CISA Tabletop Exercise Packages give you ready made objectives, scenarios, discussion questions and references that you can customize. Pick a scenario that fits your risk, invite the people who would decide in a real incident, run a 90 minute discussion, and write down the gaps you find with owners and dates.
What the packages contain
According to CISA's page, each package includes template objectives, scenarios, discussion questions, references and resources, and can be customized. The page says there are over 100 packages. Cybersecurity scenarios include ransomware, insider threats, phishing, industrial control system compromise and sector specific cases such as elections, local governments, maritime ports, water and healthcare. There are also physical security and cyber physical scenarios.
The page lists the audience as stakeholders and partners and tags Federal Government. It does not state whether other organizations may use the material or what any support costs, so check CISA's page and contact before relying on that. A contact address is given there for questions and requests.
Choose the scenario
Pick one that matches a risk you worry about this year. For many companies, ransomware or a phishing led account takeover is the right start. Avoid exotic scenarios on your first run.
Pick the room
Invite the people who would act: a security lead, an engineering manager, someone from legal or compliance, a communications owner, and an executive who can make decisions. Six to ten people is enough. Assign a facilitator and a scribe.
A 90 minute agenda
- 10 minutes: purpose and ground rules. Say clearly that nobody is graded.
- 60 minutes: walk through the scenario in stages, using the package's discussion questions. Ask who does what, how you know, and where the information lives.
- 15 minutes: list gaps. Examples: no one knew the contact for the cloud provider, backups were untested, no decision on paying or not.
- 5 minutes: assign owners.
After the session
Write a one page summary: gaps, owner, due date. Revisit in a month. Run a different scenario next quarter or at least yearly.
Tailoring tips
- Replace generic system names with your real ones.
- Add an inject, such as a customer calling support about suspicious emails.
- Test your communication channels, since email may be down in the scenario.
Link to training
Tabletops double as role training for managers and executives. CISA also suggests no cost tabletop exercises to help staff understand their roles during an incident, in its phishing guidance.
Quick check
Do we need an outside facilitator?
Not necessarily. An internal facilitator who is not the incident owner can run a useful first session.
How often should we run one?
At least yearly, and again after a significant incident or major system change.
Sources
Last reviewed: 19 October 2026.
