The NCSC Cyber Assessment Framework asks a demanding question that cannot be answered by policy documents alone: Can an organisation demonstrate that its essential functions are genuinely resilient to cyber disruption? A well-designed Cyber Crisis Tabletop Exercise (or cyber drill) helps answer that question by placing real people and established plans inside a credible incident scenario. It then reveals how the organisation makes critical decisions when information is incomplete and time is limited.