CISSP GLOSSARY · BUSINESS CONTINUITY

Tabletop exercise

Discussion-based walkthrough in which the response team talks through a disaster scenario against the plan, validating roles and decisions without touching any production system.

A tabletop exercise gathers the response team around a scenario and walks through the plan in discussion: who declares the disaster, who calls the hot site into action, who speaks to regulators, and what happens when a named individual is unavailable. No systems are touched and no operations are interrupted; the output is a list of gaps, ambiguities, and outdated assumptions, found while finding them is still cheap.

The exam places the tabletop on an escalation ladder of test types. A read-through (checklist review) has individuals check their own sections; a tabletop or structured walkthrough talks the team through the scenario together; a simulation adds realistic pressure and some operational steps; a parallel test activates the recovery site alongside production; and a full interruption test fails over for real. Only the full interruption test puts production at risk, which is why it is rare and demands explicit senior approval.

Exam relevance: if a scenario mentions testing the plan through discussion, with no systems activated, the answer is tabletop exercise. If it asks which test type risks an actual outage, the answer is full interruption; parallel testing is the confusable, but it leaves production running while the recovery site works beside it. The scenarios worth exercising come from the business impact analysis, which says which functions and downtimes actually matter.