MSP Tabletop Exercise Template: Run a 60-Minute Incident Drill and Fund the Gaps
A written incident response plan looks finished until the first real call. The plan names roles. The call reveals that nobody can approve downtime, counsel is missing from the contact list, and the MSP is improvising client communications from a Slack thread.
A tabletop exercise is how you find those gaps on purpose. Keep it as a timed conversation that forces decisions, records who owns them, and leaves a short after-action report the client can fund.
This template is for the vCIO or strategic account lead who needs a drill the owner will actually attend. Pair it with your incident response plan template and business impact analysis. The plan says who acts. The tabletop proves whether those people can decide under a clock.
CISA's tabletop exercise packages and NIST incident-response guidance both treat exercises as preparation work, not theater. For an MSP, the useful output is a client decision list with owners, dates, and scope.
What this tabletop is for
Use this when a client has an incident clause, a cyber-insurance questionnaire, a compliance control that asks whether the plan was exercised, or a QBR where "we should test IR" keeps slipping.
Treat it as the 60-minute ownership drill that exposes missing authority before the breach does. Keep your technical runbook, legal advice, insurance counsel, and any live-system simulation as separate work.
A useful tabletop answers five questions:
- Who opens the incident record and leads technical triage?
- Which decisions need a client executive, counsel, or carrier, and how fast can they respond?
- What communications are approved before facts are complete?
- Which response tasks sit inside the agreement, and which need a separate incident scope?
- What remediation, roadmap, or accepted-risk decisions follow the hotwash?
60-minute agenda
Keep the room small. Ideal attendees: MSP technical lead, MSP account or vCIO lead, client executive sponsor, one operations owner, and counsel or carrier contact when the scenario requires them. Record one shared timeline. Do not run parallel chats that become competing facts.
| Minute | Block | What happens | Facilitator focus |
|---|---|---|---|
| 0-5 | Open | State the objective, rules, and scoring. Confirm the incident record owner. | No debate about tooling yet. Confirm who writes the timeline. |
| 5-15 | Scenario brief | Read Inject 1. Ask for the first 10 minutes of real response. | Force one technical lead and one client decision owner by name. |
| 15-30 | Inject 2 | Add pressure: payroll, a vendor outage, a regulator question, or a reporter. | Separate acting from deciding. Write every "we would call X" as a contact that must exist. |
| 30-45 | Inject 3 + containment boundary | Ask what the MSP can do without approval, and what needs a named client yes. | Capture service-boundary language for the after-action report. |
| 45-55 | Hotwash | Score the drill. List gaps as decisions, not blame. | Convert each gap into owner, due date, and work type. |
| 55-60 | Close | Confirm the next update, who drafts the AAR, and the review date. | Leave with a one-page decision list, not a vague "lessons learned." |
Rules that keep the drill honest:
- Say what you would do with the people and authority you have today, not the org chart you wish you had.
- If a decision has no owner, write "unowned" and keep moving.
- Do not pause the clock to rewrite the IR plan mid-exercise. Capture the rewrite as an AAR item.
- Technical deep-dives go to a parking lot. The tabletop owns decisions and handoffs.
Roles for the room
| Role | Job in the drill | Failure mode to watch |
|---|---|---|
| Facilitator (usually MSP vCIO or AM) | Keeps time, reads injects, writes the decision list | Turns into a lecturer instead of a referee |
| MSP technical incident lead | States technical facts, containment options, evidence needs | Speaks for the client on business risk |
| MSP account / service lead | Tracks agreement scope, vendors, and update cadence | Absorbs unpaid incident project work silently |
| Client executive sponsor | Approves downtime, spend, and business priorities | Delegates every decision and then disputes the result later |
| Client operations owner | Speaks to payroll, clinics, warehouses, or other timed work | Leaves critical process timing unspoken |
| Counsel / carrier (when invited) | Advises notice triggers and privilege | Becomes a substitute for technical containment |
If counsel cannot attend, still run the drill. Mark every legal or insurance question as "needs counsel within X minutes" and treat a missing contact as a finding.
Three ready scenarios
Pick one scenario the owner recognizes. Keep the facts short so the room debates decisions, not novel writing.
Scenario A: Microsoft 365 account takeover on payroll week
Inject 1: A finance user reports repeated sign-in prompts. The MSP sees a new inbox rule forwarding payment notices and an unfamiliar session location. Payroll runs tomorrow morning.
Inject 2: The same inbox rule appears on a second finance mailbox. The bank asks the client to confirm two unusual ACH requests.
Inject 3: An employee posts in the company chat asking whether "IT got hacked," and a key vendor asks if purchase orders are still valid.
Scenario B: Ransomware alert on a line-of-business server
Inject 1: EDR flags encryption behavior on a file server that hosts the client's scheduling or ERP share. Users report slow saves. No ransom note yet.
Inject 2: Backup jobs for that volume failed overnight. The last known good restore point is 36 hours old. The client has a same-day customer commitment that depends on the system.
Inject 3: The client's cyber carrier asks whether systems were isolated and whether a preferred IR firm must be engaged before further changes.
Scenario C: Critical vendor outage with customer data exposure risk
Inject 1: A SaaS vendor used for client intake reports unauthorized access to a subset of tenant data. The vendor's status page is vague. Your client stores customer PII in that tool.
Inject 2: The vendor confirms API tokens should be rotated and that logging is incomplete for the suspected window. A customer's counsel emails the client asking for details.
Inject 3: A local reporter contacts the front desk after seeing a social post from an employee. The owner asks what they can say in the next hour.
Label each scenario as illustrative. Change industry details to match the client. Do not invent breach outcomes the facts do not support.
Inject and decision log
Copy this table into the shared record. Fill it live.
| Time | Inject | Observed facts | Decision needed | Owner | Deadline | In scope / separate project | Notes |
|---|---|---|---|---|---|---|---|
| 1 | |||||||
| 2 | |||||||
| 3 |
Prompts that keep the log useful:
- "Who can authorize this in the next 15 minutes if the sponsor does not answer?"
- "What evidence must we preserve before we change the environment?"
- "What do we tell staff now, and who approves the words?"
- "Which of these tasks is ticket work, and which is a scoped incident project?"
For the broader ownership split outside the drill, use a shared responsibility matrix. The tabletop is where that matrix gets a timer.
Scoring sheet
Score each row 0 (missing), 1 (partial), or 2 (clear and tested). Total out of 20. Anything 0 becomes an AAR decision.
| Capability | 0 | 1 | 2 | Score |
|---|---|---|---|---|
| Named technical incident lead and backup with after-hours path | No name | Name only | Name, backup, contact path tested | |
| Named client decision owner who can approve downtime and spend | No name | Name only | Name plus backup and response SLA | |
| Counsel and carrier contacts reachable from the plan | Missing | Listed but untested | Listed, location of policy known, call path clear | |
| Pre-approved containment actions written in the agreement or plan | None | Informal understanding | Written list the MSP can execute without waiting | |
| Evidence preservation steps known to the technical lead | Unknown | Partial | Checklist used in the drill | |
| Communications owner and approval path | None | Ad hoc | Owner, approver, and update cadence agreed | |
| Service boundary: included triage vs incident project | Unclear | Spoken only | Written examples the account lead can cite | |
| Critical business process timing known (payroll, clinics, shipping) | Unknown | Partial | Documented with recovery priorities | |
| Vendor escalation paths for the scenario systems | Missing | Partial | Contacts and ticket path confirmed | |
| Review owner and next exercise date | None | Discussed | Named owner and calendar date |
A low score still counts as a useful meeting. That score is the reason the AAR can ask for budget.
After-action report template
Send this within two business days while the room still remembers the awkward pauses.
| AAR field | What to write |
|---|---|
| Exercise date and scenario | Date, attendees, which scenario ran |
| What worked | People, contacts, approvals, or evidence steps that moved fast |
| Gaps found | Unowned decisions, missing contacts, unclear authority, scope ambiguity |
| Decisions required | Each gap as a client or MSP decision with owner and due date |
| Work packages | Remediation, documentation, tabletop follow-up, or accepted risk |
| Evidence retained | Timeline, inject log, score sheet, and where they live in the client record |
| Next exercise | Date, owner, and whether the next drill retests the same gap |
Turn gaps into work the client can buy or schedule:
| Gap type | Typical package | Example ask |
|---|---|---|
| Missing authority or contacts | Plan update + short re-drill | "Update the IR ownership map and retest the payroll scenario in 30 days." |
| Missing logs or evidence path | Discovery or hardening project | "Enable and retain the identity and mailbox logs we needed in Inject 1." |
| Unclear service boundary | Agreement language + playbook | "Write which incident tasks are included and which become a project." |
| Business process timing unknown | BIA refresh | "Record payroll and clinic recovery priorities before the next QBR." |
| Communications unowned | Comms one-pager | "Name the approver and draft the first-hour staff message." |
Do not bury the ask inside "security best practices." Put a price, an owner, and a date on each package, or record accepted risk in writing.
How to package the drill for the QBR
The tabletop earns its keep when the hotwash feeds the roadmap.
- Bring the score sheet and the three highest-risk unowned decisions.
- Tie each decision to business timing the owner already cares about (payroll, clinics, month-end, insured requirements).
- Offer a small funded package: plan update, evidence fixes, vendor path, or a second 30-minute retest.
- Schedule the next exercise on the calendar before the meeting ends.
That is the same motion as a good QBR: findings become choices, and choices become scoped work. Keep the QBR structure nearby so the drill does not become a one-off PDF.
Keep the evidence in the client record
Insurers, assessors, and future you will ask whether the plan was exercised. Store the agenda, inject log, scores, AAR, and remediation decisions with the client, not in a facilitator notebook.
That is where Scopable's GRC workflow fits: frameworks, evidence signals, open gaps, client summaries, and the next remediation decision stay tied to the same client record. The MSP still owns judgment. The client still owns business risk.
If you want the next tabletop's gaps to land as roadmap items and scoped work without rebuilding the story from scratch, start Scopable for free.
