---
title: "Test your incident response plan at least annually through tabletop exercises."
impact: MEDIUM
impactDescription: "general best practice"
tags: cybersecurity-compliance, legal, nis2, dora, sec-cybersecurity-rules
---

## Test your incident response plan at least annually through tabletop exercises.

Include technical staff, legal counsel, executive leadership, and communications teams. Simulate scenarios that trigger multiple notification obligations simultaneously.