Rehearse the IT outage before no one is left to decide
In an outage, the first hour counts. Unrehearsed groups lose it to searching for roles. The annual plan keeps the exercises on the calendar. Each session lasts two hours, brings management, IT and the business unit to the table and ends with an action plan.
Key takeaways
- Two hours are enough. The tabletop trains the situational picture, decisions and the first wording in an outage, without touching production systems.
- Roles before the real event. Management, IT, the business unit, data protection and the service provider must share the same picture.
- Keep the scenario small. A credible outage path with a few injects forces decisions under uncertainty.
- The exercise creates assignments. Each session ends with actions, names, dates and a repeat slot on the annual calendar.
Related: When the notification deadline really starts ticking · Which decision rights the CISO must have in writing
What a two-hour tabletop trains
An IT outage at a mid-sized company first hits the work due on the next business day. Order intake, goods issue, payroll and the customer hotline depend on systems taken for granted in quiet weeks. When the platform fails, management demands a situational picture while business units still want to deliver. The first questions come from sales, production and leadership, who are watching delivery capability and liability.
What is a tabletop? A tabletop is an analog exercise at the table. Production systems stay untouched. Participants receive incomplete information and must, under time pressure, set down the situation, a decision and the first agreed wording. The subject of the exercise is leadership. Two hours are enough if roles, scenario and minutes are fixed in advance.
Anyone who, in that minute, clarifies roles, decision paths and agreed wording for the first time is not directing the incident. The group that could direct it forms only under pressure. The tabletop brings exactly that group to a table before the real event. The exercise stays analog and contained. Cards, a scenario sheet, a visible clock and the minutes are enough as tools.
Forensics, patch levels and the depth of individual log files have no place in this format. Each new inject changes priorities. The group must judge whether to isolate systems or start them again, whether an internal lockdown is in force, and whether customers or suppliers receive a first notice.
Technical recovery stays with the restart plans and the backup tests. The two-hour session trains the shared situational picture. It shows who, under uncertainty, writes an assignment.
Which roles belong at the table for two hours
Without fixed roles, the tabletop falls apart into a technical debate with no decision. Management sits at the table as the authority for operations, cost and external impact. It approves whether to stop production, close a site or trigger emergency procurement with the service provider. IT leadership owns isolation, restart and the assessment of technical options. The security lead keeps the protection needs and the defensive logic on record, so haste does not reopen systems unchecked.
Roles at the table
- ✓Management for operations, cost and external impact
- ✓IT for the situational picture, restart and the service provider
- ✓The business unit for what the next business day needs
- ✓Data protection, once personal data or deadlines apply
- ✓HR or internal communications for the wording to staff
- ✓External IT service provider, if operations or restart sit with that provider
- ✓A facilitator with a stopwatch who drives the scenario
Data protection joins once personal data, duties to provide information or the content of staff and customer communication are affected. HR or internal communications owns the messaging to the workforce and clarifies whether the works council must be involved. A business unit with a critical process keeps the exercise on value creation and stops the table from staying inside IT. Typical anchors are sales, production, logistics or accounting, depending on which process stops the company first. This role must not go to someone who knows the process only by hearsay.
The external IT service provider belongs at the same table if operations, hosting or restart sit with that provider by contract. Without the provider, the company rehearses a situation it cannot control alone in a real event. A facilitator keeps the time and pulls the group back from technical detail to decisions. A person outside the specialist roles writes the minutes. That person records decisions, open questions and agreed wording before they fray in discussion.
Deputies are part of the role card. Leave, illness and clashing appointments are normal in mid-sized companies. Each role needs a named deputy and a channel that works without the failed primary system. Mobile contact lists, paper printouts and management reachable outside the corporate network sound plain. In an outage they set the pace of the first hour.
How to set the scenario up in two hours
The scenario must be credible for the company itself. Failure of the central order-and-stock system, an extortion case without technical gimmicks, failure of the sign-on service or a link to production left open too long are enough as a frame. The closer the case sits to a process the company feels on a normal business day, the more honest the priorities. Distant crises produce debate. Nearby ones produce decisions.
The scenario names the visible effect on processes. It does not speculate about attacker groups and it does not simulate malware. Preparation belongs in the weeks before the session. IT leadership and the security lead draft the trigger, a few injects and the visible goal at the end of the two hours. That goal can be a decision to isolate, a first internal notice or a written assignment to the service provider.
The facilitator knows the injects. The other participants know only the starting state. The two hours follow a rough working frame. At the start come the goal, the rules and the role card, then the opening inject. In the middle come further decision loops, each with a new inject. Toward the end the group drafts agreed wording and the next concrete assignment. A short review closes the session while impressions are still sharp.
Documents stay short, and so does the group. One page for the scenario, one page for roles, a blank template for the situational picture and a template for the first notice are enough. Anyone who puts policy binders on the table ends up reading. Paper and pen are still allowed, because in a real outage that path is often the only one. Anyone who only wants to listen receives the minutes and stays away from the table.
How the group practices decisions and wording under time pressure
The visible clock is the real training tool. Without it, the table debates as if a whole night shift were free. With it, every open question becomes expensive, because it is weighed against the next decision. The facilitator stops debates that produce no decision and asks for the action that, in the next few minutes, affects restart or the outside world.
Every decision needs one sentence in the minutes. That sentence states what applies, who carries it out, by when an update is due and what stays deliberately open. Incompleteness is normal in the first hour of an outage. The exercise shows who turns uncertainty into an assignment. It also shows who waits for a full set of facts that will not arrive in this phase.
In this format, communication is a deliverable. The group writes a first internal notice to staff. If the business unit treats outside pressure as realistic, it also drafts restrained wording for customers or suppliers. Names of people affected, technical causes and blame stay out. Data protection checks whether personal data or statutory deadlines limit the wording. Management releases the statement or holds it back.
Email as the only channel fails when the email system is part of the situation. The group must then name another path, such as mobile phones, an independent distribution list or an announcement on site. Anyone who cannot show a written statement after two hours has only discussed the situation. A real event demands sentences an employee can say on the phone without speculating. Those sentences appear when the table treats them as an assignment.
How the exercise becomes an action plan that holds
The value of the two hours sits in the action plan the group still sketches in the room. Every gap that showed up in the exercise becomes an action with an owner, a date and expected evidence. Typical findings in mid-sized companies are escalation chains that work without the corporate network, current contacts at the service provider and deputy rules for management. Templates for first notices belong with them. What often stays open is the order in which processes truly have to run again first.
Each action is cut small enough to start without a new major project. A printed role card, a tested call path outside the corporate network or an approved first notice holds up better than a statement of intent. The plan should be sharpened in the days after the exercise, while the friction is still fresh. IT leadership checks what is feasible technically and by contract. Management approves what touches money, suppliers or external impact.
Actions with no date or no name disappear into daily work. Actions with evidence return in the next exercise as the test. The plan stays short. A few-line overview carries better in day-to-day business than a long document nobody opens.
Large-scale simulation programs are not a prerequisite for this in mid-sized companies. Working through the list belongs in ongoing management. A fixed agenda item in the weeks after the tabletop stops daily work from burying the open points. What is done is ticked off and recorded in the management minutes. What stalls goes back to management with the question of whether the protection need or the date was set wrong.
Which 12-month plan keeps the exercise on the calendar
A single tabletop reassures briefly and goes stale fast. People change, service providers change their contacts and processes shift with new systems. The annual plan turns the exercise into a management routine. The year splits roughly into mandate, first exercise, follow-through, second exercise and year-end review. Dates are set before holiday peaks and year-end close the calendar.
At the start of the year, IT leadership obtains management’s mandate. Together they name the processes without which the company cannot deliver, and the systems those processes depend on. In the following weeks the role card, deputies, reachability independent of the corporate network and the first scenario take shape. The first two-hour exercise sits deliberately early in the year. Only then does the action plan still have time for contacts, templates, escalation and clarification with the service provider.
At mid-year, a short status in the management meeting is enough, with the columns done, delayed and blocked. In the second half of the year the scenario gets harder. The second exercise tests, with a longer outage, a missing key person or parallel pressure, whether the plan from spring still holds. The second exercise again lasts two hours and uses the same roles. Only the situation changes.
Year-end records which actions work, which roles must be filled again and which scenario is due the following year. The calendar entry itself is a security measure. Anyone who does not schedule the two hours will not find them in daily operations. Anyone who schedules them and repeats them can, in an outage, fall back on practiced decisions. They can fall back on wording that has already taken shape at the table.
Common questions
Each question is closed. A tap unlocks the answer.
Are two hours enough if a real outage would last much longer?
The two hours train the leadership decisions of the first hour. Recovery that runs longer stays with the restart plans, the backup tests and the work with the service provider. The tabletop shows whether those plans can be picked up from there, and whether the group can decide under time pressure.
Does the external service provider need to be at the table?
Once operations, hosting or restart sit with the provider by contract, the provider belongs in the exercise. Otherwise the company decides on options it cannot carry out alone. The role card names the provider with a deputy and a contact path outside the failed system.
Do we need an expensive simulation program for the annual plan?
For a mid-market tabletop, an analog setup with a scenario sheet, a role card and minutes is enough. Large-scale simulation programs are not a prerequisite.
Editor’s Picks
Editor’s PickThe emergency plan that nobody practiced.Editor’s PickRansomware 2026: Incident Response in the First 60 MinutesEditor’s PickWhat Is Incident Response? The Plan for Emergencies
More from the MBF Media Network
MyBusinessFutureNIS2 Implementation: What Mid-Sized Companies Still Need to DoDigital ChiefsIT Resilience 2026: Why DORA, NIS2, and ISO 22301 Belong in One Framework
Image source: AI-generated (September 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
