A tabletop exercise is a scheduled rehearsal of the incident runbook, held for each response tier before a real incident arrives. In the Incident Runbook and Tabletop Program, the team runs the first quarterly tabletop per tier and records results against Incident Response Readiness. Every gap the exercise finds goes into the runbook the same week.
Why an Untested Runbook Leaves the Owner Exposed
The Cyber, Data Privacy, and Security module sits inside the VWCG OS framework that World Consulting Group applies with owners. Its diagnostic scores each dimension on a 0 to 5 scale against written anchors that describe low, middle, and top readings. Every dimension carries an equal weight of 0.20, and the composite score is a weighted sum. Incident Response Readiness is the dimension that the Incident Runbook and Tabletop Program serves.
The lowest written anchor for that dimension describes a business with no runbook or with an untested plan. That anchor adds a blunt observation about such a business: its first incident becomes its first rehearsal. A tabletop exercise moves that first rehearsal ahead of the real event, inside a planned session instead. The middle anchor describes a documented runbook, irregular tabletops, and an escalation matrix that has gone stale.
The top anchor describes quarterly tabletops that run with their lessons fed back into the runbook afterward. At that level, response windows are honored in exercises, and the escalation matrix stays current in the SOP Codex. Those anchors describe the dimension itself, not the playbook, and a scorer reads them at each scoring. An owner can read the anchors as a plain ladder from an untested plan to a rehearsed one.
Used as an outside lens, the theory of constraints could ask which response step would fail first under pressure. The method answers that question through its own tools: the three-tier runbook, the tabletop, and the scored dimension. Those tools stay inside the module, and the outside lens only helps an owner think about weak links.
What Triggers the Program
A red reading on Incident Response Readiness opens the Incident Runbook and Tabletop Program for its owner. Red covers scores from 0.0 up to but not including 2.0 on the module scale. The program also triggers on a runbook that is missing or untested, or on response windows unknown to responders. Any of those conditions is enough to start the work under the written method.
A red reading on this dimension also fires routes into the Change Enablement Sprint and the SOP Codex. The first of those modules runs security-awareness retraining for teams involved in human-factor incidents. The SOP Codex route maintains the escalation matrix as a coded SOP with a 90-day review. Those routes run beside the program and answer the same red reading from training and documentation.
Each owner runs at most three red playbooks at once, and further reds wait in a queue. That queue ranks reds by how many modules the red dimension routes into across the method. The Incident Runbook and Tabletop Program is a safety playbook, and safety playbooks never queue behind other work. An owner holding three red playbooks would still open this program on a red reading.
Writing the Three-Tier Runbook
The program writes the three-tier runbook, the document that each tabletop then tests in practice. Tier 1 covers triage within the first hour, which the dimension records as a window of 0 to 1 hour. Investigation and response fall under Tier 2 through 24 hours, a window running from 1 to 24 hours. Tier 3 covers recovery through 2 weeks, a window that runs from 24 hours to 2 weeks.
Those tier windows do not stay fixed in every condition, because the dimension states that they compress. Windows compress when Intelligent Foundations reads red, and the runbook must reflect the compressed windows when that happens. A tabletop that rehearses the standard windows during a compressed period would rehearse the wrong clock for responders.
Consider a small business that writes its runbook for the first time after a red reading on this dimension. The team could start with Tier 1 and describe what triage means for its own systems and people. It would then extend the document through investigation and response, and finish with recovery steps for Tier 3.
Setting the Notification Window
The program also sets the regulatory notification window inside the three-tier runbook, beside the tier windows. The standard window runs 72 hours, and it compresses to 24 hours on an Intelligent Foundations compliance-baseline red. An inbound route from Intelligent Foundations carries the same rule into this module whenever the compliance baseline turns red. That route also defaults customer personal data to the Restricted tier of the classification matrix.
The method treats these windows as operating rules that responders must know before an incident begins. What any notification duty requires in a specific situation remains a question that needs legal counsel. An owner should bring counsel into the runbook work wherever legal exposure could arise from an incident.
Ready for the Next Step?
The next guide on this site covers a closely related system: Cybersecurity for Small Business: What a Breach Actually Costs and What Actually Stops One.
Publishing the Escalation Matrix
The program publishes the escalation matrix as a coded SOP inside the SOP Codex module. That coded SOP sits on the 90-day review, the same review cycle named in the dimension itself. A stale matrix counts as a sign of partial readiness under the middle anchor for this dimension. The top anchor treats a current matrix in the SOP Codex as part of full readiness.
The red route into the SOP Codex reinforces the same duty from the documentation side of the method. That route maintains the escalation matrix as a coded SOP with the 90-day review attached. Both the program and that route treat the matrix as a coded SOP on the same review cycle.
Running the First Quarterly Tabletop
The program runs the first quarterly tabletop per tier against the runbook, its windows, and the matrix. Each tabletop uses the Change Enablement Sprint framework, which the module names as the framework for these exercises. Results from each tabletop are recorded against Incident Response Readiness, the dimension that triggered the program. Every gap the exercise exposes is logged into the runbook the same week, not saved for later.
Imagine a small business owner who schedules the first tabletop for Tier 1 once the team writes the runbook. The team could talk through a suspected breach and check who acts within the first hour. Any gap the group found would go into the runbook that same week under the program rule.
The same team could then run a separate tabletop for Tier 2 and another for Tier 3 recovery. Each session would test whether responders know the window that applies to their tier at that moment. Results from every tier would land against the same dimension and inform its next scoring.
Owners who still need groundwork on threats and defenses could first read this guide to cybersecurity for a small business, which covers the basics. That broader groundwork sits outside the playbook, which focuses on the runbook, the windows, the matrix, and the tabletop.
Outcome, Owner, and Duration
The program states its outcome in parts that an owner can check in turn. First, the runbook is live with current windows, and the escalation matrix is coded in the SOP Codex. The first tabletop is completed with lessons incorporated, and results are recorded in Incident Response Readiness. Owners can treat those parts as a closing checklist for the program.
The CISO owns the program together with an incident commander designate, and the stated duration is 4 weeks. Used as an outside lens, a RACI chart could help a business record who supports those roles. The method itself names only the CISO and the incident commander designate as owners of this program.
Every playbook in the method follows the same lifecycle: open, running, met or missed, escalated, and closed. A trigger that arrives while the program is open is logged against the open run. An outcome met, with an independent re-score at amber or better, closes the run for the owner. The owner’s next queued red then opens, and the cap of three red playbooks still applies.
An outcome missed at the end of the stated duration escalates to the owner’s manager. The same miss also goes onto the next Core Execution quarter planning agenda. Someone other than the owner re-scores the dimension, and the run closes only on a met outcome with that re-score at amber or better.
After the Build: Amber and Green
Amber covers scores from 2.0 to 3.5 inclusive, and every amber dimension routes to Security Posture Monitoring. That standing playbook runs 30-day pulse checks for each amber dimension under the CISO as owner. It also runs the quarterly tabletop, and it audits PIA gating by sampling go-lives across the Integrated Tech Stack and AI Deployment Canvas. Monthly security KPI reviews with the COO and the quarterly threat model review sit in the same playbook.
Green covers scores above 3.5 up to and including 5.0 on the module scale. A green dimension holds and is monitored quarterly through the Core Execution module. When a red playbook outcome is met, any standing duty it set up continues under the standing playbook. That standing playbook does not count toward the cap of three red playbooks for any owner.
How the Tabletop Connects to the Rest of the Module
Incident Response Readiness sits beside other dimensions in the module, and several touch the same response work. Security KPI Integration places four KPI categories on the KPI Precision Grid dashboard with traffic-light thresholds. Those categories cover detection, response, prevention, and compliance, and a red MTTD reading routes to the CISO and COO. That routing runs through the Variance Alert Engine in the KPI Precision Grid module.
Data Classification Enforcement uses the four-tier classification matrix: Public, Internal, Confidential, and Restricted, each with handling rules. PIA Gating routes all four trigger events through a Privacy Impact Assessment before any go-live takes place. Those events are a new system, a new collection, a third-party integration, and a new AI model.
Each assessment uses the five-part framework of data and purpose, legal basis, flow mapping, risks, and mitigations. Red readings on classification or PIA gating open Classification and PIA Activation, a safety playbook with a stated duration of 5 weeks. Together these dimensions give the tabletop a module around it, and each keeps its own scored anchors.
Frequently Asked Questions
What is a tabletop exercise in the Incident Runbook and Tabletop Program?
A tabletop exercise is a scheduled rehearsal of the incident runbook, held for each response tier. The program runs the first quarterly tabletop per tier with the Change Enablement Sprint framework. Results are recorded against Incident Response Readiness, and every gap goes into the runbook the same week. The exercise rehearses the plan ahead of a real incident.
What triggers the Incident Runbook and Tabletop Program?
A red reading on Incident Response Readiness triggers the program, along with a missing or untested runbook. Response windows unknown to responders also trigger it. Red covers scores from 0.0 up to but not including 2.0. The program is a safety playbook, so it never waits in the queue behind other red playbooks.
What are the three tiers in the incident runbook?
Tier 1 covers triage within the first hour, a window of 0 to 1 hour. Tier 2 covers investigation and response through 24 hours, a window of 1 to 24 hours. Tier 3 covers recovery through 2 weeks, from 24 hours to 2 weeks. Those windows compress when Intelligent Foundations reads red.
How long is the notification window in the runbook?
The runbook sets the regulatory notification window at 72 hours as the standard rule. That window compresses to 24 hours on an Intelligent Foundations compliance-baseline red. Responders must know which window applies before an incident begins. What a notification duty requires in a specific case is a question that needs legal counsel.
Who owns the program and how long does it run?
The CISO owns the program together with an incident commander designate, and the stated duration is 4 weeks. The outcome is a live runbook with current windows, a matrix coded in the SOP Codex, and a completed first tabletop. Someone other than the owner re-scores the dimension before the run closes.
How does a small business owner begin tabletop exercise work?
An owner can begin with a review of Incident Response Readiness on the 0 to 5 scale. World Consulting Group delivers the VWCG OS service, and an engagement applies the Incident Runbook and Tabletop Program. That work covers the three-tier runbook, the windows, the escalation matrix, and the first quarterly tabletop.
