It’s Monday morning, and a longtime client calls to ask why you emailed them a wire request on Friday. You never sent it, so who do you call first? Who decides whether to contact the custodian, warn other clients, or call your IT provider?
Most registered investment advisors (RIAs) have a written incident response plan, but a plan only proves its value once your team has practiced it. Cybersecurity tabletop exercises give you a low-cost, low-stress way to test that plan before a real attack does it for you. In this guide, you’ll learn what a tabletop exercise is, how to run one, and which threat scenarios make the most sense for your financial advisory firm.
| At a glance: What RIAs need to know about cybersecurity tabletop exercises – A tabletop exercise is a guided discussion where your team talks through a hypothetical cyber incident using your current plan. – These exercises expose gaps, such as outdated contact lists or unclear escalation paths, before a real emergency puts clients at risk – .Running at least one full exercise each year helps your firm show readiness under SEC Regulation S-P’s incident response requirements. – Free CISA templates and realistic scenarios such as business email compromise and ransomware make getting started simple for any RIA. |
What is a cybersecurity tabletop exercise?
A cybersecurity tabletop exercise is a discussion-based simulation of a hypothetical cyber incident. Key stakeholders walk through a made-up scenario step by step and talk about how they’d respond, using your firm’s existing incident response plan as a guide.
Nobody touches a keyboard or shuts down a server. You simply gather around a table or jump on a video call and work through each stage of the hypothetical incident, returning to the same question every step of the way: “What do we do next?”
It helps to know what a tabletop exercise isn’t:
- It isn’t a live technical test. Your systems stay running as usual.
- It isn’t a penetration test. Nobody tries to break into your network.
- It isn’t a pass/fail audit. The goal is learning, not grading anyone.
As the exercise unfolds, participants move through each stage of incident response: spotting the problem, containing it, removing the threat, recovering, and capturing lessons learned. If your firm hasn’t built the plan you’ll be testing yet, start with our guide on how RIAs can stay prepared with effective incident response and reporting.
What a tabletop exercise reveals that a written plan can’t
A plan can look complete on paper and still fall apart under pressure. Cybersecurity tabletop exercises give you a safe place to find those weak spots.
- They uncover gaps before a real emergency. Outdated phone numbers, missing vendor contacts, and uncertainty over who makes key decisions tend to surface only when the clock is ticking.
- They reduce panic. Teams that have rehearsed a crisis make calmer, faster key decisions when a real one hits.
- They improve communication. Advisors, operations, compliance, and executive leadership see how their roles connect, so everyone stays on the same page.
- They strengthen your security posture over time. Each session shows what to fix next, which steadily improves your organization’s ability to respond.
- They support IT compliance readiness. The SEC’s amendments to Regulation S-P require covered firms to maintain a written incident response program. With limited exceptions, firms must also notify affected individuals within 30 days of learning that their sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization.
The rule doesn’t specifically call for tabletop exercises. Still, walking through a scenario is one of the most practical ways to confirm your team can actually meet that 30-day window. Cyber insurance underwriters also tend to look favorably on firms that can demonstrate a tested plan.
If you want help lining up your plan with your IT compliance requirements, our IT compliance services are built for the wealth management industry.
How to run a tabletop exercise for your incident response plan
You don’t need a big budget or a dedicated cybersecurity team to run a useful session. Just follow these six steps.
Step 1: Set clear objectives
Decide what you want to test before you pick a scenario. Good objectives might include your client notification process, your escalation paths, or how quickly you can restore your CRM. Stick to two or three objectives per session so the discussion stays focused.
Step 2: Bring in the right participants
Invite a cross-section of your firm. That usually means principals or leadership, your chief compliance officer, operations staff, client service team members, advisors, and your outsourced IT provider.
Assign a few simple roles, based on guidance from the Cybersecurity and Infrastructure Security Agency (CISA):
- Participants: Discuss the scenario and make decisions
- Facilitator: Presents the scenario and keeps the discussion on track
- Notetaker or evaluator: Records who decided what, and why, without stepping in
- Observers (optional): Watch quietly and share suggestions afterward
Step 3: Build a realistic scenario
Base your scenario on real-world threats your firm actually faces. To keep things engaging, release new details in stages. For example, a second client reports a strange email, or a reporter calls asking questions.
You don’t have to start from scratch. CISA offers over 100 free tabletop exercise packages. Each one works like a ready-made cybersecurity tabletop exercise template, with sample objectives, discussion questions, a feedback form, and after-action report resources. The library also covers physical security topics, such as improvised explosive devices, but RIAs will get the most from CISA’s cybersecurity-based scenarios on ransomware, phishing, and insider threats.
Step 4: Run the session
The facilitator walks the group through the scenario one phase at a time. Use discussion questions that force real choices:
- Who has the authority to shut down email access?
- When do we contact our cyber insurance carrier?
- Who writes the client notice, and who approves it?
Step 5: Hold a hot wash
A “hot wash” is a quick debrief right after the exercise, while details are still fresh. Ask what worked, what didn’t, and what’s missing. Then hand out a short feedback form so quieter participants can share their thoughts too.
Step 6: Turn findings into action
Write a brief after-action report that lists each gap, assigns an owner, and sets a deadline. Then update your plan, contact lists, and training. Many gaps trace back to unclear rules, so it’s worth reviewing why RIAs need a comprehensive security policy.
Choosing the right exercise format and length
There’s no single right length. The best format depends on your goals, your organization’s size, and who’s in the room. The time ranges below are common examples and will vary by scope.
| Format | What it covers | Typical length |
| Rapid-fire | One decision point, such as “someone clicked a phishing link” | 10–30 minutes |
| Standard tabletop | A full walkthrough with your core response team | 60–90 minutes |
| Technical-focused | Your IT provider and operations on containment and recovery | 1–2 hours |
| Full stakeholder | Leadership, compliance, client service, IT, and key vendors | 2–4 hours |
As a good rule of thumb, aim for at least one comprehensive exercise each year. Add shorter sessions after big changes, such as switching custodians, adopting a new CRM, moving offices, or replacing someone in a key role.
Sample cybersecurity tabletop exercise scenarios for financial firms
We wrote the scenarios below with RIAs in mind. They cover several of the same threats as CISA’s free tabletop exercise packages, including phishing, ransomware, and insider threats. If you want ready-made facilitator materials, such as feedback forms and after-action report templates, you can pair any of these scenarios with the matching CISA package.
Phishing and business email compromise
Setup: An advisor falls for a phishing attack, and a criminal gains access to their mailbox. The attacker replies to a real email thread and asks a client to wire funds.
Discussion questions:
- How fast can we lock the account?
- Who calls the client and the custodian?
- Does this trigger our notification obligations?
Ransomware attack
Setup: Staff arrive to find files locked on shared drives and cloud storage, with a ransom message on every screen. Client meetings start in an hour.
Discussion questions:
- Who decides whether to disconnect systems?
- How recent is our last clean backup, and has anyone tested the backup process?
- What do we tell clients today about the ransom demand?
Older computers and unsupported software make this scenario far more likely, which is one of the hidden costs of outdated IT for RIAs.
Insider threats
Setup: A departing employee downloads client lists to a personal device the week before joining a competitor. Misconfigured permissions gave them access to files they never needed.
Discussion questions:
- How would we even notice?
- Who handles the HR and legal steps?
- What’s our process for removing access on someone’s last day?
Third-party vendor or supply chain incident
Setup: Your financial planning software provider announces a breach that may include your clients’ data.
Discussion questions:
- Do we have the vendor’s incident contact on file?
- What does our contract require them to tell us, and when?
- How do we meet our own deadlines when the vendor controls the facts?
Making tabletop exercises a habit
A tabletop exercise turns a plan on paper into a response your employees can carry out with confidence. To keep the momentum going, put the next session on the calendar now, rotate scenarios each time, and check whether last year’s gaps were actually fixed. Pairing your exercises with a regular IT risk assessment helps you pick scenarios based on your firm’s real weak spots.
RIA WorkSpace helps registered investment advisors build, test, and strengthen their incident response plans as part of our managed IT and compliance support. Schedule a discovery call to talk through where your plan stands today and how a tabletop exercise can uncover gaps before an attacker does.