A cybersecurity tabletop exercise is a guided simulation for leadership, technical teams, and decision-makers to practice responding to an incident. These sessions create a safe, no-pressure environment to test decision-making, communication, and coordination across departments. By walking through realistic scenarios, teams can uncover gaps, strengthen their readiness, and build the confidence needed to respond effectively when a real incident occurs.
Before an incident occurs, organizations should develop a Cyber Incident Response Plan (CIRP). Make sure the CIRP covers more than just IT. The CIRP should be Top Down so that it addresses all the expectations and concerns of the management team. We’re also seeing Board of Directors involvement due to recent SEC guidance. If you are a public company, your corporate annual report is a good place to start. You should test the CIRP to make sure it meets the needs of the entire organization. This is usually accomplished by a tabletop exercise (TTX). These are an annual requirement if you are an audited entity. You should also maintain and update the CIRP regularly. This results in a “lessons learned” program. McCarthy Cyber Readiness helps you cover all these steps so you’re ready before the crisis hits.
Yes. Our Cyber Incident Response Plans (CIRP) and tabletop exercises (TTXs) are designed to align with leading compliance frameworks such as NIST, ISO, HIPAA, and CMMC. While compliance alone doesn’t guarantee readiness, our approach ensures you meet regulatory requirements while also strengthening real-world resilience. This means you not only check the boxes for audits, but also build a culture of preparedness that protects your organization from evolving threats.
We only do Cyber Incident Response Plans (CIRP) and the tabletop exercises (TTXs) necessary to test them. We’re not a software / hardware company that wants to offer a product on top of our services. We are not a forensics firm. Most of those firms deliver generic, IT centric CIRPs and TTXs. That’s where their expertise is.
We are different. While our CIRPs & TTXs address the IT concerns, we also focus on Top Down, Risk Based, and Business Due Diligence CIRPs & TTXs that prepare the entire organization for a cyber crisis. We leverage a decades old military methodology that custom builds your CIRP to address your specific needs. The last thing we’re going to do is recommend/lock you into a security appliance or service.
Just about every cyber security framework out there requires a TTX at least annually. NIST, FFIEC (which is going away), HIPAA, PCI, ISO27K are ones that immediately come to mind. There are a number of reasons you may want to conduct more frequent TTXs: your board wonders if your organization can respond to a cyber attack that has impacted a competitor or one is in the news and on their minds, changes/upgrades to either your technology infrastructure, regulatory requirements, or even contractual requirements from third parties you work with.
Over the last 10 years, we’ve conducted hundreds of management level tabletop exercises. One of the most obvious indicators that an organization is not ready for a crisis is when they ask that very question. The participants of your TTX should be listed in your CIRP because your CIRP has identified all of the potential risk scenarios that may impact your organization. The CIRP then needs to identify all the various requirements for those scenarios and who will be needed to satisfy each requirement.
This approach is called Requirements Driven Execution (RDE). It’s been used by the military for a very long time. We also leverage this when we write CIRPs. On the management side, the usual suspects should include: CEO, Legal, HR, Corporate Communications, Audit/Compliance, CFO, and Privacy (especially if a cyber incident involves a breach of PII). If you have cyber insurance (very important), the Risk Management person who manages the policy should be included. If you expect to involve law enforcement, identify someone for those circumstances. Finally, you need to identify someone who will represent and liaison with your business functions (Business Continuity). If you are publicly traded, someone from your Board may also want to be involved. (This is a new trend based on recent SEC guidance.) On the IT side, CIO, CISO, networking for containment, forensics, InfoSec for all the SIEM, threat & vulnerability issues, the infrastructure team, and Disaster Recovery (DR) if you want to ever recover. I’m probably missing one or two, but until you conduct a formal assessment in the form of a CIRP, we won’t know for sure. You should probably have all of this documented, too, if you worry about potential litigation.
IT and cybersecurity teams are vital, but incident readiness goes beyond technology. It requires alignment across leadership, legal, compliance, HR, operations, and communications to ensure the entire organization responds effectively.
If you can “think” it, you can “write” it. The goal of writing a CIRP is to ensure that you, the person who will lead the organization through a crisis, have thoroughly anticipated and researched your role prior to the actual crisis. No plan is 100% effective (or as the Marines say, “No plan survives first contact with the enemy”), but we should be able to address 80–90% of the “easy” stuff.
A CIRP addresses the following requirements:
Expectation management:
Your expectations of me and the CIRP:
My expectations of you (2–4 hours per week):
Defining the Risk Narrative:
Identify scenarios where these cyber risks may manifest (use cases).
Requirements-Driven Execution (RDE)
RDE = Requirements + Resources + Research/References.
This becomes the foundation of the Working Draft (WDv1) of the CIRP.
Refinement of WDv1
This phase may require multiple iterations (some clients have gone up to WDv13). Every increment takes about a week. Timelines vary depending on complexity.
Understanding the role of your cyber insurance
Cyber insurance is a key part of your IR strategy. Ensure coverage, vendors, and terms are understood and sufficient. The person managing insurance should be part of your CIRT.
Termination of the project:
Delivery of the Final Draft (after second invoice payment) initiates the final 40% invoice.
Total cost: $25,000
It is a rare privilege to have the opportunity to rehearse for a crisis. While TTXs are an annual requirement for every InfoSec framework, the opportunity to have the undivided attention of your Executive Management team, to update them with current threats, to see if any of their concerns have changed (assuming you already know their concerns), and to refresh the muscle memory of the team responding to crisis is invaluable.
I have been successful at the management-level TTXs because I invest a significant amount of time learning about my clients and helping them prepare for the TTX. My ultimate objective is to prepare your team to be successful during an actual crisis (i.e., give an “open book test”).
I offer three types of two-hour TTXs:
This can be either a formal TTX, or more of a coaching/teaching event.
Objectives typically include:
Objectives typically include:
Business-focused:
Objectives typically include:
The normal scope of this engagement is for two 2-hour TTXs at your location. I recommend one TTX before lunch, and one after. You can choose from the three choices above. I recommend a Top Down order for the TTXs: the BOD prior to the EMT, prior to the Technical. This way, we can ensure management considerations are fully understood/evaluated at each subordinate level.
If you have recently developed a CIRP with me, I recommend a TTX as a mechanism to review the CIRP, with the people identified in the CIRP as members of the Cyber Incident Response Team (CIRT).
I am also open to a two-day on-site session in which we address all three TTX options.
The following is a high-level project timeline for developing/executing your TTX. This timeline is by no means reflective of every TTX engagement. (I had one client wait for seven months to schedule the TTX because their CEO wanted all the actuals at the table.)
Expectation management:
Your expectations of me, and the TTXs:
My expectations of YOU (typically 2–4 hours per week):
Review your CIRP and any other relevant IR/Cyber Risk documentation:
Defining/Validating the Cyber Risk Narrative for the Organization:
Understanding the Role of your Cyber Insurance
Cyber insurance is an integral component of your IR strategy… (kept full description)
Development of the TTX
Upon completion of the TTX, I will provide you with:
Final Deliverables:
Total cost of the one-day TTX engagement: $17,000 (includes all travel expenses for 2 TTXs).
Total cost of the two-day engagement: $24,000 (includes all travel expenses for 3 TTXs).
Discounted price of both a CIRP development and a one-day TTX: $35,000
You can find full details on our workshops—including schedules, pricing, timelines, and what to expect—on our Workshops page.
