Running a breach tabletop exercise with a three-person team

A three-person team can test a breach plan without building a simulation platform. Choose a plausible incident, give participants incomplete facts and ask them to explain what they would do next. The exercise should reveal missing decisions and inaccessible information, not reward whoever remembers the most legal terminology.

A tabletop is a recommended preparation technique. It is not a universal DPDP requirement in this particular format. As of 22 October 2026, the main DPDP duties are scheduled for 13 May 2027 under the commencement notification, while existing incident requirements need their own current assessment.

Assign three useful roles

One person facilitates the scenario and introduces new facts. One coordinates the business response. One represents technical operations, including the supplier where relevant. If the team cannot cover a specialist question, record whom it would contact and whether that contact is actually available.

The facilitator should avoid answering every uncertainty immediately. Real incidents rarely arrive with a complete account history, a precise affected population and a confirmed cause. Participants should practise acting on what is known while assigning the unanswered questions.

Keep a separate note of decisions, assumptions and missing resources. This prevents the exercise from becoming an entertaining discussion whose useful findings are forgotten.

Begin with an ordinary operational failure

Use a hypothetical online florist. At 10 am, a customer says a delivery spreadsheet opens without signing in. The file includes names, phone numbers, delivery addresses and messages intended for recipients. The staff member who created it is away, and the supplier has not answered support chat.

Ask the coordinator to identify the first actions. Who can restrict the link? Who can determine the relevant file contents? Where should the initial report and screenshot be stored? Who decides whether additional expertise is needed?

Do not let the team solve the problem by inventing permissions it does not have. If only the absent employee can change sharing settings, that is a finding to repair after the exercise.

Introduce facts that challenge the plan

After ten minutes, say that the file has a hidden tab containing older orders. Ask how the scope assessment changes. Then say the platform’s available logs do not establish every viewer. The team should record uncertainty rather than assume either universal access or no access.

Next, introduce a supplier message saying a detailed investigation will take two days. Ask which decisions can wait and which cannot. Under the CERT-In Directions, covered entities must report specified cyber incidents within six hours of noticing or being brought to notice. The official FAQ allows available information first, with additional information later within a reasonable time.

For the future DPDP process, Rule 7 separates information to affected people and initial Board information without delay from the detailed Board update within seventy-two hours of awareness, or a longer period allowed by the Board on a written request. Ask participants to describe those routes separately.

Make communication part of the exercise

Request a short draft message explaining the known information, likely consequences, mitigation and a contact route. Identify any sentence that claims more certainty than the scenario supports. For example, “No one else viewed your information” cannot be inferred merely because the team lacks a complete access log.

Then introduce a customer who asks whether a sensitive personal message was included. Can the support team answer from the same evidence as the incident team? How will it escalate a new fact? This tests whether communication is connected to investigation rather than treated as a separate public relations task.

Also ask who can approve the message if the founder is unreachable. A process that requires an absent person’s approval for every action may fail when time matters.

Finish with a small repair list

Spend the final fifteen minutes separating observations from improvements. “The team discussed deletion” is an observation. “No one knew who could revoke the supplier’s link” is a concrete gap. “Assign and test a backup administrator by Friday” is an action.

Choose a manageable number of repairs, each with an owner and evidence of completion. Useful outcomes might include a verified supplier contact, an accessible reporting template, an accurate account list or a revised escalation route.

Keep the scenario, participants, decision notes and actions. Repeat a focused exercise after important changes or unresolved weaknesses, rather than scheduling elaborate sessions that the team cannot sustain. A modest rehearsal has done useful work when the next real incident involves fewer guesses about authority, facts and the route to timely action.