performing-soc-tabletop-exercise

name	performing-soc-tabletop-exercise
description	Performs tabletop exercises for SOC teams simulating security incidents through discussion-based scenarios to test incident response procedures, communication workflows, and decision-making under pressure without impacting production systems. Use when organizations need to validate IR playbooks, train analysts, or meet compliance requirements for incident response testing.
domain	cybersecurity
subdomain	soc-operations
tags	["soc","tabletop","exercise","incident-response","training","nist","playbook-validation"]
mitre_attack	["T1566","T1486","T1078"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Performing SOC Tabletop Exercise

When to Use

Use this skill when:

• Annual or semi-annual incident response testing is required (NIST, ISO 27001, PCI DSS compliance)
• New SOC analysts need exposure to major incident scenarios in a controlled environment
• Updated playbooks need validation before next real incident
• Cross-functional coordination (SOC, IT, Legal, PR, Executive) needs rehearsal
• Post-incident reviews reveal gaps requiring scenario-based training

Do not use as a replacement for technical purple team exercises — tabletop exercises test processes and decision-making, not technical detection capabilities.

Common Misconfigurations & Verification

• Objectives not measurable: vague goals like "test our response" give no pass/fail. Each objective must map to an observable decision in an inject and a scorecard criterion (detection, containment, communication, recovery) — otherwise the after-action report is opinion, not evidence.
• Injects too scripted / no decision pressure: injects that state the answer ("this is ransomware, isolate the host") test reading comprehension, not judgment. Withhold the diagnosis, add competing priorities (the CFO/quarter-end call, media inquiry, stale backup), and let the gap surface — "if participants are unsure, that IS the finding."
• Wrong room: only SOC analysts attend, so cross-functional gaps (after-hours CISO contact, ransom-payment authority, breach-notification timeline, PR holding statement) never get exercised. Confirm Legal, Comms, IT, and an exec/delegate are actually present and respond in-character.
• No follow-through: the most common failure — findings are logged but action items have no owner, due date, or tracking, so the same gap recurs next year. Verify every gap has an owner and date and is loaded into a tracker (ttx_action_items.csv) with overdue flagging.
• Verify the exercise worked: a hot wash captured one strength + one gap per participant, the AAR scores each objective, action items are assigned with dates, and a re-test (or the next quarterly TTX) confirms prior gaps were closed — not just re-discussed.

Prerequisites

• Exercise facilitator with incident response experience
• Participant list: SOC analysts (Tier 1-3), SOC manager, IT operations, Legal, HR, Communications
• Conference room or video call with screen sharing capability
• Printed or digital scenario injects with timed release schedule
• Evaluation scorecard for assessing participant responses
• Existing incident response plan and playbooks for reference during exercise