How to Run a 90-Minute Disaster Recovery Tabletop Exercise
Reviewed September 28, 2026. A tabletop exercise is a facilitated discussion about an incident. It helps staff examine decisions, contacts, and plan gaps without taking production systems offline. It does not demonstrate actual restoration speed or prove that an RTO or RPO is achievable.
Prepare before the session
Choose one service and one scenario, such as an unavailable order-processing system after a suspected compromise. Invite the business owner, IT lead, incident coordinator, and appropriate communications, legal, or supplier representatives. Appoint a facilitator and note-taker. Provide the current runbook, dependency list, contact list, and agreed recovery objectives.
Use CISA’s exercise packages for scenario ideas. NIST’s exercise guidance explains the distinction between tabletop discussions, functional exercises, and technical tests.
Minutes 0-10: agree on scope and rules
State the service being discussed, the exercise objectives, and what is excluded. Confirm that the session authorizes discussion only, not changes to production. Define how the facilitator will introduce new information and how unresolved questions will be recorded.
Minutes 10-25: present the initial incident
Describe the symptoms and available evidence without assuming a cause. Ask who receives the alert, who declares an incident, who has decision authority, and which communication channel works if email is unavailable. Record where the runbook answers these questions and where it does not.
Minutes 25-45: discuss containment and dependencies
Introduce a missing contact, unavailable identity service, or uncertainty about a backup. Ask who can authorize containment, where emergency credentials are stored, and what evidence must be preserved. Identify the business consequences of each choice rather than improvising changes on a live system.
Minutes 45-65: walk through recovery decisions
Identify the recovery environment, dependencies, restoration sequence, and validation owner. Compare the plan with the stated RTO and RPO. Label any recovery duration as an estimate unless it comes from a documented technical test under relevant conditions.
Minutes 65-80: communications and return to service
Discuss staff and customer communications, supplier coordination, and escalation to legal or compliance advisers. Do not assume one reporting deadline fits every incident. Ask what evidence the business owner needs before approving the return to service.
Minutes 80-90: agree on corrective actions
Create a short action record for each finding: issue, affected service, risk, owner, due date, and verification evidence. Assign a follow-up review. Avoid marking an issue resolved merely because the team discussed it.
What to measure
- Whether participants can identify their responsibilities and escalation contacts.
- Whether the runbook addresses the scenario and dependencies.
- Which decisions remain blocked by missing authority or information.
- Which assumptions require a separate restore or functional test.
- Whether corrective actions have owners and later verification.
What comes after the tabletop?
Update the runbook, resolve findings, and plan authorized technical tests. See our ransomware recovery evidence checklist for the difference between discussion findings and restore-test proof.
Technijian can help scope business continuity and recovery planning. Discuss an exercise for your business.
Original recording
The original recording is retained. Use the reviewed written guidance above for current instructions; the audio and video have not been rerecorded.
