Could your charity keep operating after a cyber attack? Run a tabletop exercise to find out

A charity can have multifactor authentication, backups and an incident response plan—and still face difficult decisions when a cyber attack disrupts its work.

What happens if staff cannot access Microsoft 365? How will frontline teams contact the people they support? Who decides whether to shut down a compromised system? What can continue while IT is being restored?

A cyber tabletop exercise lets your team work through those decisions in a guided discussion. It does not involve attacking your systems or taking services offline. The aim is to find gaps in your plans while there is still time to fix them.

The National Cyber Security Centre’s guidance, published on 1 October 2026, recommends exercising business continuity and recovery plans. It says tabletop exercises can help test roles, governance and decision-making, while technical recovery tests establish whether restoration will work in practice. National Cyber Security Centre

What would a charity tabletop exercise look like?

Start with a scenario that reflects how your charity works. For example:

It is Monday morning. Staff report that they cannot access email, Teams or files in SharePoint. Your IT provider suspects an account has been compromised, but the cause and extent are still unclear. A service delivery team needs information for appointments this afternoon.

The facilitator then introduces new information as the discussion progresses. Perhaps a supplier is also affected. Perhaps someone asks whether personal data has been accessed. Perhaps restoring access quickly would risk allowing the attacker back in.

Participants explain what they would do, who would make each decision and what information they would need. The exercise should include a senior decision-maker, someone responsible for service delivery, a communications lead and the people responsible for IT and security. A trustee may also be useful where the scenario calls for board oversight.

The questions worth testing

For a charity, the discussion should reach beyond the IT team:

• Essential services: Which activities must continue today, and which could pause?
• People: How will you contact staff, volunteers, beneficiaries and partners if your usual systems are unavailable?
• Decisions: Who can authorise system shutdowns, emergency spending and changes to service delivery?
• Information: What records do frontline teams need, and is there a safe way to access them during an outage?
• Suppliers: What happens if the disruption starts with your IT provider or another critical supplier?
• Recovery: Which systems must return first, and how will you know they are safe to use?

The NCSC’s newer disruption guidance asks organisations to plan for minimum viable operations: the essential functions they need to maintain while full recovery continues. That is a particularly useful starting point for charities whose services cannot simply stop until every system is restored. National Cyber Security Centre