Find the gaps in your IR plan,
or a customer, audit, or crisis will.
That IR tabletop has been on the list since last quarter. You know you need to run it.
What if the entire tabletop, from scenario to audit-ready report, took less than 60 minutes? You could run it this week.
Mapped to SOC 2 · ISO 27001 · PCI DSS · and more
Why now
The cost of getting it wrong
Ransomware at 2am. Encryption spreading. No clear decision owner. Nobody called legal. Fines, litigation, lost contracts. The incident was containable. The botched response made it expensive.
The ask has changed
Auditors used to ask whether a plan existed. Prospects took your word for it. QSAs accepted documentation. That's changed. The question now, from all of them, is if it was tested.
Annual testing is the floor, not the ceiling
The frameworks require annual testing, but eleven months of change goes untested. Continuous testing builds muscle memory and is best practice, but cost and logistics have always made that out of reach for most teams. Until now.
The frameworks behind every audit, deal and renewal conversation
CC7.3 is what your SOC 2 auditor is testing when they ask for evidence of incident response. They need to see that you evaluated a security event, made decisions and documented the outcome. An annual tabletop with a named after-action report is what In Place looks like.
Also relevant: Availability criteria (A1.3) for teams with DR obligations in scope.
A.5.24 is the clause your surveillance auditor checks when they ask how you manage security incidents. They expect evidence the process has been tested. Named participants, a real scenario, documented decisions. Missing it creates a non-conformity that threatens the certificate.
Req 12.10.2 is what your QSA verifies when they check whether your incident response plan has been tested. The requirement is explicit: at least once every 12 months, tested and documented. The after-action report from your tabletop is the evidence they need to mark it In Place on the RoC.
Don't see your framework?
Handrails covers more than SOC 2, ISO 27001 and PCI DSS. If your framework is listed here, or you don't see it at all, let us know.
- NIST CSF 2.0The language your cyber insurer and enterprise buyers are already using to ask about your IR readiness.
- SEC cyber disclosure rulePublic companies need evidence the response machinery works before a material incident forces the question.
- NIS2In scope across the EU from October 2024. Most organizations are still figuring out what evidence looks like.
From scenario to audit-ready report, in under 60 minutes.
Built around your context
Answer a few questions about your setup, including your industry, your frameworks, your tech stack. The scenario is custom generated from your context, not pulled from a generic library.
Amir · IR lead
Ines · LegalRun it live, virtually
Your team joins a video call. A realistic incident unfolds. Each person makes the decisions they would actually make. The session is recorded. That recording is your evidence trail.
The report is ready before you close the call
An auditor-ready after-action report is generated from the session. Dated. Named. Mapped to your frameworks. Hand it to your SOC 2 auditor, your enterprise prospect, or your broker. Done.
Tailored, not templated
Ransomware in production
Encryption at the storage layer at 2am. Who decides to shut down? When do you page legal and insurance?
Credentials leaked in a third-party breach
Your OAuth provider is breached. Which customers to notify, on what SLA, with what content?
Insider exfiltration
A departing engineer pulls customer data. Evidence preservation, legal escalation, external comms.
Cyber insurers are asking the same question your auditor is.
Underwriters at renewal increasingly ask for evidence of a tested incident response plan, not just a policy document. A Handrails session produces the documented exercise record most carriers now expect to see. Plus, some insurers are beginning to offer premium consideration for organizations that can demonstrate a regular testing cadence.
Tabletops don't have to be the hard part.
Run your next tabletop this week.
Sign up, pick a scenario, invite the team. The report is ready before the session ends.