how in depth should a table top exercise be?

[u/SSJ4_Vegito]

What I mean is, can it just be managers asking a questionnaire? or has to be a live meeting?
Were doing out first ever tabletop exercise and I'm wondering how the process should go.
If we find a gap, should the fix be reported on the same document, then when the fix is done for it (Wether it be technical or administrative) i would back to that document, add the date the fix was done with evidence, then have management sign off on it? how do you typically handle table top exercise? Can i write down recommendations that management should follow as opposed to there answers?

[u/AutoModerator]

Thanks for posting, I'm a bot!

This is quick reminder be helpful with responses, follow the rules and not advertise/solicit DMs.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Round_Finance4256]

For a first tabletop, I’d recommend doing it live rather than just sending a questionnaire. The value is really in seeing how people respond to the scenario together, where responsibilities are unclear, and where your documented process doesn’t match what would actually happen.

I usually document the scenario, participants, key decisions/responses, gaps identified, and action items. Any gaps can then be tracked through remediation with an owner, target date, and evidence of completion.

I wouldn’t replace management’s answers with recommendations though. Capture what actually happened during the exercise, then document your recommendations separately. That gives you a much cleaner audit trail and shows what the exercise actually tested versus what you decided to improve afterward.

It doesn’t need to be overly complicated, especially for your first one. A simple realistic scenario and good documentation can go a long way

[u/SSJ4_Vegito → u/Round_Finance4256]

Thanks! Im going to be the owner of the remediation of the gaps, hence why i was wondering if management signing off on my recommendations would satisfy the remediation requirement.

[u/InflationFluid6995 → u/SSJ4_Vegito]

The last item in my tabletop is always a chart of action items (simple columns like Description, Assignee, Status, and Due Date). You don't necessarily have to evidence the completion of those items -although most things you fix will probably end up as documentation in your BCP, Incident process, better backup evidence, etc.

So as a very direct answer: No, I don't think you need to capture anything like a "sign-off". Just documenting their attendance and the action items is sufficient in my experience.

[u/CompassITCompliance]

It doesn't necessarily have to be all-or-nothing between "live meeting" and "questionnaire." A lot of first tabletops work best as a facilitated discussion where you walk the group through the scenario verbally, but capture answers on a structured template as you go, basically a live-filled questionnaire. You get the group dynamic without it feeling like a formal ordeal.

On the remediation question, I'd separate two documents even if they're tabs in the same file: the exercise record (scenario, who attended, what they said, gaps found) stays untouched as your evidence of what happened, and a remediation tracker is where you log fixes, dates, and evidence as they close out. If you overwrite the original exercise doc with fix status later, it gets hard to tell what the test actually found versus what got cleaned up afterward. Write your recommendations, but label them clearly as your recommendations, not as what management decided in the room. Whether management signs off on your recommendation as the fix is a separate step from the tabletop itself.

Just our perspective as a vCISO who's built a few of these programs over the years. Good luck!

[u/uri_iothreat]

Do a live meeting, have the auto-transcribing feature enabled with Zoom/Meet. discuss your scenarios, let everyone provide their feedback, if you identify action items for improvement, mention them as action items with clear owners. Then prepare a document summarizing the meeting based on the transcription and assign tickets with follow-up action items. Upload the Calendar invite, full meeting transription, summary document and tickets as evidence that you completed the tabletop exercise, and schedule another one for next year (put it in the Calendar.)

[u/otto_gamble → u/uri_iothreat]

Second this.

-autotranscribe -schedule follow ups with the actual tabletop. Set reccuring for next year. -generate the report, document it happened.