransomware turns up in the middle of the night: who has the authority to cut off the whole network? Who calls the insurer, the police and the regulator, and how soon? When company email and chat are unusable, how does everyone reach each other? A tabletop exercise takes these questions to a meeting table and plays them out before an incident does it for you.

This article is for anyone asked to run one for the first time. It explains how a tabletop exercise differs from other drills and what Taiwan's current rules say about exercises, then covers how to set up the scenario, injects and participants, which questions the exercise has to force, and how to review and follow up afterwards.

What a tabletop exercise is, and how it differs from technical drills

NIST SP 800-84 divides the activities that keep IT plans (incident response plans, continuity plans and the like) workable into three types[1]:

  • Tests: use quantifiable metrics to validate that a system or component works in the environment the plan specifies; they often focus on backup and recovery operations[1]. Backup restore tests belong here; see The 3-2-1 backup rule.
  • Training: informs people of their roles and responsibilities in the plan and teaches the related skills[1].
  • Exercises: simulate an emergency to validate whether aspects of a plan are viable, revealing gaps and inconsistencies in plans and procedures and showing where people need more training[1].

Exercises come in two kinds. A tabletop exercise is discussion-based: a facilitator presents a scenario and asks questions that lead participants to discuss roles, responsibilities, coordination and decision-making, with no equipment or other resources deployed. A functional exercise has people carry out their roles in a simulated operational environment, for example communications, emergency notification or equipment setup[1]. FEMA's exercise doctrine defines a tabletop exercise in similar terms: a discussion in response to a scenario, meant to identify strengths and areas for improvement or to change how people understand plans, policies and procedures[2].

Put another way, a phishing drill tests whether employees click (see Social engineering drills), vulnerability scans, penetration tests and red teaming test whether defenses have holes (see Vulnerability scanning vs. penetration testing), and a restore test checks whether backups work. A tabletop exercise tests people and process: whether the division of work in the response plan is workable, who holds decision authority, and whether information reaches the right people at the right time. No amount of technical testing covers this.

SP 800-84 was published in September 2006 and is still listed on the NIST site as the final version, with no revision or withdrawal noted[1]. SP 800-61 Rev. 3, published in April 2025 to supersede Rev. 2, rates "improvements are identified from security tests and exercises" as a high-priority item, notes that incident response exercises prepare staff and third parties such as critical service providers for future response, and points readers to SP 800-84 for tabletop discussions and other forms of exercise[3].

Why bother: what Taiwan's rules require

The following summarizes the texts as of 14 November 2026 and is not legal advice; your sector's central competent authority may impose additional rules.

Specific non-government agencies under the Cyber Security Management Act

Critical infrastructure providers, state-owned enterprises, certain government-funded foundations and others covered by the Cyber Security Management Act (scope in Taiwan's Cyber Security Management Act) need to watch two sets of regulations:

  • Regulations on Reporting, Response and Drills for Cyber Security Incidents (formerly the Regulations on Reporting and Response to Cyber Security Incidents; the Ministry of Digital Affairs amended the title and full text on 5 January 2026, effective on promulgation[4]): each organization's reporting procedures must cover the process and authority for classifying an incident, assessment of scope and damage, the internal reporting flow, how other affected organizations are notified, and drills of those items; its response procedures must cover the organization of the response team and "drills before an incident occurs"[5]. A specific non-government agency must report an incident within one hour of becoming aware of it, in the manner its central competent authority designates, and must take part when that authority plans social engineering drills, reporting and response drills, cyber attack-and-defense drills, scenario drills and the like[5].
  • Regulations Governing the Classification of Cyber Security Responsibility Levels (amended 7 January 2026; the amendments took effect on promulgation): under the schedules of required tasks, a level A specific non-government agency must run a business continuity plan exercise for all core systems once a year, and level B and C agencies once every two years; the schedules for levels D and E contain no such item[6].

The often-quoted "social engineering drill every six months, reporting and response drill every year" comes from Article 10 of the drills regulation, which governs exercises within the government system, planned by the Presidential Office, the National Security Council, the five Yuan and their directly subordinate agencies, and municipal and county governments[5]. It is not a direct obligation on companies. None of these texts prescribes the form an exercise must take, and the items the reporting procedures must drill, such as who classifies the incident, how it is reported internally and who notifies affected parties, are exactly what a tabletop exercise tests best.

Listed and OTC companies

The Taiwan Stock Exchange published a revised version of its Cybersecurity Control Guidelines for Listed and OTC Companies in November 2026; the table of amendments is dated 9 November 2026[7]. Three articles concern exercises[8]:

  • Article 10: maintain a business continuity plan for core business and exercise it regularly, covering backup arrangements, staff responsibilities, response procedures, resource allocation, and review and improvement of the results.
  • Article 31: run an email social engineering drill every year.
  • Article 35: set incident response and reporting procedures, and "regularly conduct response exercises to verify their effectiveness". That clause is new in this revision; the table of amendments says it draws on the reporting, response and drill requirements of the Regulations Governing the Classification of Cyber Security Responsibility Levels[7].

At the time of writing, the TWSE regulations database still shows the version amended on 10 September 2024, in which the corresponding article has no exercise clause[9]. Article 44 of the guidelines says that, unless laws or TWSE and TPEx rules provide otherwise, companies may adopt the guidelines "as appropriate" to their industry, size and risk; the general provisions also state that the guidelines exist to help companies meet the controls for computerized information systems in Article 9 of the Regulations Governing Establishment of Internal Control Systems by Public Companies[8]. Listed companies should always build the material information decision into the exercise; the criteria are in Material information disclosure for cyber incidents.

Designing the exercise: objectives, scenario, injects and participants

Write down the objectives first

SP 800-84 says a tabletop exercise should aim to validate the content of the plan, participants' roles and responsibilities in it, and the interdependencies it documents[1]. FEMA's doctrine recommends a reasonable number of objectives, each specific, measurable, achievable, relevant and time-bound (SMART)[2]. For a first exercise, two or three are enough, for example:

  • Confirm who can declare a cyber incident, who can approve cutting network connections or taking core systems offline, and who deputizes for each.
  • Confirm who is responsible for external notifications (regulator, TWCERT/CC, insurer, police) and internal reporting, and the deadlines for each.
  • Confirm how the response team communicates when company email and chat are unusable.

Pick a scenario grounded in your real risks

Start from the risks your company actually faces, not the most dramatic story. SP 800-84 cautions that a short, concise scenario is usually more effective than a long, detailed one; with long scenarios, participants spend more time dissecting the scenario than meeting the exercise objectives[1]. Good starting points for Taiwan companies:

  • Ransomware with data theft: files are encrypted and the attackers claim to have taken customer data and threaten to publish it. Response steps are in After ransomware encrypts your files and The ransomware attack chain.
  • A compromised mailbox leading to a fraudulent transfer: the finance manager's mailbox is taken over, and a customer pays into a "new account" before anyone notices. Material is in Compromised company email account and Phishing and business email compromise.
  • A vendor breach: the IT provider that handles remote maintenance, or a software supplier, is hacked and your environment may be affected. Background is in Supply chain attacks.
  • Ransomware discovered over a long holiday weekend: the same ransomware, but found in the early hours of the first day off, with executives abroad and vendors not answering. This version is especially good at testing on-call arrangements, delegated authority and whether the contact list is reliable.

If you would rather not start from scratch, look at CISA's Tabletop Exercise Packages (CTEP). CISA says more than 100 are available, each customizable, with template objectives, scenarios and discussion questions, plus templates for the invitation, slide deck, post-exercise feedback form and after action report[10]. Cybersecurity packages cover ransomware, vendor supply chain compromise, executives and senior leadership, financial services, information technology and other topics, and are downloadable as Word files[11]; CISA's ransomware guide also lists the packages among its no-cost resources[12]. They are written around US agencies and law, so replace the notification targets, deadlines and contacts with Taiwan's before use.

Write three to five escalating injects

An inject is a new development introduced partway through the exercise to move the story along and force the next decision. SP 800-84 describes injects as pre-scripted messages handed to participants during the exercise, by email, letter, phone call and so on, and says there should be enough to keep participants occupied but not so many that they become overwhelmed[1]. Using the holiday ransomware scenario:

  1. Saturday 02:00: the on-call engineer gets an EDR alert; large numbers of files on the file server have been renamed. Questions: who gets woken up? Who decides whether to disconnect the network?
  2. Saturday 06:00: unusual VPN logins are found, and the backup server is unreachable. Questions: should the VPN be shut off? If the person with approval authority cannot be reached, who can act for them?
  3. Saturday 10:00: the chairman receives a ransom note with a sample of customer data attached. Questions: who calls the insurer and an outside incident response firm? Do you report it to the police? When do you notify the regulator?
  4. Sunday 15:00: a journalist calls, and customers are posting on social media. Questions: who speaks for the company? What is said and what is not?
  5. Monday 06:00: systems are still down. Questions: for a listed company, is a material information announcement needed, and who decides? Do staff come to work as usual today?

Who must be in the room

SP 800-84's principle is that participants should be the people with roles and responsibilities in the plan, and that senior leaders should attend when the main objective is to validate decision-making and oversight[1]. The response roles in SP 800-61 Rev. 3 go beyond technical staff to include leadership, which may hold decision authority over shutting down or rebuilding critical services, legal, public affairs and media relations, human resources and others[3]. For a Taiwan company, at minimum:

  • IT and security: to say what can be done now and how long it will take. If the SOC or operations is outsourced, invite the provider's contact too.
  • A manager with decision authority: the president or an authorized deputy. Without someone who can make the call, the discussion stops at "we will need to check upstairs".
  • Legal: notification duties, contractual liability and evidence preservation.
  • PR or the spokesperson: external statements and media handling.
  • Finance: estimating losses, contacting the insurer, and handling payment and transfer anomalies.
  • For listed companies, whoever handles material information announcements: depending on how duties are split, the spokesperson, finance or the shareholder services unit.

The exercise itself needs two staff roles: a facilitator who leads the discussion and steers it back to the objectives when it drifts, and a note-taker who records the discussion and observations. Both should know the response plan and the exercise objectives well[1]. SP 800-84 also notes that participants are usually not seated with their own teammates, to encourage independent thinking and exposure to other parts of the organization[1]. The facilitator should preferably not be the most senior person in the room, or everyone tends to wait for that person's view.

Duration and lead time

SP 800-84 says tabletop exercises typically run two to eight hours, with senior-level sessions usually two to four; senior and operational teams should first exercise separately, then together to validate coordination between them[1]. Planning should start at least one month ahead for simpler exercises and at least three months for large, complex ones, and management approval should be obtained when scheduling[1]. For a first exercise, use a single scenario with three to five injects and keep it to about two hours, which makes it far easier to get decision-makers to stay for the whole session.

Questions the exercise has to force

A good tabletop exercise ends with an answer to every question, or at least a named person responsible for finding one. These are the ones that most often stall:

  • Who declares this a cyber incident? In SP 800-61 Rev. 3, an incident is declared when adverse events meet the defined incident criteria[3]. Write the criteria and the authority to declare down in advance, or nobody may dare to say "this is an incident" until Monday. Organisations under the Cyber Security Management Act already have to set out the process and authority for classifying incidents in their reporting procedures[5].
  • Who can approve taking systems offline? SP 800-61 Rev. 3 notes that response policies typically define roles, responsibilities and authorities, such as which roles may confiscate, disconnect or shut down technology assets[3]. Push for named people and an order of deputies: if the decision-maker is abroad or unreachable, who makes the call?
  • Who notifies whom, and how quickly? SP 800-61 Rev. 3 recommends following established procedures on what must be reported to whom and when, and having designated individuals notify law enforcement and regulators based on criteria in the response plan and management approval[3]. List an owner and a deadline for each party during the exercise: organizations under the Act have a one-hour reporting deadline[5]; the insurer's notification window depends on the policy; for listed companies, the material information deadlines are in Material information disclosure; reporting channels for other companies are in The first 24 hours of a suspected breach. CISA also lists the cyber insurance company among the stakeholders to engage during an incident[12].
  • What is the out-of-band channel? CISA advises coordinating isolation through out-of-band methods such as phone calls so attackers are not tipped off[12]. Decide in advance which group and which phone numbers the response team uses when the company domain and internal chat cannot be trusted.
  • Where is the contact list? CISA advises keeping a hard copy and an offline version of the response plan[12]. Ask directly during the exercise: "Email is down and the file server is encrypted. Who has the phone numbers for executives, vendors, the insurer and the lawyers?"
  • Do we pay the ransom, and who decides? This does not need a conclusion on the day, but everyone should know who decides, on what information, and when legal and the insurer get involved.

After the exercise: hot wash, report and follow-up

Hold a hot wash as soon as the exercise ends: the facilitator asks participants where they did well, where they need more training and which parts of the plan need updating[1]. FEMA's doctrine likewise places the hot wash immediately after the exercise and feeds what it surfaces into the after action report[2].

Then write an after action report, ideally within two weeks. SP 800-84 recommends that it set out the exercise's purpose, objectives, participants and scenario, record the facilitator's and note-taker's observations, and recommend improvements to the response plan[1]. FEMA goes further and turns the findings into an improvement plan listing each corrective action, the responsible party and a completion timeline, tracked and reported until done, with a way to validate that completed actions actually work[2]. The most direct validation is to build last time's gaps into the next exercise's scenario and test them again.

Common failure modes

  • A script where everything goes well: backups always restore, executives always pick up, every inject has a textbook answer. Deliberately include situations that will make people stuck.
  • Only IT attends: an IT-only run cannot reveal the gaps between legal, PR, finance and the decision-makers, which are exactly the gaps a tabletop exercise exists to find.
  • No follow-up: the report is filed, the gaps have no owners or deadlines, and next year's exercise finds the same problems.
  • Treating it as an exam: participants who fear being graded give only textbook answers. FEMA recommends reminding participants that they are making decisions in a no-fault environment[2]; the facilitator should say at the outset that the plan is being tested, not the people.

Action checklist

  • Confirm which requirements apply: whether you are a specific non-government agency under the Cyber Security Management Act and at what responsibility level; listed companies should check Articles 10, 31 and 35 of the cybersecurity control guidelines.
  • Get approval from the president or decision-maker, set a date, and start preparing at least a month ahead.
  • Write two or three exercise objectives and choose a scenario grounded in your real risks.
  • Write three to five escalating injects, each paired with the decision questions it should force; CISA's CTEP packages are a good base to adapt.
  • Invite IT, a decision-making executive, legal, PR and finance, plus whoever handles material information for listed companies; appoint a facilitator and a note-taker.
  • Use your current response plan, contact list and reporting procedure in the exercise rather than a separate "exercise" version.
  • Hold a hot wash right after the exercise, finish the after action report within two weeks, and give every improvement item an owner and a deadline.
  • Track progress on improvements regularly, and build last time's gaps into the next exercise's scenario.
  • If you need outside help designing or facilitating an exercise, see our incident response service.