Run the Fire Drill Before the Fire: Tabletop Exercises for Your Company's Legal Emergencies
Every general counsel has a version of the same story. A call comes in at 6:40 on a Tuesday morning — ransomware, a departing sales executive with a laptop full of customer data, an inquiry letter from a state attorney general — and within hours it becomes painfully clear that nobody knows who calls the forensics vendor, where the insurance broker's after-hours number lives, or whether the notification obligations run through the CTO, the GC, or nobody at all.
The problem is rarely a lack of intelligence. It is a lack of rehearsal. Companies run fire drills for evacuations and penetration tests for networks, but almost never practice the legal dimension of a crisis. A tabletop exercise closes that gap for a fraction of the cost of a single bad week.
What a Tabletop Exercise Actually Is
A tabletop is a facilitated simulation. Participants gather — in person or on a video call — and a facilitator walks them through a realistic scenario in stages: It is 7:15 a.m. An employee reports that the shared drive is encrypted. What do you do first? Each decision exposes the next decision, and the facilitator introduces complications as the group proceeds: the forensics firm's contract expired, the board chair is flying internationally, a journalist has emailed for comment.
The point is not to pass or fail. The point is to discover, in a controlled setting, exactly where the response plan frays.
Choosing the Scenario Worth Practicing
Resist the urge to simulate a dramatic but unlikely event. The most valuable scenarios sit at the intersection of probability and consequence. For most US mid-market companies, three candidates consistently earn the top slots:
- A data security incident. Breach notification obligations now span all fifty states, sector rules like HIPAA and GLBA, and contractual clocks that sometimes run shorter than statutory ones.
- A senior executive departure. Especially one headed to a competitor, which triggers trade secret, non-compete enforceability (which varies sharply by state post-FTC activity), device preservation, and customer-deployment questions simultaneously.
- A government inquiry. A civil investigative demand, a DOL audit, or a state regulator's records request — each with response deadlines measured in days, not weeks.
Pick one. A scenario covering everything covers nothing.
Who Belongs in the Room
The cast matters more than the script. At minimum: the CEO or COO, the head of IT or security, the senior HR leader, whoever owns communications, and outside counsel. Finance should attend — incident response bills accumulate quickly, and cyber insurance carriers impose consent requirements that can void coverage if a company retains vendors without approval.
One deliberate omission: do not rehearse with a script everyone has read in advance. The discomfort of improvising is the entire mechanism. A skilled facilitator — often outside counsel, which also helps preserve privilege over the discussion — should hold the scenario details until the room is seated.
The Gaps You Should Expect to Find
After running dozens of these exercises, the same fault lines appear with remarkable consistency:
- No single owner. Three people believe they are running the response; two believe they are not.
- Vendor relationships on paper only. The breach forensics firm was engaged eighteen months ago; the engagement letter was never countersigned.
- Insurance friction. Nobody has read the notification provisions of the cyber policy, which may require notice within 72 hours.
- Privilege confusion. Employees forward sensitive analyses to wide distribution lists without understanding the consequences.
- Communication dead air. No holding statements, no employee talking points, no designated spokesperson.
None of these are exotic failures. All of them are cheap to fix in February and expensive to fix in the middle of an incident.
Converting the Debrief Into a Playbook
The exercise is worth precisely what the follow-through is worth. Within one week, circulate a findings memo organized not by department but by the first sixty minutes, the first twenty-four hours, and the first week of a real event. Then convert findings into concrete artifacts: a one-page escalation tree with names and alternates, a pre-negotiated master service agreement with a forensics vendor, a privilege protocol memo distributed to the response team, and template holding statements awaiting only the facts.
Assign each item an owner and a deadline. A debrief without assignments is a pleasant meeting; a debrief with assignments is a playbook.
Cadence and Cost
Run one tabletop annually, rotating scenarios. Budget a half day of executive time plus facilitation — a modest line item next to the six-figure cost of a mishandled incident, both in direct expense and in the quieter currency of regulator credibility and customer trust.
Your first legal crisis will be a live fire whether you plan for it or not. The only question is whether the response team has already run the play.
