NHS Executive Tabletop Exercise: Third-Party Dependency, Decision-Making, and Organisational Resilience

Cyber incidents affecting NHS organisations are no longer solely an IT issue.

A significant cyber event can quickly affect clinical services, operational capacity, communications, workforce deployment, patient safety, and critical third-party suppliers.

This private, scenario-led tabletop exercise will bring together a small group of senior NHS leaders to explore how an organisation responds when a major cyber incident begins to disrupt essential services.

Rather than focusing on technical cyber defence, the session will examine the decisions senior leaders may need to make during an incident, how responsibilities are shared across the organisation, and how boards and executive teams maintain safe and resilient services under pressure.

A Practical Board-Level Exercise

The centrepiece of the session will be an interactive tabletop scenario designed around a realistic cyber incident affecting an NHS organisation and one or more of its critical third-party dependencies.

Participants will work through the evolving scenario as a leadership group, considering:

• What information is needed before decisions can be made.
• Who should take ownership of different elements of the response.
• How clinical and operational services should be prioritised.
• When and how an incident should be escalated.
• How third-party suppliers should be managed during disruption.
• What the board and executive team need to know.
• How regulatory, governance, and assurance responsibilities should be handled.
• How the organisation moves from immediate response into recovery.

The exercise is intended to encourage discussion, challenge assumptions, and examine how different senior functions work together during a significant incident.

Who Should Attend?

This session is designed for senior NHS and public sector leaders who would have a role in organisational decision-making, governance, clinical continuity, or operational response during a significant cyber incident.

Relevant roles may include:

• Board members and Non-Executive Directors.
• Chief Executives and Executive Directors.
• Medical Directors and Deputy Medical Directors.
• Chief Clinical Information Officers.
• Chief Information Officers and Chief Digital Information Officers.
• Directors of Digital and Transformation.
• Directors of Operations.
• Directors of Risk, Governance, Audit or Assurance.
• Senior clinical leaders with digital resilience responsibilities.
• Senior leaders involved in Emergency Preparedness, Resilience, and Response.
• Integrated Care System and wider NHS executive leaders.