{"id":3766,"date":"2026-07-03T16:00:00","date_gmt":"2026-07-03T08:00:00","guid":{"rendered":"https:\/\/firmussec.com\/sg\/?page_id=3766"},"modified":"2026-07-03T21:11:40","modified_gmt":"2026-07-03T13:11:40","slug":"table-top-exercise-ttx","status":"publish","type":"page","link":"https:\/\/firmussec.com\/sg\/table-top-exercise-ttx\/","title":{"rendered":"Table Top Exercise (TTX)"},"content":{"rendered":"

Governance, Risk & Compliance (GRC)<\/p>\n<\/div>

Build Cyber Resilience Through a Real-World Tabletop Exercise<\/h1><\/div>

The TTX aims to assess the CIIOs\u2019 capabilities and operational processes to detect, respond and recover from cyber incidents by exercising the relevant operational plans and Standard Operating Procedures (SOPs), Business Continuity Plan (\u201cBCP\u201d) and Disaster Recovery Plan (\u201cDRP\u201d) to ensure that its CIIs remain resilient and can continue to deliver essential services in the event of disruptions due to a cybersecurity incident.<\/p>\n

FIRMUS uses a threat intelligence driven approach to develop scenarios, including for the purpose of wargaming exercise, not limiting to establishing case studies on noteworthy past incidents and cyber-attack campaigns, and profiling known threat actors and their tactics, techniques and procedures (TTPs) using the MITRE ATT&CK framework or equivalent framework.<\/p>\n<\/div><\/div><\/div>

\"Table<\/span><\/div><\/div><\/div>

Our Approach & Methodology<\/h1><\/div>

Our approach & methodology also assess Sector Lead to coordinate and manage cyber incidents at the sectoral level.<\/p>\n<\/div>

  • <\/i><\/span>
    \n

    Phase 1 (Understand and Plan):<\/strong> To conduct planning and engagement workshops for the Sector Lead and ICM CIIOs for information gathering and schedule of activities leading to actual conduct of exercise<\/p>\n<\/div><\/li>

  • <\/i><\/span>
    \n

    Phase 2 (Design and Develop):<\/strong> To design and develop cybersecurity scenarios for the Sector Lead and ICM CIIOs on a threat assessment that established realistic and emerging cyber threats that are relevant to ICM sectors.<\/p>\n<\/div><\/li>

  • <\/i><\/span>
    \n

    Phase 3 (Deliver and Report):<\/strong> To conduct TTX and Crisis Communications to assess and grade the cyber readiness of each CIIO and the ICM sector via specific criteria that was discussed. Exercise After Action Report (AAR) to be delivered after the conduct of the exercise.<\/p>\n<\/div><\/li><\/ul><\/div><\/div>

    Key Benefits of Running TTX (Table-Top Exercise)<\/h1><\/div>
    <\/i><\/div>

    1. Validate Incident Response Readiness<\/h2><\/div>
    <\/div>
    \n

    A TTX tests whether your incident response plan actually works in practice, not just on paper. Teams quickly discover gaps in:<\/p>\n

      \n
    • Escalation flow<\/span><\/li>\n
    • Roles & responsibilities<\/span><\/li>\n
    • Communication channels<\/span><\/li>\n
    • Decision authority<\/span><\/li>\n
    • Technical coordination<\/span><\/li>\n<\/ul>\n<\/div><\/div><\/div>
      <\/i><\/div>

      2. Improve Executive Decision-Making<\/h2><\/div>
      <\/div>
      \n

      Cyber incidents are no longer purely technical. A TTX helps management practice:<\/p>\n

        \n
      • Crisis leadership<\/span><\/li>\n
      • Business continuity decisions<\/span><\/li>\n
      • Regulatory response<\/span><\/li>\n
      • Public\/media communication<\/span><\/li>\n
      • Legal and reputational risk handling<\/span><\/li>\n<\/ul>\n

        This is especially valuable for C-level executives and board members.<\/p>\n<\/div><\/div><\/div>

        <\/i><\/div>

        3. Identify Process & Communication Gaps<\/h2><\/div>
        <\/div>
        \n

        Most failures during incidents happen because of coordination issues, not lack of tools. TTX reveals:<\/p>\n

          \n
        • Delayed escalation<\/span><\/li>\n
        • Confusion between IT\/SOC\/legal\/comms<\/span><\/li>\n
        • Missing contact points<\/span><\/li>\n
        • Vendor dependency issues<\/span><\/li>\n
        • Slow approval processes<\/span><\/li>\n<\/ul>\n<\/div><\/div><\/div>
          <\/i><\/div>

          4. Strengthen Cross-Functional Collaboration<\/h2><\/div>
          <\/div>
          \n

          A well-run exercise aligns multiple stakeholders:<\/p>\n

            \n
          • Security team<\/span><\/li>\n
          • IT operations<\/span><\/li>\n
          • Legal<\/span><\/li>\n
          • HR<\/span><\/li>\n
          • PR\/Communications<\/span><\/li>\n
          • Management<\/span><\/li>\n
          • Third-party vendors<\/span><\/li>\n<\/ul>\n

            Teams learn how to work together before a real crisis happens.<\/p>\n<\/div><\/div><\/div>

            <\/i><\/div>

            5. Meet Compliance & Audit Expectations<\/h2><\/div>
            <\/div>
            \n

            Many frameworks and regulators increasingly expect organisations to conduct cyber crisis simulations, including:<\/p>\n

              \n
            • ISO 27001<\/span><\/li>\n
            • NIST CSF<\/span><\/li>\n
            • SOC 2<\/span><\/li>\n
            • MAS TRM<\/span><\/li>\n
            • PDPA-related governance expectations<\/span><\/li>\n<\/ul>\n

              A TTX demonstrates operational maturity and preparedness.<\/p>\n<\/div><\/div><\/div>

              <\/i><\/div>

              6. Increase Confidence During Real Incidents<\/h2><\/div>
              <\/div>
              \n

              When teams have rehearsed scenarios before, response becomes:<\/p>\n

                \n
              • Faster<\/span><\/li>\n
              • More structured<\/span><\/li>\n
              • Less emotional<\/span><\/li>\n
              • More coordinated<\/span><\/li>\n<\/ul>\n

                This directly reduces downtime and business impact.<\/p>\n<\/div><\/div><\/div>

                <\/i><\/div>

                7. Test Business Continuity & Recovery Assumptions<\/h2><\/div>
                <\/div>
                \n

                TTX helps validate:<\/p>\n

                  \n
                • Backup recovery assumptions<\/span><\/li>\n
                • RTO\/RPO expectations<\/span><\/li>\n
                • Alternate communication methods<\/span><\/li>\n
                • Third-party recovery dependencies<\/span><\/li>\n<\/ul>\n

                  Many organizations realize their recovery expectations are unrealistic only during exercises.<\/p>\n<\/div><\/div><\/div>

                  <\/i><\/div>

                  8. Build Cybersecurity Culture<\/h2><\/div>
                  <\/div>
                  \n

                  A TTX changes cybersecurity from \u201cIT\u2019s problem\u201d into a business-wide responsibility. It increases awareness among leadership and non-technical stakeholders.<\/p>\n<\/div><\/div><\/div>

                  <\/div><\/div><\/div><\/div>

                  Why Firmus?<\/strong><\/h1><\/div>

                  Firmus combines offensive security expertise, governance consulting, and real-world cybersecurity implementation experience to deliver practical, risk-driven, and business-aligned security services. Our consultants work closely with organizations to strengthen cybersecurity resilience while ensuring security initiatives remain operationally effective and aligned with business objectives.<\/p>\n

                  Firmus is also recognized through multiple industry-leading certifications and accreditations, including:<\/p>\n<\/div>

                  • <\/i><\/span>
                    \n

                    CREST Accredited Company with CREST Certified Consultants<\/strong><\/p>\n

                    Firmus is CREST accredited, validating our capabilities, methodologies, and quality standards in delivering professional cybersecurity assessment and penetration testing services aligned with internationally recognized best practices.<\/p>\n<\/div><\/li>

                  • <\/i><\/span>
                    \n

                    ISO\/IEC 27001:2022 Certified<\/strong><\/p>\n

                    Firmus is certified to ISO\/IEC 27001:2022, demonstrating our commitment to maintaining a robust Information Security Management System (ISMS) and protecting the confidentiality, integrity, and availability of information assets.<\/p>\n<\/div><\/li>

                  • <\/i><\/span>
                    \n

                    Cyber Trust Mark \u2014 Advocate Level Certification<\/strong><\/p>\n

                    Firmus is certified at the highest Cyber Trust Mark tier, demonstrating advanced cybersecurity maturity and operational excellence.<\/p>\n<\/div><\/li><\/ul>

                    These certifications and accreditations reflect Firmus\u2019 commitment to maintaining high cybersecurity standards, operational discipline, and trusted service delivery for enterprise and regulated environments.<\/p>\n<\/div><\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"100-width.php","meta":{"footnotes":""},"class_list":["post-3766","page","type-page","status-publish","hentry"],"yoast_head":"\nTable Top Exercise (TTX) - Penetration Testing Singapore | Top Pentest Services Expert<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/firmussec.com\/sg\/table-top-exercise-ttx\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Table Top Exercise (TTX) - Penetration Testing Singapore | Top Pentest Services Expert\" \/>\n<meta property=\"og:url\" content=\"https:\/\/firmussec.com\/sg\/table-top-exercise-ttx\/\" \/>\n<meta property=\"og:site_name\" content=\"Penetration Testing Singapore | Top Pentest Services Expert\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/FIRMUSsec\/\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-03T13:11:40+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/table-top-exercise-ttx\\\/\",\"url\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/table-top-exercise-ttx\\\/\",\"name\":\"Table Top Exercise (TTX) - Penetration Testing Singapore | Top Pentest Services Expert\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/#website\"},\"datePublished\":\"2026-07-03T08:00:00+00:00\",\"dateModified\":\"2026-07-03T13:11:40+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/table-top-exercise-ttx\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/firmussec.com\\\/sg\\\/table-top-exercise-ttx\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/table-top-exercise-ttx\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Table Top Exercise (TTX)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/#website\",\"url\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/\",\"name\":\"Penetration Testing Singapore | Top Pentest Services Expert\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/#organization\",\"name\":\"Penetration Testing Singapore | Top Pentest Services Expert\",\"url\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/dev\\\/wp-content\\\/uploads\\\/2022\\\/12\\\/FIRMUS_Red-1.png\",\"contentUrl\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/dev\\\/wp-content\\\/uploads\\\/2022\\\/12\\\/FIRMUS_Red-1.png\",\"width\":1244,\"height\":281,\"caption\":\"Penetration Testing Singapore | Top Pentest Services Expert\"},\"image\":{\"@id\":\"https:\\\/\\\/firmussec.com\\\/sg\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/FIRMUSsec\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/firmus-security\\\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Table Top Exercise (TTX) - Penetration Testing Singapore | Top Pentest Services Expert","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/firmussec.com\/sg\/table-top-exercise-ttx\/","og_locale":"en_US","og_type":"article","og_title":"Table Top Exercise (TTX) - Penetration Testing Singapore | Top Pentest Services Expert","og_url":"https:\/\/firmussec.com\/sg\/table-top-exercise-ttx\/","og_site_name":"Penetration Testing Singapore | Top Pentest Services Expert","article_publisher":"https:\/\/www.facebook.com\/FIRMUSsec\/","article_modified_time":"2026-07-03T13:11:40+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/firmussec.com\/sg\/table-top-exercise-ttx\/","url":"https:\/\/firmussec.com\/sg\/table-top-exercise-ttx\/","name":"Table Top Exercise (TTX) - Penetration Testing Singapore | Top Pentest Services Expert","isPartOf":{"@id":"https:\/\/firmussec.com\/sg\/#website"},"datePublished":"2026-07-03T08:00:00+00:00","dateModified":"2026-07-03T13:11:40+00:00","breadcrumb":{"@id":"https:\/\/firmussec.com\/sg\/table-top-exercise-ttx\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/firmussec.com\/sg\/table-top-exercise-ttx\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/firmussec.com\/sg\/table-top-exercise-ttx\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/firmussec.com\/sg\/"},{"@type":"ListItem","position":2,"name":"Table Top Exercise (TTX)"}]},{"@type":"WebSite","@id":"https:\/\/firmussec.com\/sg\/#website","url":"https:\/\/firmussec.com\/sg\/","name":"Penetration Testing Singapore | Top Pentest Services Expert","description":"","publisher":{"@id":"https:\/\/firmussec.com\/sg\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/firmussec.com\/sg\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/firmussec.com\/sg\/#organization","name":"Penetration Testing Singapore | Top Pentest Services Expert","url":"https:\/\/firmussec.com\/sg\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/firmussec.com\/sg\/#\/schema\/logo\/image\/","url":"https:\/\/firmussec.com\/sg\/dev\/wp-content\/uploads\/2022\/12\/FIRMUS_Red-1.png","contentUrl":"https:\/\/firmussec.com\/sg\/dev\/wp-content\/uploads\/2022\/12\/FIRMUS_Red-1.png","width":1244,"height":281,"caption":"Penetration Testing Singapore | Top Pentest Services Expert"},"image":{"@id":"https:\/\/firmussec.com\/sg\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/FIRMUSsec\/","https:\/\/www.linkedin.com\/company\/firmus-security\/"]}]}},"_links":{"self":[{"href":"https:\/\/firmussec.com\/sg\/wp-json\/wp\/v2\/pages\/3766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/firmussec.com\/sg\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/firmussec.com\/sg\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/firmussec.com\/sg\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/firmussec.com\/sg\/wp-json\/wp\/v2\/comments?post=3766"}],"version-history":[{"count":6,"href":"https:\/\/firmussec.com\/sg\/wp-json\/wp\/v2\/pages\/3766\/revisions"}],"predecessor-version":[{"id":3832,"href":"https:\/\/firmussec.com\/sg\/wp-json\/wp\/v2\/pages\/3766\/revisions\/3832"}],"wp:attachment":[{"href":"https:\/\/firmussec.com\/sg\/wp-json\/wp\/v2\/media?parent=3766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}