A tabletop exercise is a live, facilitated walkthrough of a real incident scenario, run against your actual business continuity plan (BCP), with the people who would genuinely be in the room during a crisis. It differs from a written BCP in one important way. A document sits untested until something goes wrong. A tabletop exercise finds the gaps before that happens.
Most UK SMEs have a business continuity plan filed away somewhere. Far fewer have tested it against a scenario that resembles a real incident: time pressure, incomplete information, and more than one system affected at once. That gap between having a plan and having a tested plan is what a tabletop exercise closes.
A tabletop exercise tests your plan against a live scenario rather than reviewing a document
A written BCP describes what should happen during a disruption. A tabletop exercise puts that plan under pressure by walking a group through a realistic scenario in real time, forcing decisions rather than descriptions.
The two exercises check different things. A document review confirms the plan is complete. A tabletop exercise confirms the plan actually works when the people relying on it are under stress and short on facts. Businesses that only ever do the first assume the second is also true. That assumption is rarely tested until it matters.
The right people need to be in the room, not just the plan
A tabletop exercise only works if it includes the people who would genuinely be involved in a real incident: department leads, whoever holds the key client relationships, and whoever has the authority to make a call without waiting for someone unavailable to sign off. Leaving out a key decision-maker during the exercise means leaving out the exact gap that would surface during a real event, at the worst possible moment to discover it.
Realistic scenarios reveal gaps a written plan cannot
A tabletop exercise is only as useful as the scenario behind it. Generic disaster scenarios – fire, flood, a vague “cyber incident” – rarely resemble what actually happens to a UK SME. The scenario needs to reflect incident types a business is genuinely likely to face:
- Ransomware during a deadline. Systems lock up the day before a client deliverable is due, forcing a decision between paying, restoring from backup, or missing the deadline entirely.
- Compromised devices. A laptop or phone is confirmed compromised, and the plan has to cover isolating it, assessing what it had access to, and deciding who needs to be told.
- Supplier or SaaS outage. A critical supplier or platform goes down without warning, and the plan has to cover which processes stop, which continue, and how clients are kept informed.
- Business email compromise. An attacker gains access to a mailbox and starts sending convincing but fraudulent instructions, and the plan has to cover verifying identity before anyone acts on a request.
Running each of these as a distinct scenario, rather than one generic drill, is what surfaces the specific gaps a written plan cannot show on its own.
Would your team know what to do if one of these happened tomorrow?
Dr Logic can run a tabletop exercise built around scenarios like these, before one of them becomes real.
Your first real test should not be your first real crisis
Running a tabletop exercise before an incident means discovering what does not work while the stakes are still manageable. Running it for the first time during a genuine crisis means discovering it at the worst possible moment, with clients waiting and no time to fix it.
What typically surfaces in a first exercise
Most first exercises turn up a similar pattern. A decision-maker assumed to be available turns out not to be. A step in the plan depends on a system that is itself affected by the scenario being tested. Nobody has actually confirmed how quickly a supplier, insurer, or IT partner can be reached outside office hours. None of these gaps is visible on paper. All of them are visible within the first ten minutes of a live walkthrough.
How often to repeat the process
An annual exercise is a reasonable minimum for most SMEs, with an additional session whenever the business changes in a way that affects the plan: a new office, a new critical supplier, a change in who holds key decision-making authority, or a near miss that suggests the existing plan has not kept pace.
Written plan or live exercise: what each actually delivers
| Aspect | Written BCP document | Tabletop exercise |
|---|---|---|
| What it tests | Whether the plan is complete on paper | Whether the plan holds up under real pressure |
| Who is involved | Whoever wrote or approved it | Everyone who would genuinely respond to a live incident |
| What it produces | A document | Named gaps, with owners and fixes |
| Typical frequency | Reviewed occasionally | Run at least annually |
For most Mac-first UK businesses, a tabletop exercise costs a half day of senior time and surfaces gaps a written plan review never will. In Dr Logic’s experience, the businesses least prepared for a real incident are rarely the ones without a BCP. They are the ones who assume a plan they have never tested will hold up when it actually matters, and only find out otherwise once the pressure is real.
This is worth treating as a standing item on the IT strategy calendar rather than a one-off project. A plan that was tested two years ago against a scenario the business no longer faces is not much more reliable than no plan at all.
If your business continuity plan has not been tested against a live scenario, Dr Logic’s IT strategy team can run a tabletop exercise built around the incidents your business is genuinely likely to face, and turn the gaps it surfaces into a plan you can actually rely on.
Related articles
- Business Continuity Planning for SMEs: More Than Just Backups
- Building an IT strategy for Apple-first or hybrid businesses
- The IT satisfaction gap: why businesses overestimate how happy their teams are with tech
FAQs
What is a BCP tabletop exercise?
A BCP tabletop exercise is a facilitated, live walkthrough of a realistic incident scenario, run against a business’s actual continuity plan with the people who would respond to a genuine event. It tests whether the plan works under pressure, not just whether it is complete on paper. Most exercises run for two to three hours.
How is a tabletop exercise different from a written BCP?
A written BCP is a document describing what should happen during a disruption. A tabletop exercise puts that document under pressure by forcing real decisions against a live scenario. The document confirms a plan exists. The exercise confirms the plan actually works when people are under stress and short on facts.
Who should take part in a tabletop exercise?
Department leads, anyone holding key client relationships, and anyone with the authority to make decisions without waiting for an unavailable colleague to sign off. Leaving out a genuine decision-maker leaves out the exact gap most likely to surface during a real incident.
How often should a business run a tabletop exercise?
Annually is a reasonable minimum for most SMEs. An additional session is worth running whenever the business changes in a way that affects the plan, such as a new office, a new critical supplier, or a change in who holds decision-making authority.
What kind of scenarios should a tabletop exercise cover?
Scenarios should reflect incidents a business is genuinely likely to face rather than generic disaster planning. Ransomware during a deadline, a confirmed compromised device, a supplier or SaaS outage, and business email compromise are realistic starting points for most UK SMEs.
