A response plan may look complete until several teams need to decide together. A tabletop exercise creates a controlled setting to test roles, communications, and trade-offs without touching production systems.
Choose a scenario that forces decisions
The scenario should begin with a plausible event and evolve in stages. Loss of visibility, compromised vendor access, or an anomaly on an engineering workstation are useful when they force participants to decide what to isolate, whom to call, and what evidence to preserve.
Bring operations into the exercise
OT response does not belong to cybersecurity alone. Operations, automation, safety, maintenance, communications, and leadership each hold part of the decision. The exercise should make those dependencies visible.
Test isolation and recovery
Isolating a system may contain an incident while creating a new operational risk. Participants need to understand degraded modes, available backups, restoration criteria, and the authority required to return an asset to service.
Turn observations into actions
The value of the exercise comes from follow-through. Every gap should become an assigned, dated, verifiable action: update a contact, clarify responsibility, validate a backup, or prepare an isolation procedure. A short exercise with real follow-up is more useful than a dramatic scenario with no closure.