A SAMA CSF incident response tabletop exercise usually spends its time on the technical story: how the attacker got in, what to isolate, when to restore. That matters. But in a real incident at a SAMA-regulated institution, the team is also working against a notification obligation, and that part of the playbook is rarely rehearsed. This article sets out four playbook steps your exercise should test under simulated notification pressure, and an observation scorecard that shows whether your team can produce a usable draft report within a two-hour exercise window.
Why notification belongs inside the exercise
SAMA expects regulated institutions to manage cyber incidents within the resilience and incident-management expectations of the SAMA Cyber Security Framework (CSF). Those expectations include timely reporting to the regulator. Confirm the current deadlines and the required report format against SAMA's latest instructions before you design the scenario, and write them into the exercise brief rather than relying on memory.
The common failure is not ignorance of the obligation. It is that nobody has ever drafted the report while the incident was still unfolding, with incomplete facts, and with executives asking for answers. A tabletop is the cheapest place to find that out.
Designing the exercise
Keep the scenario realistic but narrow. A data breach or ransomware scenario with a confirmed impact on customer data works well because it forces a notification decision. Plan the exercise in three parts:
- A scenario briefing of about ten minutes, with a fixed start time on the exercise clock.
- Timed injects released at set points, each adding new facts or new pressure, such as a call from a senior executive or a media enquiry.
- A two-hour window in which the team must produce a draft regulatory report from what it knows at that point.
Assign one observer to each of the four steps below. Observers record what happened; they do not coach.
Step 1: Initial classification
Classification decides everything that follows: severity, who is woken up, and whether a regulatory clock has started. Test whether participants can:
- Apply your documented severity criteria to partial information, rather than waiting for certainty.
- State explicitly whether the event meets the threshold for regulator notification, and who made that call.
- Record the time of detection and the time of classification, since both will be asked for later.
Inject conflicting information early, for example an initial alert that understates the scope. Watch whether the team reclassifies and logs the change.
Step 2: Stakeholder escalation
Escalation is where playbooks meet people. Test whether participants can:
- Reach the right individuals using the contact and escalation matrix, not personal memory.
- Bring in legal, compliance, communications and the business owner at the right time.
- Identify who is authorised to approve and submit the regulatory report, and who deputises when that person is unavailable.
Make one key person unreachable during the exercise. A plan that works only when everyone is present is not yet a plan.
Step 3: Evidence collection
A report to the regulator is only as good as the facts behind it. Test whether participants can:
- Preserve logs, images and system state before containment actions destroy them.
- Keep a chain of custody and a timeline that distinguishes confirmed facts from assumptions.
- Say what is still unknown, and when it is likely to be known.
Many teams discover here that containment and evidence preservation pull in opposite directions. Decide in advance who resolves that conflict, and observe whether they do.
Step 4: Draft reporting
This is the step most exercises omit. Hand the team your report template, or the current SAMA reporting format, and require a draft by the end of the two-hour window. Test whether participants can:
- Populate the template from the incident timeline without re-investigating from scratch.
- Describe impact, affected services and data, and actions taken in plain, accurate language.
- Mark unconfirmed items clearly and commit to an update.
- Pass the draft through a defined review and approval path.
The observation scorecard
Score each item from 0 (not done), 1 (done late or incompletely) to 2 (done on time and complete). Record the exercise-clock time against each item.
- Classification: severity assigned; notification threshold decision stated and owned; detection and classification times logged.
- Escalation: matrix used; legal, compliance and communications engaged; approver and deputy identified; unreachable contact handled.
- Evidence: preservation before containment; timeline separating fact from assumption; chain of custody noted; open questions listed.
- Draft report: template completed; impact described accurately; unknowns flagged; review and approval completed within the two-hour window.
Add two free-text fields: what slowed the team most, and which playbook instruction was missing or unclear. Those answers, not the numeric score, drive the improvement actions. Compare scores across annual exercises to show the board whether readiness is improving.
How we approach this
Our Incident Response Readiness & Tabletop Exercises service prepares your organization to respond, covering the incident response plan and playbooks, roles and escalation, regulatory notification, and tabletop exercises for technical teams and executives. We work through four stages: assess current capability and past incidents, plan the plan, roles and playbooks, run the tabletop with technical teams and executives, and improve through lessons learned and plan updates. The engagement runs as a project of 4–8 weeks and is aligned to SAMA CSF and NCA ECC. Deliverables include the IR plan and policy, a playbook set, a contact and escalation matrix, and an exercise report with improvements.
Where an incident needs investigation, our Digital Forensics & Incident Investigation work helps preserve evidence and supports regulatory reporting. Where resilience testing extends to recovery, our Business Continuity & Cyber Resilience work follows SAMA BCM and cyber resilience requirements.
Next step
If your last exercise ended at containment, your next one should end with a draft report on the table. Speak with us about an Incident Response Readiness & Tabletop Exercises engagement, and we will help you build the scenario, the notification procedure and the scorecard around your own institution.
