Most businesses with a disaster recovery or incident response plan have never actually run it. It sits in a folder, reviewed once a year if that, and the first real test of whether it works happens during an actual breach - the worst possible time to discover it doesn't.
What an Incident Response Drill Actually Is
A drill - usually called a tabletop exercise - is a structured walkthrough of a realistic incident scenario, run with the people who'd actually be involved if it happened for real. No systems are taken offline and nothing is actually broken. The team talks through what they'd do, in what order, and who they'd need to contact, while a facilitator introduces new information as the scenario unfolds.
Why a Written Plan Isn't Enough on Its Own
A plan looks complete on paper and still fails in practice for reasons that only show up when people actually try to follow it:
- Contact details go stale - the person listed as the emergency contact left the business eight months ago.
- Steps assume access that isn't available - the plan says to log into the admin portal, but the only person with access is the one whose account may be compromised.
- Roles are unclear under pressure - everyone assumes someone else is making the call on whether to take systems offline.
- Communication isn't planned - nobody has decided in advance what staff, clients, or media get told, and when.
None of these show up by reading the document. They only show up by trying to use it.
Running a Simple Tabletop Exercise
1. Pick a realistic scenario
Ransomware on a file server, a compromised email account sending invoices to clients, or a lost laptop with client data are common, realistic starting points. Keep it specific rather than vague.
2. Bring the right people into the room
Include whoever would genuinely be involved - not just IT. That usually means a decision-maker who can authorise spend or downtime, someone who can communicate with staff and clients, and whoever manages your IT or managed service provider relationship.
3. Walk through it in stages
A facilitator presents the scenario in steps - "it's 9am Monday and three staff report they can't open files" - and the team talks through their response at each stage before the next development is revealed.
4. Write down what breaks
The value of the exercise is in the gaps it exposes - outdated contacts, unclear authority, missing backups of the plan itself. Capture these as action items, not just observations.
5. Fix the gaps and run it again next year
A drill is only useful if it leads to changes. Update the plan, close the gaps, and treat the exercise as an annual check-in rather than a one-off.
How Often Should This Happen?
Once a year is a reasonable baseline for most small and medium Perth businesses, with an additional session after any major change - a new core system, a change in key staff, or a move to a new office or cloud platform that changes how recovery would actually work.
Where to Start
If you don't have a written incident response or disaster recovery plan yet, that comes first - a drill needs something to test against. If you do have one, the next step is simply booking time with the right people and running it.
Frequently Asked Questions
What's the difference between a tabletop exercise and an actual incident response test?
A tabletop exercise is a talked-through walkthrough, the team discusses what they'd do at each stage of a scenario without touching any real systems. It's not the same as a live simulation where systems are actually taken offline, but for most small and medium Perth businesses, a tabletop drill is enough to expose the gaps that matter, like stale contacts or unclear authority, without any operational risk.
Who actually needs to be in the room for a drill to be useful?
Not just IT. A useful drill includes a decision-maker who can authorise spend or downtime, someone who can handle communication with staff and clients, and whoever manages the relationship with your IT or managed service provider. Leaving out any of these roles means the drill won't surface the gaps that actually matter during a real incident.
How long does a tabletop exercise typically take?
Most run for an hour or two, depending on how detailed the scenario is and how much discussion each stage generates. It doesn't need to be a major production, the value comes from actually walking through a realistic scenario, not from how long the session runs.
We don't have a written incident response plan yet, should we skip straight to a drill?
No, a drill needs something to test against, so a basic written plan should come first. Once that's in place, even a simple one, a drill is what turns it from an untested document into something you actually know will hold up.
We help Perth businesses build and stress-test a disaster recovery and incident response plan that actually holds up under pressure.
Backup & Disaster Recovery →Never tested your incident response plan?
Call 0433 087 091 for a free, no-obligation conversation about running a drill.
Book a Free Consultation