The National Cybersecurity Authority's Essential Cybersecurity Controls require regulated organizations in Saudi Arabia to maintain documented incident response capabilities and test them periodically. For most CISOs and security operations managers, the challenge is not writing an incident response plan—it is proving that the plan actually works when the pressure is on.
An NCA ECC incident response tabletop exercise is a structured, scenario-driven discussion that walks your technical teams and executives through a simulated security incident. Done properly, it reveals gaps in your procedures, clarifies roles, and produces the evidence of testing that regulators expect. Done poorly, it becomes a vague conversation that satisfies no one and leaves your organization no better prepared.
This article describes the four-phase structure we use to design and deliver tabletop exercises that meet NCA ECC requirements: scenario design, role assignment, simulation, and after-action reporting. Each phase has a specific purpose, and each produces a tangible output that strengthens your incident response capability.
Why NCA ECC Requires Tabletop Exercises
The National Cybersecurity Authority mandates that organizations establish and maintain an incident response capability. This includes documented procedures, defined roles, escalation paths, and regular testing. The intent is straightforward: when a ransomware attack, data breach, or fraud incident occurs, your team must know exactly who does what in the first hours.
A tabletop exercise is the most practical way to test this capability without disrupting operations. Unlike a full-scale simulation or live drill, a tabletop brings the right people into a room—or onto a video call—and walks them through a realistic scenario step by step. The facilitator injects events, asks questions, and observes how the team responds. The exercise surfaces misunderstandings, missing procedures, and unclear authority before they become problems during a real incident.
Regulators recognize tabletop exercises as evidence of periodic testing. When an auditor or NCA assessor asks how you validate your incident response plan, a documented tabletop exercise report is a credible answer.
Phase One: Scenario Design
The foundation of an effective tabletop exercise is a realistic, relevant scenario. The scenario must reflect the threats your organization actually faces, the systems you operate, and the regulatory obligations you carry.
We begin by assessing your current incident response capability and reviewing past incidents—not to assign blame, but to understand what has happened before and what gaps exist. This assessment informs the scenario design. A financial institution will face different scenarios than a healthcare provider or a government entity, and the exercise must reflect that context.
A well-designed scenario includes:
- Initial event: The first indication of a problem—an alert from a monitoring tool, a call from a customer, a report from a third party.
- Injects: New information that arrives as the scenario unfolds—forensic findings, additional affected systems, media inquiries, regulatory questions.
- Decision points: Moments where the team must choose a course of action—isolate a server, notify customers, escalate to the board, engage external investigators.
- Regulatory triggers: Events that require notification to the National Cybersecurity Authority, SAMA, or another regulator within a specified timeframe.
Common scenarios we develop include ransomware attacks, data breaches involving personal or financial data, and fraud incidents. Each scenario is tailored to the organization's environment, using real system names, actual roles, and plausible attack vectors.
The scenario is documented in a facilitator guide that includes the timeline, injects, expected responses, and discussion questions. This guide is not shared with participants in advance—they receive only the initial event, just as they would in a real incident.
Phase Two: Role Assignment
An incident response tabletop exercise involves two groups: the incident response team and the observers.
The incident response team includes the people who would actually respond to an incident:
- Security operations manager or incident response lead
- IT operations and system administrators
- Legal counsel
- Compliance or risk officer
- Communications or public relations
- Business unit representatives for affected services
- Executive sponsor (CIO, CISO, or designated executive)
The observers may include internal audit, external consultants, or senior management who want to understand the process without participating directly.
Before the exercise, we work with the CISO to confirm roles and assign participants. Each participant receives a brief description of their role, their authority, and the resources they control. This clarity is essential—confusion about who has the authority to shut down a system or approve a regulatory notification is a common failure point in real incidents.
We also prepare a contact and escalation matrix that lists each role, the person assigned, their contact details, and the escalation path. This matrix is used during the exercise and becomes part of the incident response plan afterward.
For organizations that want to test executive decision-making separately, we conduct a second tabletop session focused on board-level concerns: business impact, regulatory exposure, reputational risk, and communication strategy. This executive tabletop uses a condensed scenario and runs for a shorter duration, typically two hours.
Phase Three: Simulation
The simulation phase is the exercise itself. It typically runs for three to four hours, depending on the complexity of the scenario and the number of participants.
The facilitator opens with a brief overview of the exercise objectives, the scenario format, and the ground rules. Participants are reminded that this is a learning exercise, not a test, and that the goal is to identify gaps and improve the plan.
The facilitator then presents the initial event and asks the incident response lead: "What do you do first?" From that point, the exercise proceeds as a guided discussion. The facilitator injects new information at planned intervals, asks probing questions, and ensures that all participants contribute.
Key discussion areas include:
- Detection and triage: How was the incident detected? What is the initial assessment of severity and scope?
- Containment: What immediate actions are needed to limit the damage? Who has the authority to take those actions?
- Investigation: What forensic steps are required? Do you have the capability in-house, or do you need external support?
- Notification: Does this incident trigger a regulatory notification requirement? To whom, by when, and in what format?
- Communication: What do you tell employees, customers, partners, and the public? Who approves the message?
- Recovery: What is the plan to restore affected systems and resume normal operations?
- Documentation: What records are you keeping? What evidence are you preserving?
The facilitator takes detailed notes throughout the exercise, recording decisions, questions, disagreements, and gaps. These notes form the basis of the after-action report.
A well-run tabletop exercise is not a lecture. The facilitator guides the discussion but does not provide answers. The value comes from the team working through the scenario together, discovering what they know, what they do not know, and where the plan needs improvement.
Phase Four: After-Action Reporting
The final phase is the after-action review and reporting. Within one to two weeks of the exercise, we deliver a written report that includes:
- Exercise summary: Scenario, participants, date, and duration.
- Observations: What went well, what did not, and what was unclear.
- Gaps identified: Missing procedures, undefined roles, unclear authority, absent capabilities.
- Recommendations: Specific, actionable improvements to the incident response plan, playbooks, or supporting processes.
- Evidence of testing: Documentation that the exercise was conducted, who participated, and what was tested—suitable for regulatory review.
The report is reviewed with the CISO and the incident response lead. Together, we prioritize the recommendations and update the incident response plan and playbooks accordingly. This is not a one-time event—tabletop exercises should be conducted at least annually, and the plan should evolve as the organization's systems, threats, and regulatory obligations change.
The updated plan, playbooks, and contact matrix become the working documents for the next incident—and the next exercise.
What We Deliver
Our Incident Response Readiness & Tabletop Exercises service prepares your organization to respond to incidents with confidence and compliance. We assess your current capability and past incidents, then develop an incident response plan and a set of scenario playbooks covering ransomware, data breach, and fraud. We define roles, escalation paths, and regulatory notification procedures, then conduct tabletop exercises with both technical teams and executives. The engagement runs for four to eight weeks and delivers an incident response plan and policy, a playbook set, a contact and escalation matrix, and an exercise report with improvements.
When an incident does occur, our Digital Forensics & Incident Investigation service provides the specialist support needed to contain the incident, preserve evidence, investigate root cause and scope, and support regulatory reporting and recovery.
Closing
A tabletop exercise is not a formality. It is the most practical way to validate that your incident response plan works, that your team knows their roles, and that you can meet NCA ECC requirements for periodic testing. The four-phase structure—scenario design, role assignment, simulation, and after-action reporting—ensures that the exercise is realistic, relevant, and produces tangible improvements.
If your organization is preparing for NCA compliance or simply wants to strengthen its incident response capability, a structured tabletop exercise is the place to start. Know exactly who does what in the first hours of an incident, before the first hours arrive.
