An incident response plan is essential for companies to act quickly and in a structured way when facing cyber threats. It guides how to detect, contain, and recover systems in critical situations, reducing damage and ensuring business continuity. 

This plan directly supports incident response, a broader process that combines practices and technologies to deal with threats, security breaches, or cyberattacks. According to the National Institute of Standards and Technology (NIST), in document SP 800-61 Rev. 2, incident response is divided into four phases: Preparation; Detection and Analysis; Containment, Eradication and Recovery; and Post-Incident. 

Understanding and applying these stages is fundamental, but just as important as knowing them is turning everything into practical actions. This is where the plan comes in: the piece that connects theory, responsibilities, and execution in decisive moments. Keep reading to learn more! 

What is an Incident Response Plan (IRP)? 

An Incident Response Plan (IRP) is the document that formalizes how to identify, contain, and resolve different types of attacks. An effective IRP helps contain threats, restore systems quickly, and reduce financial losses, fines, and other associated costs. 

The main components of an IRP include: 

Objectives and Scope 

Clear definition of the plan’s objectives and the types of incidents it covers. It is common to develop multiple response plans, each addressing different threats such as phishing, ransomware, DoS attacks, insider threats, or personal data leaks. 

Incident Response Team (CSIRT) 

Identification of the team members responsible for incident response, including their roles and responsibilities. 

Incident Classification 

Criteria to classify the severity of incidents and determine the appropriate response. At this stage, it is also possible to include a risk matrix to help classify the severity/impact of the incident. 

Detection and Analysis Procedures

Methods to identify and analyze incidents, including data and evidence collection. Tools such as EDR (Endpoint Detection and Response), NDR (Network Detection and Response), and SIEM (Security Information and Event Management) are crucial for event detection and log analysis during investigations. These tools provide enhanced visibility, allow event correlation, and help identify suspicious behaviors. 

Containment, Eradication, and Recovery 

Steps to contain the incident, eliminate the root cause, and restore affected systems and data. In this phase, incident response playbooks are applied to guide decision-making during the crisis. These playbooks provide detailed, specific procedures for different types of incidents, ensuring an organized response, minimizing impact, and speeding up recovery. 

Communication 

Plans for internal and external communication during and after an incident, including notifications to stakeholders and authorities as required by regulations (e.g., GDPR, LGPD). 

Documentation and Post-Incident Reports 

Processes to document the entire investigation (event chain and custody), lessons learned, and improvements to governance, policies, SOPs (Standard Operating Procedures), controls, and measures. 

What is a Tabletop Exercise? 

A tabletop exercise (TTE) is a practical simulation used by organizations to test and improve their incident response plans, emergency procedures, and crisis management capabilities. 

During a TTE, participants discuss hypothetical incident scenarios and make decisions based on existing plans and procedures. These exercises are conducted in a meeting room environment, without physically moving resources, allowing for a detailed and collaborative analysis of responses and actions. 

Objective of a Tabletop Exercise 

The main goal of a tabletop exercise (TTE) is to prepare teams for real emergency situations, ensuring that everyone knows their roles and responsibilities. 

By working in a controlled environment, participants can identify gaps in current plans, improve communication and coordination across departments, and develop a clear understanding of the procedures to follow. 

Benefits of Applying Tabletop Exercises 

• Gap Identification: Enables the detection of weaknesses and gaps in incident response plans without the risk of a real failure. 
• Improved Communication: Facilitates collaboration and communication across different departments and teams. 
• Hands-On Training: Provides a practical training environment where employees can apply their knowledge and skills in a simulated scenario. 
• Plan Enhancement: Supports the review and improvement of response plans, ensuring they remain updated and effective. 

Structure and Execution 

Every exercise should be designed following the best practices recommended in section “4. Tabletop Exercises” of the NIST SP 800-84 document. Each organization must define and develop scenarios to be tested based on previously established Incident Response Plans (IRPs). 

How Does a TTE (Tabletop Exercise) Work? 

There are four main points for effectively conducting the exercise: 

• Scenario Preparation: A hypothetical scenario is prepared, detailing a specific incident the organization may face. Usually, the chosen incident is aligned with an already developed incident response plan. 
• Participant Involvement: A group of employees is gathered, typically from different departments, who are part of the newly designed response plan. 
• Scenario Discussion: The scenario is presented, and participants discuss their actions and decisions based on existing plans and procedures. 
• Analysis and Feedback: After the discussion, the facilitators evaluate the responses and identify areas for improvement. The feedback is documented and used to enhance the tested response plan. 

Example Scenario 

Imagine a scenario where the organization faces a cyberattack that compromises sensitive data. During the exercise, participants discuss how to detect the attack, contain the threat, communicate with stakeholders, and restore affected systems. 

This exercise helps identify how the team reacts under pressure and highlights areas where the plans need to be strengthened. 

In summary, a tabletop exercise is an essential tool to ensure that an organization is prepared to face unexpected incidents in an efficient and coordinated way. 

Is your company prepared for the next incident? Get in touch with our specialists and find out how to structure or improve your incident response plan with practical tabletop exercises!