An NCA ECC incident response tabletop exercise is often treated as a box to tick: a meeting, a scenario, a slide deck and an attendance list. Yet the question an assessor or an executive committee will eventually ask is not whether a procedure exists. It is whether your people can carry it out within the time the situation allows. Many incident-response plans pass document review and then struggle when execution time is tested with real role-players.
This article describes five playbook steps that a tabletop exercise should validate under a timer, and the timestamped evidence format that shows execution rather than intention. The National Cybersecurity Authority (NCA) sets expectations for incident management in its Essential Cybersecurity Controls (ECC). Confirm the exact notification windows and reporting channels applicable to your entity against current NCA requirements and any sector regulator instructions before you design the exercise.
Why process existence is not enough
A written playbook answers the question "what should happen". A timed exercise answers "how long does it take, and who is actually available". The gaps tend to appear in the same places: an escalation path that names a role nobody has covered out of hours, a notification template that needs legal review nobody has scheduled, or a containment decision that requires an approver who has never seen the scenario.
To expose these gaps, the exercise needs three things: named role-players in their real roles, a facilitator who controls the clock and injects new information, and a scribe who records what happened and when.
The five playbook steps to validate
1. Initial triage
Validate how quickly an alert or report becomes a classified incident with an owner. Start the clock when the first signal reaches the first person, not when the exercise begins. Check:
- Who receives the signal, and how they reach the incident lead
- Which criteria set severity, and whether the role-player applies them consistently
- How long it takes to declare the incident formally
2. Containment decision
Containment usually trades security against service availability, so it needs a decision-maker with authority. Test whether the technical team can present options and consequences in plain language, and whether the business owner can decide without delay. Record the time from options presented to decision made, and who made it.
3. Evidence preservation
Under pressure, teams restore services first and lose the evidence that explains what happened. Inject a request to rebuild a system early and observe whether the playbook stops, delays or documents the action. Check that logs, images and volatile data are captured, that chain of custody is recorded, and that someone is accountable for it.
4. Regulator notification
This is the step most often unproven. Do not stop at confirming that a procedure exists. Require the role-players to produce an actual draft notification from the facts available at that point in the scenario, route it through the real approvers, and record how long that takes. Note where information is missing and how the draft handles uncertainty. Measure the elapsed time against the reporting window that applies to your entity.
5. Stakeholder communication
Test internal and external messaging: executives, staff, customers or citizens, partners and, where relevant, the media. Check that spokespeople are named, that messages are consistent with the regulator notification, and that a holding statement can be approved quickly. Inconsistent messages across audiences are a common finding even when each message is individually reasonable.
The evidence format that proves execution time
Evidence of a good exercise is a record that a third party could read and reconstruct. We suggest four artefacts, each with timestamps in a single agreed time zone:
- Decision log: each decision, the options considered, the decision-maker, the time of the decision and the time it was communicated.
- Notification drafts: the actual draft produced during the exercise, with version times, approver names and the time of simulated submission.
- Escalation records: who was contacted, by what channel, when, when they responded, and any contact that failed.
- Timeline summary: a consolidated view of the five steps showing elapsed time between milestones and the variance against your target for each.
Keep the originals, not only a tidied summary. Finish with a short findings table in your exercise report, listing each gap, an owner and a due date. Assessors and boards respond better to a documented gap with a dated fix than to a flawless-looking exercise with no timing data.
Running the exercise
A practical sequence is:
- Fix the scenario and the timing targets in advance, based on your plan and your notification obligations.
- Brief role-players on their real roles, not on the answers.
- Run the scenario with the facilitator injecting developments and the scribe logging times.
- Hold an immediate debrief while memory is fresh.
- Convert findings into plan and playbook updates, then retest the weakest step.
Run separate sessions for technical teams and executives, or a combined one with distinct phases, because the decisions and delays differ between them.
How CISO Consulting supports this
Our Incident Response Readiness & Tabletop Exercises service is built around this sequence. We prepare your organization to respond: incident response plan and playbooks, roles and escalation, regulatory notification, and tabletop exercises for technical teams and executives. The work follows four stages: assess current capability and past incidents, plan the plan, roles and playbooks, exercise through a tabletop with technical teams and executives, and improve through lessons learned and plan updates. The service covers scenario playbooks for ransomware, data breach and fraud, and it is mapped to NCA ECC and SAMA CSF.
Deliverables include the IR plan and policy, a playbook set, a contact and escalation matrix, and an exercise report with improvements. The project typically runs 4–8 weeks. Where an incident is real rather than rehearsed, our digital forensics and incident investigation work helps contain it, preserve evidence and support regulatory reporting.
Closing
If your plan has passed review but has never been timed, the exercise is the next step. Our aim is that your team knows exactly who does what in the first hours of an incident, and can show it. To discuss an NCA ECC tabletop for your organization, speak with CISO Consulting about Incident Response Readiness & Tabletop Exercises.
