Executive Tabletop
Cybersecurity Tabletop Exercise
Your incident response plan exists. The question is whether it works when the clock is running, the information is incomplete and the regulator is waiting. We put your board in front of a real crisis, with regulatory obligations from several jurisdictions running in real time, and we hand you documented evidence that the test happened.
It isn't a walkthrough.
It's a crisis on the clock.
A traditional tabletop gathers a committee around a slide deck and discusses what it would do. Nobody loses anything by deliberating too long, and by the end everyone agrees the plan works.
Executive Tabletop doesn't wait. The incident moves forward, the regulatory clocks run, and every decision changes what happens next. When a notification deadline expires, it really expires, and that goes in the report.
Traditional tabletop
- Discussion without consequences.
- Time doesn't count.
- One country, one generic framework.
- Template scenario.
- A report of impressions.
- One isolated event a year.
Executive Tabletop (Nordstern)
- Every decision changes the state of the incident.
- Regulatory clocks running, with real deadlines.
- Simultaneous obligations across several jurisdictions.
- Built around your sector, your countries and your real roles.
- A compliance verdict with auditable evidence.
- A program that measures the trend between exercises.
The difference between those two columns isn't something you explain in a meeting. You run it.
Put our plan to the testIt is no longer optional
Your policy requires it
Major cyber insurers already make coverage conditional on a documented exercise within the last twelve months. Policies have been voided for not having one.
Your regulator requires it
A growing number of regulatory frameworks recognize scenario-based testing as a valid — and in some cases mandatory — way to demonstrate operational readiness, with documentation of scope, findings and remediation. This applies across Latin America, the United States and Europe, with variations by jurisdiction and by sector.
Your standard requires it
ISO 27001 doesn't ask you to have a continuity plan. It asks you to test it. A documented exercise is exactly that evidence.
If your last documented exercise is more than twelve months old, it is worth reviewing before your next policy renewal.
Review my situationFour phases
Configuration
We build the scenario from your sector, your countries of operation, your applicable regulation and the real roles on your committee. We don't use a generic template.
The exercise
Your committee faces the incident from their own device, with injects arriving through realistic channels and four courses of action per decision. No option is obviously correct.
Clocks running
Regulatory obligations run in parallel. If you operate in several countries, that means several clocks with different deadlines and different authorities, and someone has to decide who gets notified first when there isn't time for everyone.
Evidence
We deliver the committee's performance, the individual analysis of each participant, the compliance verdict obligation by obligation, and documented evidence that the exercise took place.
The multi-jurisdiction
regulatory clock
Most simulations treat compliance as a topic of conversation. Here it is a clock that runs and a verdict that is either met or missed.
A single incident triggers different obligations in every country you operate in, with different authorities and different deadlines. Your committee sees them all at once, each clock running separately, and has to decide who to notify first when there isn't time for everyone.
There is real research behind it: eighteen curated countries, with each one's specific obligations, deadlines, authorities and documented enforcement cases with amounts and dates. And when an obligation isn't determined for your case, the system says so instead of inventing it.
Schematic representation of the session panel. The jurisdictions, authorities and deadlines in your exercise are configured from your own countries of operation.
Eighteen curated countries. Your exercise is configured with the ones you actually operate in.
Configure my exerciseYour readiness, measured session after session
A single exercise tells you how your committee responded that day. A program tells you whether your organization is improving, and on what evidence you are saying so.
Every organization builds a Validation Score, recalculated with each closed session across five weighted factors:
How regularly you exercise.
How many scenarios and disciplines have been tested.
How demanding the conditions were.
Whether performance holds or depends on who was in the room.
Whether results advance between exercises.
The result is a trend line, not a snapshot. And a maturity state that evolves as the organization accumulates evidence.
And there is something more important than the curve. The next exercise starts by reviewing the findings of the previous one: what was closed, what is still open, and what was promised and never happened. That is precisely what an auditor asks for as evidence that the tests were not just run, but acted on.
Nothing to install, no training required
One link per participant
Each participant joins from their own device with an individual link tied to their role. Links are handed out by code or by URL, on the spot, and the committee is inside in under a minute.
No technical requirements
Nobody needs to install software, create an account or learn the tool before starting. The facilitator runs the session from the console and sees the full state of the exercise.
In person or distributed
It works the same in a single room as it does with the committee spread across three cities.
What you are left with after the exercise
Executive debriefing
Your committee's performance in containment, compliance and coordination, with the full trajectory of the incident, the terminal state reached and its severity level.
Decision timeline
Every decision the committee made, with its explanation: whether it was the best option available or not, and why, anchored to the regulation or practice framework that applies.
Compliance evidence
A verdict obligation by obligation, with the authority, the deadline and the outcome. The document your auditor, your regulator or your insurer is going to ask for. Downloadable and shareable.
Every verdict comes with its explanation and the regulatory or practice framework behind it. Schematic representation of the deliverable.
It is the document your auditor, your regulator or your insurer is going to ask for. Better to have it before they ask.
I want that evidenceDesigned by a firm audited against the same frameworks it evaluates
This is not decoration. It means that whoever designs your compliance exercise lives inside an audited management system, held to the same standards of evidence, traceability and change control that we are assessing in your organization.
On top of that sits the day-to-day operation: a 24/7 SOC, an incident response team with real crisis experience, and active PCI DSS compliance practice. The scenarios do not come out of a purchased catalog. They come out of what we see, and out of our adversary simulation practice.
Certifications
- ISO/IEC 27001
- ISO/IEC 27017
- ISO/IEC 27018
Frameworks we operate under
- ISO 9001
- ISO/IEC 20000
- PCI DSS
There is a platform behind the exercise
Executive Tabletop is not a slide deck. It is a simulation platform built by Nordstern.
curated content pieces
scenario types
countries with curated obligations
With verifiable anchoring to frameworks such as MITRE ATT&CK and ISO 22301. Content is generated with artificial intelligence and nothing reaches a session without explicit human approval. That resolves the tension between curated libraries that do not scale and generated content you cannot trust.
Coming soon under license
Organizations that want to exercise at their own cadence, without depending on scheduling a facilitated session, will be able to operate the platform directly. Write to us if that model interests you.
Does your board know what to do
when the clock starts running?
Don't find out during the incident.
Schedule Executive Tabletop