Incident Response Tabletop Exercises

You know your organization has a cyber incident response plan (IRP). That’s great. But could that knowledge be giving you a false sense of security? In Kroll’s experience working on thousands of cyber matters a year, we have seen crises intensify or escalate when organizations discover their IRPs are outdated or when key team members are not prepared to act according to plan. 

Practicing your IRP on a regular basis is key for validating or restoring confidence in your IRP. Kroll can help with customized incident response tabletop exercises (TTX) led by our seasoned experts. Participating in a Kroll TTX gives the members of your incident response team a valuable opportunity to clarify and rehearse their roles. Ultimately, they will have greater confidence to carry out their assigned duties in the event of an incident. Additionally, a TTX will highlight where guidance or information (e.g., contact information) needs to be updated. 

A Cyber or Physical Event Strikes Your Organization Today. What Do You Do First?

Kroll follows a seven-step process refined by our leading hundreds of tabletop exercises for client organizations of various sizes, complexity and industry sectors. 

• Kick Off the Process With Clear Communications 
  Kroll cyber and physical security experts will hold a call with all participants to provide an overview of the TTX methodology, what to expect during the interviews and a timeline for each step.  
• Interview Key Stakeholders
  Our cyber and physical security experts will conduct onsite meetings to identify each stakeholder’s duties and experiences with incident response. We will also focus on your overall cyber security concerns. These can include specific factors or vulnerabilities that you perceive within your organization, developments within your industry or another public incident. 
• Review Current Incident Response Plan and Other Documents
  Our in-depth review of your current incident response plan will focus on identifying gaps that will hamper or decrease the effectiveness of your response.  
• Develop an Incident Response Plan
  If your organization does not already have a plan, we will develop a unique incident response plan for your organization designed to help you effectively mitigate damage from a cyberattack. We will provide this plan to you and your management approximately one week prior to the onsite TTX.  In the event your incident has a physical component, Kroll’s business continuity and disaster recovery experts can also provide a well-structured plan with on-the-ground protocols to safeguard your staff, protect your data and maintain business function. 
• Create Custom Tabletop Scenarios
  We design these scenarios to encourage communication among all stakeholders. In this way, not only will everyone understand his or her responsibilities and how to respond, but also it will allow any gaps in your incident response plan to be surfaced, identified and resolved.    
• Facilitate the TTX
  In this discussion-based event, our cyber investigators will present four to six incident response tabletop scenarios customized for your organization in order to test the complete response plan. This exercise will give those involved an opportunity to experience an incident response in a stress-free, open environment. 
• Deliver Report
  We will review and provide the results and lessons learned from the exercise and deliver a final report that summarizes our discussions and recommendations. 

Know How You Will Respond to a Cyber Incident Before One Strikes

Take advantage of Kroll’s unrivaled cyber incident response experience to better prepare to respond to a cyber incident. To schedule a customized tabletop exercise for your team, contact a Kroll expert today.