The order processing system stops working. Deliveries are waiting, sales is taking customer calls and IT is trying to establish the cause. Every further delay increases the backlog and reduces the time available to fulfil agreed commitments.
The company has a business continuity plan. Yet nobody is sure who approves alternative working arrangements, which orders take priority or what can be promised to customers.
In this illustrative scenario, a technical fault also reveals an organisational problem: business decisions must be made before there is a complete picture of the incident.
An untested plan can be a useful starting point. But its usability remains an assumption until the interaction of people, procedures and resources has been checked.
What an exercise reveals that a document leaves open
A plan may say that an employee should notify their manager. An exercise reveals what happens when the manager is unavailable.
A backup way of working may exist, but staff may lack the permissions, data or instructions needed to activate it. A communications lead may be named without anyone being assigned to provide verified information.
A tabletop exercise lets participants discuss their roles, coordination and decisions through a set scenario. NIST SP 800-84 describes it as a discussion-based activity, without deploying equipment or other operational resources. It therefore does not establish that a backup system or data recovery works technically. Those capabilities require appropriate practical tests.
Choose one process and a clear objective
For an initial exercise, choose a process whose disruption would have a recognisable business impact: order processing, billing, deliveries or client communications.
Then define what you want to check. For example:
- who decides to activate alternative working arrangements;
- how priority commitments are identified;
- whether the team can find the necessary contacts and instructions;
- how activities are temporarily recorded;
- who approves information sent to customers.
The objective “check our readiness” is too broad. “Check how priority orders are approved and processed without the main system” gives participants a specific task.
A suggested initial 90-minute exercise
The following schedule can be used for the scenario above. This is a SECURITY 360° proposal for a narrowly defined initial exercise, not a universal duration standard. Scope and timing should reflect the process and number of participants.
| Time | Activity | Key question |
|---|---|---|
| 0–10 minutes | Introduce the scenario, objective and rules | Which process has stopped, and what are we trying to maintain? |
| 10–25 minutes | Initial decisions and allocation of responsibilities | Who coordinates the response, and what information do they need? |
| 25–45 minutes | Develop alternative working arrangements | How do we handle priority orders and record changes? |
| 45–60 minutes | Additional complication: the responsible person is unavailable | Who takes over their authority, and can decisions continue? |
| 60–75 minutes | Communications and return to normal operations | What do we tell customers, and how do we avoid duplicated or lost records? |
| 75–90 minutes | Review findings and agree corrections | What will we change, who is responsible and when will we repeat the check? |
Include a process representative, someone authorised to make business decisions and relevant technical support. Assign a facilitator and a person to record decisions, delays and open questions.
Live systems are not interrupted during this exercise. Participants work through the scenario, explain decisions and check that the required instructions are available.
“We would manage” is the start of a question
When a participant says the team would manage, ask them to describe the process.
Exactly how? Who would do it? What data would they access? Whose approval would they need?
If the answer depends on a private phone, a personal connection or one person's knowledge, record that dependency.
For example, the team suggests recording orders temporarily in a spreadsheet. The next questions are who can access it, how duplicate entries will be prevented and how the data will later be reconciled with the main system.
This turns a general idea into a process that can be assessed and tested.
How to evaluate the result
Before starting, define criteria appropriate to the chosen process. During the exercise, monitor:
- Coordination: is it clear who leads the response and who acts as their deputy?
- Information: are the necessary contacts, instructions and records available?
- Authority: can a decision be made without waiting for an unavailable person?
- Feasibility: are resources available for the proposed alternative procedure?
- Communications: do sales, support and management have consistent information?
- Return to operations: who confirms resumption of the normal process and reconciliation of temporary records?
Record the time needed for decisions and where discussion stalled. Use tabletop exercise results as indicators for further checking, rather than proof of actual recovery time.
Assign an owner and deadline to every finding
The continuity programme should also include correcting identified shortcomings. The Ready.gov business continuity plan template specifically includes testing, exercises and a corrective action programme.
A brief log is enough to start:
| Finding | Required change | Responsibility | Evidence of resolution |
|---|---|---|---|
| No deputy for the decision-maker | Designate a deputy and their authority | Process manager | Repeat part of the scenario without the primary responsible person |
| The contact list is out of date | Verify contacts and assign responsibility for maintaining them | Designated responsible person | A controlled contact check |
| The alternative procedure is not detailed enough | Define steps, access and records | Process owner with technical support | A practical test using a controlled sample |
Add a specific deadline to each change. Close the task when there is confirmation that the revised procedure works, rather than merely that the document has been updated.
The SECURITY 360° perspective: follow the handovers between teams
IT may be restoring the system while sales does not know what to tell customers. A manager may approve an alternative procedure while staff lack access to the data needed to carry it out.
Every team is doing its job, yet the process remains stalled.
During the exercise, we therefore track how information leads to a decision, a decision to a task and a task to resumed operations. At those handovers, we look for unclear authority, delays and dependencies that individual instructions do not reveal.
A valuable exercise produces a specific list of what the organisation needs to improve — with an owner, deadline and method of verification.
What would stop first in your company if a key system or person became unavailable?
In an introductory discussion with SECURITY 360°, we define the process you want to check, who should participate and which decisions the exercise should examine. We then propose the scope and expected outputs: recorded gaps, correction priorities and a suggested follow-up check.
Arrange a simulation exercise for your team →
Related reading: Digital ownership — the risk companies discover too late
Professional framework: NIST SP 800-84 and The Ready.gov business continuity plan template, linked in the text. The scenario and exercise schedule are a SECURITY 360° proposal.
DISCUSSION O TEMI
Komentari 1