Data Leak Tabletop Exercise: A 45-Minute Executive Workshop
Run a data leak tabletop by giving executives an exposed customer file, incomplete access records, and a customer asking for answers. This suggested 45-minute workshop tests containment authority, evidence requests, and communication under uncertainty.
How do you run a data leak tabletop exercise?
Give participants a fictional customer data exposure and require three decisions: how to contain it, who will establish its scope, and what to tell affected stakeholders. Release new information in stages and record how decisions change.
For Q4 planning on October 12, 2026, use the current incident contact list, file-sharing policy, and customer escalation process. Check whether delegated authority covers upcoming staff absences.
NIST SP 800-61 Rev. 3, published in April 2025, integrates incident response into broader cybersecurity risk management. The scenario and timings below are an original workshop outline. [NIST incident response guidance](https://csrc.nist.gov/pubs/sp/800/61/r3/final).
Prepare the scenario and assign roles
Fictional scenario: a customer reports that a shared link opens a spreadsheet containing customer names, business email addresses, and renewal notes without signing in. An account manager created the export for a partner meeting yesterday; the team does not yet know who accessed it.
Assume IT can revoke the link and preserve available access records. Use a mock file and simulated messages; the exercise requires no changes to live systems.
- Executive sponsor: authorizes business restrictions and resolves competing priorities.
- Security or IT lead: proposes containment and identifies evidence needed to establish scope.
- Customer operations lead: explains the sharing workflow and drafts customer updates.
- Privacy or legal representative: identifies facts needed to assess notification duties and contractual commitments.
- Facilitator and recorder: release updates and capture each decision, owner, rationale, and review time.
Compare the scope of containment
Ask the team to choose an initial restriction and name the evidence that would justify expanding it. Preserve relevant records alongside containment; do not turn evidence gathering into an open-ended delay.
| Containment choice | Benefit | Tradeoff or remaining gap |
|---|---|---|
| Revoke the reported link | Stops further access through that link | Other shared copies or links may remain accessible. |
| Restrict external sharing for the affected workspace | Covers additional exposures within that workspace | Interrupts legitimate partner access and needs a controlled exception process. |
| Temporarily restrict external sharing organization-wide | Provides broader coverage while scope is uncertain | Disrupts unrelated work; requires clear authority and criteria for restoring access. |
Run the 45-minute workshop
Use these suggested timings. Before each update, require a concrete action and named owner; record unknowns separately from confirmed facts.
- Minutes 0–5: read the scenario, assign roles, and identify who can authorize immediate containment.
- Minutes 5–15: choose the containment scope, request specific evidence, and set the next internal update time.
- Minutes 15–25: reveal that available records show anonymous access but cannot identify the viewers. A second externally shared export appears in the same workspace; reconsider scope and restrictions.
- Minutes 25–35: reveal that the reporting customer asks whether competitors downloaded the file. Draft a response stating what is known, what remains under investigation, and when the next update will arrive.
- Minutes 35–45: compare decisions with the supplied evidence and assign follow-up actions.
Debrief decisions and define closure evidence
Check whether participants contained the known exposure, investigated related files, and avoided treating missing access evidence as proof that nobody viewed the data. Ask whether customer communication distinguished confirmed exposure from unverified downloading.
Require an owner and due date for each gap. For example, IT could verify external-sharing restrictions using a synthetic file, while customer operations rehearses an update with incomplete access information.
Finish by defining what permits normal sharing to resume: the affected scope has been reviewed, agreed controls have been checked, and a named decision owner approves restoration. Keep unresolved investigation and communication tasks visible after access is restored.
Frequently asked questions
Can executives run this tabletop without a security team?
They can rehearse authority and communication, but include someone who understands the actual sharing workflow and available records. Otherwise, record technical assumptions as questions to verify after the workshop.
Does revoking the shared link mean the incident is resolved?
No. Revocation addresses access through that link. The exercise should also examine other copies, available access evidence, communication decisions, and the conditions for restoring normal sharing.
Run this as a real exercise
Team Exercises helps facilitators turn business training topics into AI-powered simulations with team links, decision rounds, analytics, and debrief-ready outcomes.
Start a free scenario