By Hannah Finley, corporate compliance officer, Locknet Managed IT
Many community banks have business continuity and incident response plans. They were written carefully, approved by the board, and provided to examiners on request. Far fewer have walked through it effectively with the people who would need to carry it out.
That distinction matters. Incidents rarely arrive during business hours or in the order a plan describes. They show up late on a Friday, over a holiday weekend, or while the one person who knows the firewall is on vacation.
A tabletop exercise is an efficient way to find out how a plan holds up before it has to. It doesn’t require special software, a large IT staff, or thousands of dollars. It requires a realistic scenario and the right people in the room.
The exercise belongs to the bank
For institutions that rely on outside partners for IT, security, or core processing, it’s tempting to assume one of those partners should organize the tabletop. But that isn’t the case. An exercise planned by a vendor tends to test the vendor’s process, not the bank’s.
The stronger model is for the bank to plan and lead the exercise, then invite its partners to take part. Most providers welcome the invitation. It shows them exactly where they fit in your response plan, and it shows you what they will and won’t handle when the call comes.
Who should be in the room
A functional tabletop includes the people who would make or carry out decisions during a real incident:
- Executive leadership, with the authority to make calls in real time
- Your internal IT point person, even if that role is only one person
- Compliance and operations, who know the notification timelines and customer impact
- Communications leader, or someone who can communicate with both customers and employees
- Outside partners such as your IT or security provider, core processor, legal counsel, and cyber insurance carrier, or at minimum their current contact information
Choose a facilitator to move the scenario forward and a separate note-taker to capture every question that doesn’t get a clear answer.
A scenario to consider
It’s 4:45 p.m. on a Friday. A customer calls a loan officer to ask about an email requesting updated wire instructions. The email came from the loan officer’s own account. The loan officer didn’t send it.
The facilitator then walks the group through the timeline, revealing new details at varying points of the exercise. Example:
- The first 30 minutes. Who gets told, and how? Who has the authority to declare an incident? Can someone disable the account and reset credentials right now? If your IT lead doesn’t answer the phone, who is next?
- Friday evening. IT finds a login from an unfamiliar location and a rule forwarding mail to an outside address. What are your next steps? Who are you telling at this point and who is responsible for those communications?
- Saturday morning. A customer reports that they already wired funds. Now what? Who is documenting what is happening?
- Monday. What do you tell staff reporting to work? Are talking points available for them? What other regulatory reporting is needed?
Resist the urge to solve every question in the room. The goal is to surface them.
What happens after matters most
The value of a tabletop shows up in the follow-through. The note-taker’s list should become a short action plan with every gap, owner, and a deadline identified. Common findings might include outdated phone numbers, decisions nobody clearly owned, and responsibilities each party assumed the other would handle.
Update your plans to reflect what you learned, share with the board, and keep the documentation. You need evidence that a plan has been tested, not just written.
Then schedule the next one.
A tabletop that surfaces three gaps hasn’t failed. It has done exactly what it was designed to do, on your timeline instead of an attacker’s.
Resources
You do not need to build a tabletop exercise from scratch. The Federal Emergency Management Agency (FEMA) and the Cybersecurity and Infrastructure Security Agency (CISA) offer free planning guidance, templates, and ready-to-use exercise materials that can help banks design, facilitate, and document a tabletop.
Simple tools can introduce useful variation into the exercise:
- Use preprinted cards with new facts, such as a power outage, five staff absences, or a ransomware attack. Draw a card and have the group respond to the new development.
- Use a standard die to answer yes-or-no questions (even = yes; odd = no). For example: “The bank asks additional staff to help answer phones on Saturday. Are they available?”
And remember, it is far more important to conduct a robust test of your preparedness than a perfect one.
