May 2025 Chapter Meeting

Topic: Ensure Compliance Through Effective Tabletop Exercises

Speaker(s): Matt Donato, Partner and Steve Dyson, Senior Manager Cyber Risk Advisory

A tabletop exercise (TTX) is a simulated cyber incident designed to test an organization’s response capabilities in a controlled, low-stakes environment. It brings together team members to practice decision-making under pressure and assess their knowledge of incident response procedures. Moreover, tabletop exercises are a key component of compliance with many new cybersecurity regulations, such as GLBA, NYDFS , SEC Cybersecurity Rules, and DORA, which require periodic incident response testing. Failing to conduct TTXs can result in non-compliance penalties and leave organizations vulnerable to regulatory scrutiny. Effective TTX planning involves defining the "who, what, where, when, and why" to align objectives, participants, and resources. Organizations should select realistic threat vectors, introduce complex injects, and vary the format (in-person, virtual, or hybrid) to maximize engagement and realism. Regularly conducting TTXs helps organizations strengthen…