A tabletop exercise plan is a HSEEP-aligned, facilitator-led discussion, typically 4–8 hours, built on a Situation Manual, a slide deck, and evaluator forms. It ends with an After-Action Report (AAR) and an Improvement Plan (IP) that records corrective actions and their owners. If your plan can’t deliver those pieces, it’s a meeting, not an exercise.
TL;DR:
- Write each objective against a named plan or policy, define its evaluation signal before drafting the scenario, and cut anything the session cannot cover.
- Schedule four planning meetings to assign document owners, review the Situation Manual, confirm logistics, and brief evaluators before exercise day.
- Brief evaluators before the event, draft the After Action Report within three to four weeks, and assign each corrective action an owner and deadline.
- Test audio and screen sharing 30 minutes early, keep facilitation neutral, and move technical troubleshooting aside to protect decision time.
- Regulated organizations should test required notification and documentation duties, then record assigned owners and deadlines in the Improvement Plan as audit evidence.
Table of Contents
- What a tabletop exercise is and how to set measurable objectives
- Planning timeline and Exercise Design Team roles
- Create the scenario, SitMan, slide deck, and participant materials
- Running the TTX: facilitation, format choices, logistics, and virtual adaptations
- Evaluation: capturing observations, drafting the AAR, and producing an Improvement Plan
- Sample 4-hour tabletop agenda and planning checklist
- Common mistakes, facilitation dos and don’ts, and one expert pro tip
- How to fold NIST, CISA guidance, and compliance requirements into your exercise
- Customizing tabletop exercises for different sectors and organizational sizes
- Incorporating real-world threat intelligence and scenarios relevant to your clients
- Measuring effectiveness and maturity levels through tabletop exercises
- Collaboration with external partners, such as law enforcement or vendors, during exercises
- Turning tabletop findings into steady preparedness
- How we help you design, run, and fix after a tabletop exercise
- FAQ
- Sources
What a tabletop exercise is and how to set measurable objectives
FEMA’s HSEEP program describes a tabletop exercise (TTX) as a discussion-based event that tests existing plans and policies. The same guidance says these exercises typically run 4–8 hours. You gather the right people, walk through a scenario, and talk through who decides what. Nobody touches a keyboard or deploys a response team.
The payoff is practical. EPA guidance says the purpose is to test plans, surface strengths and areas for improvement, and strengthen coordination. It also calls for an experienced facilitator who keeps the talk decision-focused instead of drifting into fast operational reactions.
Objectives are where most plans win or lose. Keep the objectives focused, and write each one so you could later say “met” or “not met”:
- Tie each objective to a capability. “Test our ability to declare an incident and notify leadership” beats “improve communication.”
- Name the plan or policy being tested. If the objective can’t point at a document, it’s too vague.
- Pick an evaluation signal up front. Decide what an evaluator will look for before the scenario is written.
- Cut anything you can’t discuss in the time. Too many objectives for the available time means shallow answers on all of them.
Planning timeline and Exercise Design Team roles
HSEEP-based templates and checklists lay out the planning meeting types: Concept and Objectives (C&O), Initial Planning Meeting (IPM), Midterm Planning Meeting (MPM), and Final Planning Meeting (FPM). You can see them in the Preparedness Toolkit design guidance. Here’s a lean calendar that works for small and mid-sized teams:
- C&O: Agree on purpose, scope, and focused objectives. Name the exercise planner.
- IPM: Confirm the scenario theme, participant list, date, and venue. Assign document owners.
- MPM: Review the draft Situation Manual and slides. Lock the invitation list and send invitations.
- FPM: Walk the agenda, check logistics, brief evaluators, and print materials.
- Exercise day: Run it, collect observations, and hold the hotwash.
The Exercise Design Team (EDT) carries this work. HSEEP guidance assigns the EDT objectives, scenario design, logistics, and post-exercise evaluation. In practice you need an exercise planner, a facilitator, evaluators, subject matter experts for scenario accuracy, and someone on logistics.
Keep the core team small so it can make decisions efficiently.
Create the scenario, SitMan, slide deck, and participant materials
Every document has a job. CISA’s Tabletop Exercise Packages (CTEP) give you customizable templates so you aren’t starting from a blank page. The CTEP fact sheet lists an Exercise Planner Handbook, a Facilitator and Evaluator Handbook, a Situation Manual (SitMan), slide deck templates, and an HSEEP-compliant AAR/IP template.
According to EPA’s design guidance, the SitMan holds the scope, schedule, objectives, scenario narrative, and discussion questions. Build yours like this:
- Scope and objectives: Say what’s in and what’s out, so nobody asks about the unrelated server migration.
- Schedule and ground rules: Include the no-fault assumption and any simplifying assumptions, such as “all backups are available.”
- Scenario narrative: Write it in short modules, each a few paragraphs, ending on a decision point.
- Discussion questions: Tie each to an objective. “Who has authority to take the system offline?” is a real question.
- Injects: Pre-write the updates the facilitator will release, with timing.
- Handbooks and handouts: Give the facilitator pacing notes and decision checkpoints, and give evaluators observation forms. Participants get a short handout with the agenda and roles.
Mirror the SitMan in your slide deck: one module per section, a timer, and a prompt slide for each question.
Running the TTX: facilitation, format choices, logistics, and virtual adaptations
On the day, the facilitator is the whole show. CISA’s tabletop tips describe facilitators presenting facts and injects and moderating, while note-takers record the discussion against plans and procedures. EPA facilitation tips add the basics: be prepared, pick the right setup, state your guidelines and assumptions, and encourage participation in a low-stress, no-fault environment.
- Stay neutral. Ask “what would you do?” and don’t answer for the room.
- Timebox hard. Set a clock per module and park side debates on a visible list.
- Set the room. Use name tents, printed SitMan copies, a tested projector, and a planned break.
- Go virtual smartly. Use breakout rooms for small groups, one shared document in Google Docs or Microsoft SharePoint for notes, and a clear signal for turn-taking, such as the raise-hand tool.
- Check tech early. Test audio and screen sharing 30 minutes before start, not at start.
Pro Tip: Send the agenda and role list in advance, and ask each participant to bring the plan they own. People who’ve reread their own plan answer faster and with fewer guesses.
Evaluation: capturing observations, drafting the AAR, and producing an Improvement Plan
Evaluation starts before the exercise. HSEEP’s evaluation resources describe Exercise Evaluation Guides (EEGs) and structured evaluator forms that tie observations to the AAR/IP and to corrective actions. Hand evaluators the forms in the final planning meeting, not at the door.
Capture evidence three ways:
- Evaluator observations: One evaluator per objective, recording what happened against the EEG.
- Note-takers: A running log of decisions, who made them, and when.
- Participant feedback forms: A short form at the hotwash, while impressions are fresh.
Timing matters. A workable cadence is to draft the AAR within three to four weeks, then hold an After-Action Meeting and finalize and distribute the report as part of the post-exercise process. Per EPA guidance, the facilitator prepares the AAR and IP.
Turn each finding into a SMART corrective action: specific, measurable, assigned to one owner, realistic, and dated. “Improve notification” fails. “Update the call tree and test it by an agreed deadline” passes.
Sample 4-hour tabletop agenda and planning checklist
Copy this straight into your invitation and SitMan:
- 0:00–0:20, Welcome and objectives: Introductions, ground rules, and the no-fault reminder.
- 0:20–1:30, Scenario module 1: Initial detection and first decisions.
- 1:30–1:45, Break.
- 1:45–2:50, Scenario module 2: Escalation, communications, and recovery decisions.
- 2:50–3:30, Hotwash: What worked, what didn’t, and who owns each fix.
- Next steps: Confirm the AAR timeline and thank everyone.
Before you send invitations, check this list:
- Invitations sent with the agenda attached
- SitMan printed and distributed
- Evaluator forms prepared and evaluators briefed
- Room and AV booked and tested
- AAR/IP owner assigned
- Note-takers confirmed
Common mistakes, facilitation dos and don’ts, and one expert pro tip
Most tabletop failures are people problems, not document problems.
- Too many passive observers. Silent attendees don’t add decisions. Invite people who own a plan or a call.
- No AAR owner. Findings without a name attached tend to sit in a folder.
- Over-technical scenarios. If the room debates packet captures, you’ve lost the decision-makers.
- Do set a no-fault tone and call on quieter players by name.
- Don’t let the room troubleshoot a technical fix. Log it and move on.
Pro Tip: Assign AAR/IP owners during the hotwash, out loud, with the room watching. Public ownership speeds up follow-through.
How to fold NIST, CISA guidance, and compliance requirements into your exercise
You don’t need a separate exercise for compliance. Pick the framework or rule your auditors care about and write one or two objectives that exercise it. If you follow the NIST Cybersecurity Framework, aim an objective at the response and recover functions. If CISA guidance drives your program, pull scenarios from CISA’s scenario library and customize them.
For regulated work such as HIPAA, CJIS, or CMMC, test the specific duties the rule creates: who notifies whom, how fast, and who documents it. Then keep the proof. A completed AAR with named owners and dates is evidence that you tested your plan and acted on what you found.
Start with clear definitions, too. Your team can’t practice triggering a response if nobody agrees on what counts as an incident, and our guide on what a security incident is and when to act helps settle that before the scenario is written. Then map findings back to your written rules. Where a fix changes a procedure, update the policy itself, and our piece on cybersecurity policies for SMB owners shows how to keep those documents usable.
Customizing tabletop exercises for different sectors and organizational sizes
The template stays the same. The scenario, the cast, and the depth change.
A small business with a handful of staff might run a shorter version with the owner, the office manager, and the outside IT provider. The scenario can be simple: a phished email account leads to a fraudulent wire request. Decisions are few, but they’re the ones that cost money.
A mid-market company needs more voices: IT, legal, HR, finance, communications, and an executive sponsor. Split the room into tables by function so each group can answer for its own lane, then reconvene to compare answers.
Sector flavor matters too. A healthcare office should pressure-test patient data handling and downtime procedures. A government contractor should test how it handles controlled information and contract notification duties. A utility or water system, the audience EPA’s tool was built for, should think about operations that can’t simply be switched off.
Whatever your size, scale the scenario to your actual assets. Know what you run before you rehearse losing it. Our six-step IT asset inventory guide gives you a way to list the systems and data a scenario should threaten, so the exercise stays tied to things you really own.
Incorporating real-world threat intelligence and scenarios relevant to your clients
A good scenario feels like next Tuesday, not a movie plot. Start with what’s actually hitting organizations like yours: phishing that leads to account takeover, ransomware on a file server, a vendor breach that exposes your data, or an unpatched internet-facing system.
Pull ideas from public sources. CISA’s scenario packages give you ready starting points, and your own incident history is even better. If your help desk recently fielded a suspicious email, build a module around it. Participants recognize the story, so they engage.
Then connect the scenario to your environment. Name your real systems, your real vendors, and your real escalation path. If a client-facing service is the crown jewel, put it at the center. If you serve clients, ask what they’d want to know early in the incident and make that an inject.
Keep technical detail at the level decision-makers need. Automation can shape the scenario too. Teams weighing how runbooks and tooling fit into response can read Opsphere’s piece on safe automation for incident response, then ask in the exercise who approves an automated action and who checks its result. That’s a decision question, which is exactly what a tabletop is for.
Refresh the scenario every cycle. Repeating the same story teaches people the answer, not the skill.
Measuring effectiveness and maturity levels through tabletop exercises
One exercise gives you a snapshot. A series gives you a trend.
Start with the objectives. Each one was written to be met or not met, so score them that way, using the evaluator forms and EEGs from the evaluation stage. Then track a few repeatable signals across exercises:
- Objectives met: Which objectives were fully met?
- Decision speed and clarity: Did the room reach a decision, and did people know who owned it?
- Plan accuracy: How often did the written plan match what people said they’d do?
- Corrective action closure: How many fixes from the last AAR got done on time?
That last one is the most honest maturity measure you have. Check it at the start of every new exercise. If earlier fixes are still open, the exercise may find the same gaps.
You can also describe maturity in plain levels. Early on, plans are informal and findings are mostly “we don’t have that.” Midway, plans exist and the room mostly knows them. Later, decisions are fast, owners are named, and fixes close on schedule. Pick a simple scale, score yourself with the same rubric each time, and share the result with leadership.
Don’t chase a perfect score. A hard scenario that exposes real gaps beats an easy one that proves nothing.
Collaboration with external partners, such as law enforcement or vendors, during exercises
Your response doesn’t stop at your front door. Real incidents involve your IT provider, your cloud vendor, your insurer, outside counsel, and sometimes law enforcement. If none of them ever sit in your exercise, you’re guessing about the most important handoffs.
Bring outside partners in on purpose. Invite your managed service provider and key vendors to a module that touches them. Ask them to bring their own response steps and contact paths. Many gaps show up right here: nobody knows the vendor’s after-hours number, or the contract doesn’t say who calls whom.
For law enforcement and regulators, think about the decision, not the drama. When would you contact them? Who makes that call? What would you hand over? You can also invite a local liaison as an observer or subject matter expert, so your team hears real expectations.
A few ground rules keep it smooth:
- Share the SitMan early so partners can prepare.
- Confirm confidentiality before sensitive details go on a slide.
- Assign each partner a role so they’re players, not spectators.
- Capture partner action items in the same IP, with owners and dates.
Your people will also need to recognize the threat in the first place, and our cyber awareness training can reinforce what the exercise reveals.
Turning tabletop findings into steady preparedness
The exercise isn’t the win. The follow-through is. I’ve seen the pattern in how teams treat these events: a good day of discussion, a thoughtful report, and then nothing, because nobody owned the fixes. The teams that improve treat every finding like a small project with a date. Prioritize the corrective actions that cut the most risk, finish those first, and run a later exercise to see whether they worked. If you’d like a hand turning findings into action, our team is happy to talk it through.
— Alden
How we help you design, run, and fix after a tabletop exercise
Running a tabletop takes time you may not have, and a fresh set of eyes finds gaps your own team misses. We design and facilitate exercises, then help you close what they uncover. Here’s what we bring:
- Managed cybersecurity through our managed cybersecurity services
- vCSO leadership to own the improvement plan
- Tabletop facilitation and security assessments
- Cybersecurity training for the people in the room
Ready to build and run yours? Contact us through our MSP form and we’ll help you plan the exercise and finish the fixes.
FAQ
What is a tabletop exercise example?
A common example is a ransomware scenario: a staff member opens a malicious attachment, files stop opening, and the group discusses who declare an incident, who notifies leadership, and how operations continue. Participants talk through decisions only, with no live systems involved. FEMA’s HSEEP guidance describes the format as a discussion-based event that tests existing plans and policies.
How do you plan a tabletop exercise?
Start by setting focused objectives, then build a small design team and hold planning meetings along the way. Draft the Situation Manual, slides, and evaluator forms, then print and distribute them before the day. The HSEEP design resources outline the meeting sequence and templates.
What is a tabletop training exercise?
It’s a facilitated, discussion-based session where people practice their roles in a made-up emergency or incident. It trains decision-making and coordination, and it checks whether written plans match what people would really do. An experienced facilitator keeps the talk focused on decisions, as EPA guidance explains.
What is a table top workout?
That phrase usually means a short fitness routine done at a table or desk, and it has nothing to do with emergency planning. If you’re looking for preparedness practice, the term you want is a tabletop exercise, a discussion-based drill for testing your plans.