At 09:00, the finance director learns that a major supplier has suffered an outage. The disruption lands during month-end close: invoices are waiting, payments need approval and management figures are due. The supplier cannot confirm when its service will return.
The exercise begins with one question: what does the business need to keep operating, and what would it take to restore it?
This is a tabletop exercise: a facilitated discussion in which business and IT leaders respond to a realistic scenario. It does not switch off systems or prove that a backup can be restored. Instead, it tests whether people understand the plan, can make decisions and know where the dependencies lie. The National Cyber Security Centre’s tabletop exercises offer a useful starting point.
For UK SMEs, a single morning can expose the gaps between a confident dashboard and a recoverable business.
09:00, The scenario briefing
The facilitator sets the scene. A critical supplier’s platform is unavailable, and the finance team cannot complete a key month-end process. Some records are held in the supplier’s service; others sit in spreadsheets, email and an ageing finance system. The team does not yet know whether the supplier’s disruption is isolated or part of a wider incident.
The first task is not to name a technology. It is to identify the important business activity at risk. Which payments, reports or customer commitments cannot wait? Who decides what gets prioritised? What can be handled manually, and for how long before errors or customer harm become unacceptable?
That conversation reveals whether the business has a shared view of what “critical” means. IT may prioritise restoring access to a system. Finance may need a reliable transaction record. A director may need to know which customers or suppliers will be affected. Those are connected concerns, but they are not interchangeable.
09:30. The plan meets real decisions
The group opens its Disaster Recovery plan. It may be detailed, current and well presented. But can anyone use it under pressure?
Participants check who has authority to declare an incident, who contacts the supplier, where escalation details are held and how staff will be updated if email or the usual collaboration tools are unavailable. They look for practical dependencies: administrator access, authentication, internet connectivity, network equipment and people who know how the finance process works.
This is where a written plan differs from a rehearsed one. A document can describe a sequence; an exercise reveals whether the sequence is understood and possible. A contact list is only useful if it is current and accessible when the systems holding it are down.
The NCSC’s small-business guidance on preparing for and responding to incidents encourages organisations to identify essential information, responsibilities and recovery needs. A tabletop brings those questions into the same room as the people who must answer them.
10:00. “We have backups” becomes “Can we recover?”
Someone says the backups are working. The facilitator asks what that means.
A successful backup job is useful evidence that data was copied. It does not, by itself, show that the right data is included, that access is available, that the copy is protected from compromise or that applications and supporting services can be restored in a usable order. A dashboard may show yesterday’s green tick; it cannot tell the team whether a restored finance system will reconcile with the records created since that copy.
The team needs to distinguish assumed backups from tested recovery. Which copy would be used? Who can access it if normal administrator accounts are unavailable? When was a restore last tested, and did someone verify that the recovered data was complete and usable?
The NCSC advises organisations to test that backups can be restored and to consider how copies can be protected against ransomware. A discussion-based exercise is valuable, but it does not replace a technical restore test. The two provide different evidence: one tests decisions and coordination; the other tests recovery capability.
10:30, Recovery targets in business language
The finance director is asked how long the month-end process can be disrupted. The answer is not a technical number; it depends on payroll, supplier commitments, reporting deadlines, customer impact and the availability of workable alternatives.
This is the point to agree recovery time objectives (RTOs) and recovery point objectives (RPOs) in terms the business can assess:
- RTO: how long the business can tolerate a system or service being unavailable before the impact becomes unacceptable.
- RPO: how much recent data the business can afford to lose, expressed as the time between the latest recoverable copy and the disruption.
The targets should come from business impact, not a number chosen because it sounds reassuring. For a firm subject to FCA operational resilience rules, the relevant question also includes whether an important business service can remain within its defined impact tolerance. The FCA’s operational resilience guidance is particularly relevant to regulated firms; other SMEs can still learn from its focus on services, dependencies and disruption.
The discussion may uncover that finance, IT and management have been assuming different recovery times. That difference is itself a finding.
11:00, The ageing finance system and its dependencies
Now the group traces the month-end process through its systems. Data may pass between an older finance or ERP platform, spreadsheets, shared folders, bank services and a supplier portal. The map often looks less like a single application and more like a chain of hand-offs.
An ageing system can be difficult to recover when documentation is thin, integrations are poorly understood or only one person knows the sequence of steps. The issue is not age alone; it is whether the business can support, secure and restore the system predictably.
This is a strategic consultancy question, not a reason to rush into a software purchase. A Dynamics 365 Jump Start assessment can help a business examine its finance processes, data, dependencies and recovery requirements before deciding whether a move to Microsoft Dynamics 365 Business Central is appropriate. Through a supported implementation route, the system, responsibilities and processes can be documented and designed for supportability. That can make recovery planning clearer, while still requiring the business to confirm its specific backup, retention and restoration arrangements.
A considered Business Central implementation begins with business outcomes and delivery planning, not a promise that cloud software removes every continuity risk.
11:30, The key-person question
The facilitator asks: “If the person who knows this system is unavailable, who can recover it?”
There is a pause.
That question matters for specialist legacy platforms as much as for modern cloud services. If a business relies on an IBM i (AS/400) management and support environment, it should identify who understands the configuration, access controls, recovery sequence and supplier arrangements. A managed cover arrangement or trusted specialist partner may reduce dependence on one individual, but the responsibilities and handover details must be explicit.
The same check applies to network access, identity services and phone lines. Helpdesk Support, Network Solutions, Cloud Solutions and Voice and Connectivity can all be useful execution services, but they should support a resilience strategy that identifies what the business must recover first.
12:00, Findings, owners and funding
By midday, the exercise has generated a practical list: confirm the supplier’s recovery commitments; locate and validate the latest restore-test record; document a manual finance workaround; update escalation contacts; clarify who can authorise recovery; and assign an owner and deadline to each gap.
The exercise should also be documented. For firms working towards or maintaining ISO 27001, records of risk decisions, backup controls, testing and corrective actions can support the wider evidence trail. ISO/IEC 27001 includes expectations around maintaining and regularly testing backups in line with policy. Cyber Essentials is different: backups are strongly recommended by the NCSC, but they are not a technical requirement of the scheme. Neither certification nor a tabletop session is a substitute for evidence that controls work.
For FCA-regulated firms, the record should connect the exercise to important business services, dependencies, impact tolerances and lessons learned. For any SME, capturing the scenario, decisions, findings, action owners and retest dates turns a conversation into a management tool.
The morning may also expose duplicated licences, unused tools or overlapping supplier contracts. Technology Expense Management (TEM) can help identify avoidable technology spend and redirect it towards agreed remediation, such as improving backup protection, completing restore tests or documenting critical systems. Cost control is most valuable when it improves resilience rather than simply trimming a line from the budget.
The real test is what happens next
A tabletop exercise does not certify that recovery will succeed. It shows whether the business understands its critical services, knows who must act and can turn assumptions into testable actions.
A consultancy-first Fractal IT Director approach connects that strategy to practical delivery. David’s experience in Google-certified IT project management, multinational onboarding and IBM i system administration brings a practitioner’s perspective to planning, while specialist channel partners can provide specific technical execution. Managed IT Services (including helpdesk, network, print, voice, hardware and software licensing) are best treated as bolt-ons to an agreed business strategy.
Start with the service the business must protect, then test the people, suppliers and systems it depends on. For broader information about the group’s services, visit Evestaff.
SEO tags: Cloud Solutions, Disaster Recovery, Dynamics 365 Jump Start, Helpdesk Support, IBM i Management, Managed IT Services, Network Solutions, Technology Expense Management, Voice and Connectivity, disaster recovery tabletop exercise UK, SME business continuity, Dynamics 365 Business Central recovery, IT consultancy UK
Join The Discussion