A tabletop exercise is a facilitated discussion of a made-up incident. You pick a scenario, walk a small group through it in stages, and write down where the plan, the people or the tooling fell short. Two hours is enough for a first one, and CISA publishes free packages that give you the structure.
What CISA provides
CISA's Tabletop Exercise Packages include template objectives, scenarios, discussion questions and reference material. The supporting documents cover role guidance for planners, facilitators and participants, an invitation template, a slide deck, a feedback form and an After Action Report template. CISA lists over 100 packages. The cyber group includes ransomware, insider threats, phishing and industrial control system compromise.
You can use one as is or trim it to fit your company.
Set it up
- Pick one scenario. Ransomware on a file server is a good start.
- Write two or three objectives, such as "confirm who declares an incident" or "test the call tree".
- Invite the incident lead, an engineer, someone from legal or operations, and whoever speaks to customers.
- Name a facilitator who is not also a decision maker, and a scribe.
Run it in stages
Present the scenario in short injects. Each inject adds a fact and asks a question.
- "Several laptops show a ransom note. What do you do first?"
- "Your cloud admin console shows a login from a country you do not operate in. Who needs to know?"
- "A reporter calls. Who answers?"
Let people answer from the real plan. If the answer is "I would look that up", note it. Resist the urge to solve problems during the session. The goal is to find them.
Record gaps, not blame
Keep the scribe's notes factual: what was decided, what was unclear, what depended on one person. Treat the exercise as learning, in the same spirit as a blameless postmortem. See how to write a blameless postmortem.
Close with an after action report
Within a week, write a short report: scenario, participants, what worked, what did not, and a list of actions with owners and dates. CISA's package includes a template. Put the next exercise on the calendar before you close the meeting, or it will not happen.
Common mistakes
- Making the scenario so dramatic that nobody can relate to it.
- Letting executives skip it. Decisions about customers and money are exactly what you are testing.
- Fixing the plan live instead of recording the gap.
- Never repeating it.
Quick check
How often should we run a tabletop?
At least once a year is a common rhythm, and again after a major change or a real incident. Pick a cadence you will keep.
Do we need an outside facilitator?
Not for a first exercise. A colleague outside the incident team can facilitate using a CISA package.
Sources
Last reviewed: 19 October 2026.
