Incident Response Tabletop Exercises

Kroll’s field-proven incident response tabletop exercise scenarios are customized to test all aspects of your response plan and mature your program.
Contact Us

You know your organization has a cyber incident response plan (IRP). That’s great. But could that knowledge be giving you a false sense of security? In Kroll’s experience working on thousands of cyber matters a year, we have seen crises intensify or escalate when organizations discover their IRPs are outdated or when key team members are not prepared to act according to plan. 

Practicing your IRP on a regular basis is key for validating or restoring confidence in your IRP. Kroll can help with customized incident response tabletop exercises (TTX) led by our seasoned experts. Participating in a Kroll TTX gives the members of your incident response team a valuable opportunity to clarify and rehearse their roles. Ultimately, they will have greater confidence to carry out their assigned duties in the event of an incident. Additionally, a TTX will highlight where guidance or information (e.g., contact information) needs to be updated. 

A Cyber or Physical Event Strikes Your Organization Today. What Do You Do First?

Kroll follows a seven-step process refined by our leading hundreds of tabletop exercises for client organizations of various sizes, complexity and industry sectors. 

  • Kick Off the Process With Clear Communications 
    Kroll cyber and physical security experts will hold a call with all participants to provide an overview of the TTX methodology, what to expect during the interviews and a timeline for each step.  
  • Interview Key Stakeholders
    Our cyber and physical security experts will conduct onsite meetings to identify each stakeholder’s duties and experiences with incident response. We will also focus on your overall cyber security concerns. These can include specific factors or vulnerabilities that you perceive within your organization, developments within your industry or another public incident. 
  • Review Current Incident Response Plan and Other Documents
    Our in-depth review of your current incident response plan will focus on identifying gaps that will hamper or decrease the effectiveness of your response.  
  • Develop an Incident Response Plan
    If your organization does not already have a plan, we will develop a unique incident response plan for your organization designed to help you effectively mitigate damage from a cyberattack. We will provide this plan to you and your management approximately one week prior to the onsite TTX.  In the event your incident has a physical component, Kroll’s business continuity and disaster recovery experts can also provide a well-structured plan with on-the-ground protocols to safeguard your staff, protect your data and maintain business function. 
  • Create Custom Tabletop Scenarios
    We design these scenarios to encourage communication among all stakeholders. In this way, not only will everyone understand his or her responsibilities and how to respond, but also it will allow any gaps in your incident response plan to be surfaced, identified and resolved.    
  • Facilitate the TTX
    In this discussion-based event, our cyber investigators will present four to six incident response tabletop scenarios customized for your organization in order to test the complete response plan. This exercise will give those involved an opportunity to experience an incident response in a stress-free, open environment. 
  • Deliver Report
    We will review and provide the results and lessons learned from the exercise and deliver a final report that summarizes our discussions and recommendations. 

Know How You Will Respond to a Cyber Incident Before One Strikes

Take advantage of Kroll’s unrivaled cyber incident response experience to better prepare to respond to a cyber incident. To schedule a customized tabletop exercise for your team, contact a Kroll expert today. 


Application Security Services

Kroll’s product security experts upscale your AppSec program with strategic application security services catered to your team’s culture and needs, merging engineering and security into a nimble unit.

Optimized Third-Party Cyber Risk Management Programs

Manage risk, not spreadsheets. Identify and remediate cybersecurity risks inherent in third-party relationships, helping achieve compliance with regulations such as NYDFS, FARS, GDPR, etc.

Third Party Cyber Audits and Reviews

Ensure that your third parties are handling sensitive data according to regulatory guidelines and industry standards with our cyber audits and reviews.


CFIUS Compliance and Review

Helping organizations manage CFIUS, Team Telecom and FOCI requirements.