Incident response plan tabletop frequency

Overview

Plans untested are fiction—minimum annual tabletop; high-risk quarterly.

Variants

Rotate scenarios: ransomware, BEC, cloud account takeover, insider threat.

Participants

Expand beyond IT: Legal PR HR Finance when scenario warrants.

Outputs

Update IR plan version; train new hires referencing last tabletop recording scrubbed.

Metrics

Track action-item closure velocity; recurring themes in after-action reviews should drive concrete control changes, not informal workarounds.

Insurance

Some carriers offer premium credit for documented frequency—ask broker quietly.