NIST SP 800-171
Tabletop Exercise for Defense Contractors: The Scenario That Exposes Real Gaps
A tabletop exercise for defense contractors should test your contract duties, not just your backups. If your team cannot report a cyber incident to DoD within 72 hours, you want to learn that in a meeting room. The scenario below is built to surface the decisions most firms have never assigned.
Why do most tabletop exercises miss the real gaps?
Most exercises follow a stock ransomware script. The team talks about restoring backups and calling the IT provider. Everyone leaves feeling good.
That script tests technology. It rarely tests your contract. For a defense contractor, the contract holds the hard duties.
DFARS 252.204-7012 sets those duties. It covers reporting, evidence and cooperation with DoD. A generic script never asks about any of them.
What should a tabletop exercise for defense contractors test?
It should test whether you can meet each duty in the clause under pressure. Start with reporting. You must report a cyber incident to DoD within 72 hours of discovery, through the DIBNet portal.
To file that report, you need a DoD approved medium assurance certificate. Ask who holds it today. Ask what happens if that person's laptop is encrypted.
Next comes evidence. You must keep images of affected systems for at least 90 days after you report. If you find and isolate malicious software, you must submit it to the DoD Cyber Crime Center. DoD may also ask for access to data and equipment for forensic analysis.
Subcontractors report to DoD directly. They also give their prime the incident report number as soon as they can.
A plain control sits behind all of this. NIST SP 800-171 Rev 2 requirement 3.6.3 says to test your incident response capability. NIST SP 800-171A, the matching assessment guide, checks that the test happened. CMMC Level 2 includes the same requirement.
What scenario exposes the gaps?
Set it on a Friday evening. A staff member sees file names changing on the shared drive. That drive holds CUI, the controlled unclassified information your contract protects.
First inject: your managed IT provider gets the call. Their instinct is to wipe and restore fast. Who tells them to stop and take images first? Is that duty in their contract?
Second inject: it is Saturday morning. Someone asks if this is a reportable incident. Who has the authority to say yes? The 72 hour clock may already be running.
Third inject: the certificate holder is on vacation. Nobody else can log in to DIBNet. What now?
Fourth inject: on Monday, your prime calls. They heard about it from a shared vendor. What do you tell them, and who says it?
Fifth inject: your cyber insurer may have its own notice rules. Do they clash with your DoD duties? Who reconciles them?
Each inject forces a decision. The gaps show up as long silences.
Who needs to be in the room?
Someone who can commit the company must be there. Reporting to DoD is a business decision with legal weight. It should not fall to whoever is on call.
Bring your IT lead and your managed provider. Bring whoever handles contracts, since primes and contracting officers will call. Bring legal counsel, inside or outside.
Keep the group small enough to talk. The goal is decisions, not a lecture.
What do we do with what we find?
Write down every gap, with an owner and a date. Then fix the documents. Your incident response plan should name who decides, who reports and who preserves evidence.
Update your System Security Plan if your process changed. Check your IT provider contract for imaging and evidence duties.
Then run the exercise again. NIST SP 800-84 is the NIST guide for planning exercises like this. A second round shows whether the fixes held, and it adds to your record of testing.
Where are the sources?
NIST SP 800-171 Rev 2: https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final
NIST SP 800-171A: https://csrc.nist.gov/pubs/sp/800/171/a/final
NIST SP 800-84, Guide to Test, Training, and Exercise Programs: https://csrc.nist.gov/pubs/sp/800/84/final
DoD DIBNet portal: https://dibnet.dod.mil