How to run a privacy incident tabletop in 45 minutes
Share
Published
A privacy incident tabletop is a discussion exercise in which a team works through a fictional event and records its decisions. In 45 minutes, a small organisation can test who takes charge, how evidence is handled and what staff say before every fact is known.
The time limit here is an exercise design, not a legal reporting deadline. Use fictional information and keep the discussion separate from production systems. The facilitator should make clear that nobody is expected to send a real notification, reset a live account or contact an actual customer during the exercise.
Choose a scenario close to ordinary work
Use a situation staff can recognise: a dispatch spreadsheet sent to the wrong recipient, a contractor retaining access after a project, or a staff member entering credentials into an unexpected support page. A spectacular ransomware story may be less useful if the team cannot yet handle an ordinary misdirected attachment.
NIST’s incident-response preparation resources include training and exercise material. Its 2025 incident-response guidance places response within wider cyber-risk management. The agenda below is an original exercise for a small team.
Assign the roles before the clock starts
Choose a facilitator, an incident lead, someone representing operations, a communications decision-maker and a recorder. One participant can represent more than one function if the team is small, but record when that creates a bottleneck.
Give participants a contact sheet using fictional names or clearly marked internal test roles. Do not introduce real customer details, passwords or security keys to make the scenario feel realistic.
| Exercise period | Task | Output |
|---|---|---|
| Minutes 0–5 | Set the scope and explain the fictional event | Shared understanding of the starting facts |
| Minutes 5–15 | Triage and assign responsibility | Incident lead, initial questions and action owners |
| Minutes 15–25 | Introduce a new piece of information | Updated evidence log and containment decisions |
| Minutes 25–35 | Prepare the first status update | Approved draft distinguishing facts from unknowns |
| Minutes 35–45 | Review gaps and assign improvements | Short action plan and retest date |
Use a starting message with limited facts
For example: “A staff member reports sending a file named dispatch-test.csv to an address outside the approved courier list. The file was sent 20 minutes ago. The recipient has not replied.” This is a fictional prompt, not a report about a real organisation.
Ask what the team knows, what it needs to verify and who will do each check. Do not tell participants immediately that every customer is affected or that the recipient has misused the file. Those are conclusions that need evidence.
Record the answers in the incident evidence-log template. Include the time, source, observation, action and unresolved question.
Introduce one complication
At the next stage, tell the team that the attachment may contain a hidden sheet, or that the supplier contact in the address book is outdated. Ask how that changes the assessment and whether the original action plan still works.
The point is to test the process under incomplete information. The facilitator should avoid rewarding confident guesses. If nobody can establish the file’s contents or the responsible supplier contact, record that as a gap to fix.
Discuss containment without executing it
Ask who has authority to disable a shared link, contact the recipient or restrict an account. Identify the evidence needed before a destructive step, and who can provide technical help. Write down the proposed action rather than carrying it out on a live system.
For a supplier-related scenario, the vendor exit and access guide can help identify ownership. For an AI connection, use the AI-access review to establish which tool and account would need attention.
Prepare a first update
Have the communications owner draft a short internal update that states what is confirmed, what is being checked, who is leading and when the next update is due. Keep the audience and purpose explicit.
Use the first incident-update template. A regulator notification, customer notice and internal status message can have different requirements. The exercise should identify who obtains the necessary legal or specialist review rather than pretending one template covers every case.
Turn the discussion into an improvement plan
Choose a small number of specific actions. Each needs an owner, date and evidence of completion. “Train staff” is too broad. “Confirm the approved courier contact list and test the lookup with the dispatch deputy” can be checked.
Record which decisions were delayed because a person, system or contact was unavailable. Then rerun the affected part after the fix. A completed exercise is useful when it changes the response capability, not merely when the attendance sheet is full.
Where can a game help?
An awareness game can be a warm-up for recognising a suspicious message. Privacy Needle Play provides a separate training activity. The tabletop adds a different test: what the organisation does after someone reports a possible problem.
Keep game scores separate from the exercise findings. A person who spots a fake message still needs a working reporting route, and a good reporting route should help someone who is unsure.
How often should the exercise run?
Choose a cadence appropriate to the organisation and repeat relevant scenarios after material changes or incidents. The more immediate priority is to close the actions from the first exercise and verify that the deputy can follow the process without the usual owner.
Featured image: AI-generated conceptual illustration.
