PŻ.
    Ask the SI

    Tabletop facilitation guide

    Everything needed to run a useful tabletop in ninety minutes, including the questions that expose decision gaps.

    Updated

    Before the session

    • Scenario drawn from the organisation's own architecture — including AI-assisted scenarios such as a synthetic-voice payment request or a prompt-injection incident where relevant.
    • One or two decisions selected as the test objective.
    • Participants include legal, communications, a business owner and an executive.
    • Four to six timed injects written, one containing incorrect information.
    • Note-taker assigned; no laptops for participants.

    Facilitator probes

    • Who decides this, by when, and on what evidence?
    • What breaks if you take that containment action?
    • What evidence would that action destroy?
    • Which clock just started, and who files?
    • How would you know the intruder is out?
    • Who is telling customers, and what exactly are they saying?
    • If this request arrived by voice or video, how would you verify it through a separate channel before acting?

    After the session

    • Every gap has a named owner and a due date.
    • Playbooks updated within two weeks.
    • Contact lists and out-of-band channels corrected.
    • Recovery-time assumptions scheduled for a real test.
    • Findings summarised for the management body.

    Related

    Tabletop exercises

    How to design and facilitate a security tabletop that surfaces decision gaps instead of confirming that everyone has read the policy, and how it fits DORA/NIS2 testing obligations.

    Incident readiness

    Incident response plan review, cloud and identity playbooks, tabletop exercises and detection coverage assessment.

    Incident response checklist

    Printable IR readiness checklist aligned to NIST SP 800-61r3: authority, playbooks, evidence access, communications and regulatory clocks.

    Incident response

    IR lifecycle aligned to NIST SP 800-61r3 and CSF 2.0, cloud and identity playbooks, detection coverage and post-incident learning that changes controls.

    IR playbooks that work

    A playbook structure built for 03:00 use: decision points, containment options with trade-offs, evidence steps and the exact notification clocks under DORA, NIS2 and GDPR.

    Deleting model data

    Why trained data is hard to remove from LLM weights, and how incident responders should contain, replace and test an affected model.