For some, Severe Weather Awareness Week kicks off next week! (If you are not sure when your state’s preparedness activities occur, consult the National Weather Service Awareness and Preparedness Calendar.) This is an opportune time to hold a tabletop exercise that synchronizes with other activities being conducted in your area—like using your local community’s tornado siren testing as the start of a tornado drill and then following it with a tabletop contemplating tornado damage to your business. But what is a tabletop exercise? And how can you conduct one successfully with your organization? Let us explore.
What is a tabletop exercise?
A tabletop exercise is an activity in which personnel gathers to discuss a simulated emergency scenario. Personnel uses role-playing and discussion to practice responding to the simulated threat(s) while referencing company policies and plan documents to support their efforts. While these types of tests can vary greatly in their scope and complexity, this testing type is always interactive and low risk. It gives everyone a chance to rehearse and ask questions, in scenarios that typically do not offer a chance to think through response during the intensity of an actual event. Depending on the scope of the emergency for which you are preparing, and the size of your business, your tabletop exercise could last a few hours to several days.
Who should take part in a tabletop exercise?
Key participants may include, but are not necessarily limited to:
- Executive leaders and other individuals identified in your management succession plan
- Personnel responsible for your business continuity plan
- Employees responsible for critical processes
- Critical vendors
Benefits of doing a tabletop exercise
Some of the benefits of engaging in tabletop exercises could include:
- Staff have a better understanding of their roles and expectations in an emergency event
- Staff gains confidence through practice and training, which can lead to more decisive leadership during an actual event
- Being better prepared can help prevent or reduce damage to your organization, risk to staff, and depending on the emergency, it may even save lives
- Improved understanding within vendor relationships around roles and response times
- Leadership has peace of mind that personnel are better prepared for crises
Perhaps most importantly, a tabletop exercise can also expose gaps in your organization's preparedness, giving you a chance to address shortcomings and, in some cases, prevent failures or improve recovery times as a result. Even the Federal Emergency Management Agency (FEMA) engages in tabletop exercises, so the value to organizations from small to very large is clear. At Locknet® Managed IT, we engage in tabletop exercises ourselves and at times with our clients, though it is not a regular service we provide. The importance of tabletop exercises should not be overlooked as a part of your preparedness strategy as they tend to be highly effective in determining how prepared your organization is before it is caught up in an emergency.
Five tips for conducting a successful tabletop exercise
- Introduce unpredictability. This is your opportunity to simulate the inherent volatility that accompanies an emergency. A standard six-sided die is one economical way to introduce chance into your exercises. For example: write down all your utilities on slips of folded paper and put them into a clean coffee mug (you probably have one of those around your workplace even if you are not a coffee consumer yourself!), roll a die to see how many utilities you will have remaining—or how many you will lose—and then draw that number from the mug. You can also use the die to answer “yes” or “no” questions. This could look like even numbers representing “yes” and odd numbers representing “no.” Someone asks a question, like “Is the President available to lead the incident?” And you let chance determine your incident commander for the event. Do not be afraid to get creative!
- Trade support with a colleague. Reach out to a trusted colleague at another company and agree to trade scenario development—you will write a scenario for them if they write a scenario for you. Once written, place your scenarios in sealed envelopes and exchange them. This can be especially helpful if you have a small team and can keep the tabletop participants unaware of the scenario’s parameters before engaging in the exercise to further simulate the uncertainty inherent to emergencies.
- Appoint a facilitator, a scribe, and an evaluator. In addition to your exercise’s participants, there are some key roles that should be considered when planning your tabletop. Facilitators control the pace and direction of the exercise; scribes document the team’s progress through the scenario, any key learnings, any recommended actions, and any other follow-up items from the event; evaluators consider the team’s performance and highlight areas for improvement.
Keeping these roles dedicated and separate from the participant list will help you get the most value out of your exercise. If you must eliminate or combine roles, consider how you can structure the team to retain the value associated with these roles, such as having participants self-evaluate performance or assigning that responsibility to the facilitator. Also consider any drawbacks that may occur by combining roles, such as asking a participant to scribe could erode the quality of their notetaking or the value of their participation as their attention will be divided.
- Amplify the impact of your tabletops by organizing them to coincide with simulated testing. Simulated technical tests of critical system(s) loss can ensure your plans for redundancy are operationalized appropriately before you need them. Integrating these tests into a tabletop can be a great way to augment your testing program and further mimic a real-world experience for your participants. For example, a tabletop exercise can provide a foundation to assess your data recovery strategy during a scenario where your routine data processes have been disrupted. Combining testing strategies can also help you maximize your exercise labor costs by having personnel engaged in related tests simultaneously.
- Coordinate tests with other entities and events. Emergencies often require us to rely on others. Reach out to key stakeholders in your region, schedule tests to coincide with awareness weeks, and maintain awareness of the broader systems in which you reside. These activities can help both you and your communities to improve your collective preparedness.
Go forth and prepare!
As a managed IT company, we work tirelessly to shore up protection for our clients so that their business is shielded from attacks, hacks, and other IT emergencies. But every business faces threats on a regular basis, both under the umbrella of IT and well outside of it—and those threats are always evolving. Planning for contingencies is a big part of managing IT, and the organizations that are most prepared when disaster strikes have typically put in long hours considering what might happen, and how they would react to minimize damage to the enterprise. Tabletop exercises are one component of that emergency preparedness mindset.
If you have not conducted a tabletop exercise recently, or ever, plan one today! Your next emergency could be tomorrow.
