A breach tabletop exercise is a discussion of how your firm would handle a realistic security incident. It tests decisions, responsibilities, and communication without attacking live systems. For a small accounting firm, one focused scenario and a written follow-up log are a practical place to start.
The aim is to find gaps before a real incident exposes them: an outdated contact number, an unclear authority to isolate a device, or a backup that nobody knows how to restore.
Key takeaways
- Use one realistic fictional scenario to test decisions without changing live systems.
- Assign incident, IT, communication and approval responsibilities before the exercise.
- Assess notification duties from the event facts rather than assuming one deadline fits every incident.
- Turn each gap into an action with an owner, completion date and verification evidence.
Table of Contents
Is a tabletop exercise the same as an incident response plan?
No. The plan documents the intended response; the exercise tests whether people can use it together.
The FTC Safeguards Rule contains a written incident-response requirement, but 16 CFR 314.6 provides limited exceptions for institutions maintaining information on fewer than 5,000 consumers. That is not an exemption from the entire Rule. Confirm the firm’s position instead of assuming its size removes every obligation.
A tabletop remains a useful operational practice even where a particular written-plan requirement does not apply. Client contracts and insurance arrangements may also affect what the firm needs to maintain.
For the wider security-program context, read Verito’s FTC Safeguards Rule guide alongside the official FTC guidance in Sources.
Choose one scenario and define the boundaries
Use a fictional scenario that resembles the firm’s work. A useful starting point is a preparer who opens a fake IRS message and later reports unexpected activity in their email account.
State at the outset that this is a discussion only. Nobody should disable a live account, call an actual client, or restore production data as part of the tabletop. Separate technical recovery tests can be scheduled with IT.
Bring the response plan, current contact list, relevant vendor responsibilities, and a blank action log. Use the PTIN and WISP requirements guide to check whether the documented security program matches the firm’s systems.
Assign response roles before the exercise
One person can hold more than one role in a small firm, but each responsibility needs an owner:
- Incident lead: coordinates decisions and escalation.
- IT lead or provider: assesses containment, evidence, and recovery options.
- Firm decision-maker: approves business interruption and spending.
- Legal or compliance contact: assesses reporting and contractual duties.
- Client communication lead: prepares consistent, approved messages.
- Facilitator and recorder: introduce facts and capture decisions.
Include the person who can act when the usual partner or IT contact is unavailable. Record the out-of-hours escalation route and who has authority to use it.
A 75-minute facilitator script
Minutes 0 to 10: Establish the first facts
Read this fictional prompt: “A preparer clicked a message claiming an EFIN problem. They entered their email credentials and now see messages they did not send.”
Ask who receives the report, what facts they collect, and how they contact IT without relying on the potentially compromised mailbox. Record uncertainty instead of guessing what the attacker did.
Minutes 10 to 25: Decide on containment
Add this fact: “The employee also approved an unexpected authentication request.”
Ask who can revoke sessions, restrict the account, and review connected applications. How will staff preserve the original message and relevant logs? Who authorizes an interruption to work?
The purpose is to establish the decision route, not perform the technical actions in the meeting.
Minutes 25 to 45: Expand the investigation
Add this fact: “Several client documents were accessible, but the team does not yet know whether they were acquired.”
Ask what information is needed to determine the scope. Identify who contacts counsel, the insurer where applicable, and relevant service providers. Do not announce that all clients were affected before the facts support it.
Minutes 45 to 60: Plan communication and recovery
Add this fact: “A client calls asking about an unusual message from the preparer.”
Draft a brief holding response that acknowledges the investigation without inventing findings. Decide who approves updates, where a decision log is kept, and how the firm continues urgent work safely.
Minutes 60 to 75: Agree corrective actions
Ask every participant to name one decision that was unclear. Convert the answers into assigned actions and arrange a short follow-up.
Rehearse notification decisions accurately
The FTC notification requirement concerns qualifying events involving at least 500 consumers’ unencrypted customer information, with notice required as soon as possible and no later than 30 days after discovery. The Rule’s notification provisions define the event and discovery conditions.
A stolen device is not enough by itself to determine the outcome. Encryption, key exposure, acquisition, scope, and other facts matter. State laws, IRS reporting, client agreements, and insurance conditions require separate assessment.
During the exercise, identify the responsible reviewer and the facts they need. Avoid rehearsing a single deadline as though it applies to every incident.
Turn findings into an action log
Use one entry per gap with these fields: finding, business risk, action, owner, target completion, and evidence of completion.
For example: “Nobody could find the after-hours escalation number. IT coordinator will add and test it before the next exercise. Evidence: a successful escalation test and updated contact list.”
Another entry might assign a controlled restore test to the IT provider. “Backups run daily” is not evidence that the firm can recover its applications and working files.
Close the action only when someone verifies the result. Update the plan and repeat the relevant part of the exercise after a major system or staffing change.
How do you know the exercise produced a useful result?
A completed meeting is not the outcome. The firm should be able to show who receives an incident report, how the IT contact is reached, who approves containment and how communication decisions are recorded.
Review the action log at the agreed follow-up. If a contact route failed, test the corrected route. If recovery responsibilities were unclear, arrange a separate controlled restore test. Close each finding only after the responsible person demonstrates the correction.
How Verito helps prepare the firm’s response
For firms using VeritGuard managed IT, discuss the support escalation, device coverage, backup responsibilities, and information available during an investigation.
Ask which response tasks are included in the agreement and which require another specialist. That discussion makes the tabletop more useful and gives the firm a clearer operational contact when staff need help.
Sources
- 16 CFR 314.6: Limited exceptions
- 16 CFR 314.4: Incident response and notification provisions
- FTC: Safeguards Rule guidance
