Choose a scenario with business consequences
Consider a compromised administrator during the busiest sales hour or a supplier outage that blocks customer communications. State what is known, what is uncertain and which services may be interrupted. The objective is not to embarrass employees. It is to discover decisions with no clear owner, dependencies nobody has tested and recovery assumptions that are still only words in a document.
Invite every decision maker
Bring security, technology, customer service, communications, legal and an executive who can authorize trade-offs. Ask who declares an incident, pauses changes, contacts suppliers, preserves evidence and approves customer messages. Add new information throughout the exercise: a customer report, an uncertain recovery estimate or an indication of unauthorized data access. Record each decision and the time it took.
Follow the path to recovery
An exercise must not end when an account is blocked. Check backup restoration, credential renewal, data integrity and criteria for resuming normal operation. Ask what customers should hear when there is uncertainty. Confirm that supplier contact details and alternative processes still work. Recovery is a service outcome, not simply a server returning to a healthy status.
Leave with accountable actions
Publish an internal register of failed assumptions, assigned owners, deadlines and follow-up tests. Separate documentation edits from changes demonstrated in the environment. Repeat the scenario after significant architecture or provider changes. A tabletop earns its place when it reduces ambiguity before a real outage.