Tabletop exercise — Cybersecurity risks & crisis
Friday, 16:40: files are encrypted, a ransom note is on the shared drive, and the break-in came through a supplier's remote-support account. Three hours around a table deciding what happens next — including the NIS2 reporting deadlines — with no real systems at risk.
What a tabletop exercise is
A structured, discussion-based rehearsal of a crisis. A facilitator presents a realistic scenario and feeds in new developments (injects) on a timeline; the people who would have to respond talk through what they would do, who decides, and what they would say. Nothing is switched off — the point is to find the gaps in plans, roles and communication before a real incident does.
What you'll do
- Work through the first 24 hours of a ransomware and supplier-compromise incident, decision by decision
- Draft the NIS2 early warning (24 hours) and incident notification (72 hours), and decide on GDPR notification in parallel
- Test backup and business-continuity assumptions against a realistic outage
- Leave with a written list of gaps, each with an owner — ready to take back to your organisation
Agenda
- 10:00Briefing: roles, rules, the no-blame principle
- 10:15The incident unfolds — first injects: helpdesk tickets, a ransom note, a suspicious supplier login
- 10:50Backups fail, customers notice, a journalist calls — containment and communication decisions
- 11:30Data-theft claim and "do we pay?" — management, insurer, legal
- 11:50The 24-hour clock: draft the NIS2 early warning; decide on GDPR notification
- 12:10Fast-forward to day 3: partial restore and the 72-hour notification
- 12:30Hot debrief: what worked, what didn't, gaps and owners
Pricing
No-show policy: booking a spot means someone else can't. If you don't show up without cancelling in advance, your payment isn't refunded. Cancel at least 15 days before the event for a full refund — that gives organizers time to find someone else for your spot. Cancellations closer to the event, or no-shows, aren't refunded.
Who it's for
IT and security staff, managers who would have to make the calls, communications and legal/DPO roles — especially in organisations within NIS2's scope. Come as a team from one organisation or on your own; mixed tables work well. No technical background is needed for the non-IT roles.
More tabletop exercises
This is one of three scenario families we run — NIS2 compliance, cybersecurity crises and natural disasters. For a tabletop built around your own organisation, see training for companies.
Led by
Run by prepping.club's own instructors, with the scenario designed around current NIS2 obligations.
Sponsors
This event doesn't have a sponsor yet. If your company wants to support practical cyber-crisis training, we'd like to hear from you.
Become a sponsor