Tabletop exercises

A tabletop exercise is talking through an incident before one happens, with the people who would actually be involved.

Its value is not technical. It surfaces the things nobody had decided: who is allowed to take the website offline, who calls the insurer, who talks to customers, what you do if the incident is on the system you use to communicate. Those questions all have answers eventually. Discovering them calmly on a Tuesday is considerably cheaper than discovering them at two in the morning.