Security Crisis Exercises and Tabletop Simulations | CloseProtectionHire

A crisis plan that has never been tested is not a plan. It is a document of intentions. The difference between a document and a response capability is an exercised team that has been through the scenario before – not in an actual incident, but in a controlled environment where the mistakes can be identified and corrected without consequence.

Most corporate security plans do not meet this standard. ISO 22301:2019 requires exercises at planned intervals. In practice, many organisations complete their first exercise when an incident has already happened, or when their insurer requires evidence of exercising as a condition of a policy renewal.

The ISO 22301 Exercising Requirement

ISO 22301:2019 (Business Continuity Management Systems), Clause 8.5, requires organisations to plan and perform exercises to confirm that business continuity procedures are effective and consistent with the business continuity objectives. The exercises must be scheduled at planned intervals and must be triggered additionally by significant organisational changes.

Clause 9.1 requires documented information on the results of those exercises. Clause 10.2 requires nonconformities identified through exercising to be subject to corrective action. The standard does not prescribe the frequency or format of exercises – this is intentional, because the appropriate exercise programme depends on the complexity of the organisation and the severity of the risks it faces.

The BCI Good Practice Guidelines 2024 (8th Edition), Chapter 7, provides a structured approach to exercise design that is aligned with ISO 22301. It defines five types: workshops and orientations (familiarisation, no activation); tabletop exercises (scenario discussion, no physical activation); functional exercises (specific function testing with real actions); full-scale exercises (full activation of resources); and live exercises (external agency involvement). Each type provides different value at different cost.

NCSC Exercise in a Box, launched in 2018 and refreshed in 2024, makes a practical tabletop exercise programme accessible to organisations that have no dedicated continuity function. The tool provides facilitator guides, participant materials, and structured scenario packs for cyber incident response. It does not cover physical security scenarios but is an appropriate model for organisations developing their first exercise programme.

Tabletop Exercises: Design Principles

A tabletop exercise seats the crisis management team around a table (or a virtual equivalent) and presents a scenario that unfolds through a series of injects. The facilitator introduces developments – a new piece of information, an escalation, a media contact, a new stakeholder – and the team responds by discussing what they would do.

The most common failure in tabletop design is building a scenario that is too comfortable. When participants know how the scenario will develop, they manage the scenario rather than managing the crisis. The exercise should create genuine uncertainty, withhold information that the team would not have in a real incident, and introduce injects that force decisions before the team has the information they want.

Control Risks 2025 identifies two design principles that most organisations fail to apply: first, the scenario should start before the crisis is confirmed – with ambiguous information, partial reporting, and the first notification coming from an unexpected source. Second, the scenario should include a media or reputational dimension that runs in parallel with the operational response, forcing the team to manage both simultaneously.

For organisations with K&R exposure – those with staff or principals in P1 cities – Kroll Crisis Management 2024 recommends running a dedicated K&R tabletop exercise as a standalone programme, not combined with a broader business continuity exercise. The K&R scenario requires a specific subset of the crisis team, involves different decision-rights (particularly around ransom payment authority), and has confidentiality requirements that make it unsuitable for a combined exercise with general business continuity participants.

K&R Exercise Structure

A K&R tabletop exercise has five mandatory components that must each be tested:

Notification and first response (0-30 minutes). How does the organisation learn that a principal has been taken? The answer is rarely a direct call from the kidnappers – it is more commonly a missed check-in, a report from a colleague, or a call from a local contact. The team must practise the first 30 minutes: confirming the information, activating the K&R insurer’s crisis consultancy, and establishing a command and communications structure before the media or the family are aware.

Crisis team activation. Who is on the team? Who is the decision-maker with authority to engage the response? Is the K&R policy document accessible to the correct person at 3am? Does everyone on the team know their role? Control Risks and Kroll consistently identify confusion about decision-rights as the most significant initial team dysfunction in real incidents.

Family communication. The family liaison function is distinct from the crisis management function and must be exercised separately. The family must be briefed on: media silence as a condition of effective response, the verified-caller protocol (accepting calls only on pre-agreed numbers from pre-identified consultancy contacts), and the prohibition on social media commentary during an active response. Kroll Crisis Management 2024 records multiple incidents where well-intentioned family social media activity – asking for prayers, sharing news – confirmed the principal’s value, attracted competing criminal groups, and compromised the response within hours.

Media management. The holding statement, the single authorised spokesperson, and the social media monitoring procedure must all be exercised. A real incident will generate media pressure within hours. The team that has never agreed a holding statement in a simulated environment will struggle to produce one under real time pressure.

Resolution and recovery. When an incident ends – however it ends – what is the handover protocol? Who briefs the family? Who manages the media? What is the psychological support plan for the principal, the family, and the crisis team members? ISO 22301:2019 and ASIS Business Continuity Management Standard 2023 both require post-incident learning to be captured and used to update the plan.

Full-Scale Exercises

A full-scale exercise activates physical resources and response teams rather than discussing decisions in a room. For organisations with residential security infrastructure, it might mean a simulated perimeter breach with a live alarm response. For organisations with medical evacuation plans, it might mean activating the MEDEVAC provider and confirming response times.

The CPNI Crisis Exercise Guidance 2024 recommends that full-scale exercises for organisations with physical security responsibilities include a live communications test, a command post activation, and a deliberate degraded-environment scenario – testing what happens when normal communications fail and the team must operate on backup systems.

The value of a full-scale exercise is not that it tests the plan – tabletops do that more efficiently. It is that it tests the human performance of the response team under realistic time pressure, with realistic information gaps, and with the physical systems that the plan relies on actually running.

The FEMA ICS system, developed for US emergency management, provides a scalable incident command framework that has been adapted by UK organisations for crisis management. Its core disciplines – establishing a unified command, dividing the response into functional sections, maintaining documentation of decisions – are applicable to corporate crisis exercises regardless of whether the scenario is terrorism, kidnap, or critical IT failure.

For organisations that do not yet have a crisis exercise programme, the appropriate starting point is a 90-minute tabletop with the crisis management team, focused on a single scenario relevant to the organisation’s actual risk profile. See the related article on corporate crisis management and security incidents for the broader framework, and personal emergency response planning for the individual equivalent.

James Whitfield is a Senior Security Consultant with 20 years of experience in executive protection, threat assessment, and corporate security across the UK and internationally.