Score a dependency compromise tabletop on a few observable behaviors, not on whether the team felt confident. Six dimensions on a 0 to 3 scale, with written anchors for each level, give you a result you can compare across exercises and turn into owned follow-up tasks.
Why score at all
A tabletop that ends with "that went well" produces nothing to compare next quarter. CISA's tabletop exercise packages include templates for an exercise plan, a feedback form for participants, and an After Action Report, which reflects the same idea: capture what happened in a form you can act on. A score is a compact way to carry that forward.
A score is not a grade for people. It measures how well your process, tools and information worked under a scripted situation. Say that at the start.
The six dimensions
| Dimension | 0 | 1 | 2 | 3 |
|---|---|---|---|---|
| Scoping | No way to say which systems contain the package | Answer given, but from memory | Answer from lockfiles or SBOMs for most systems | Answer from inventory for all systems, with gaps named |
| Decisions | Nobody decided | Decided late or by committee | Decided with a clear owner | Decided early, logged, with an end condition |
| Containment | No block possible | Manual block in some places | Block at mirror or pipeline | Block verified, plus update bots paused |
| Credentials | Not discussed | Discussed, no list | Rotation list with owners | Rotation order, verification and revocation checks |
| Communication | No draft | Draft after long delay | Internal and customer drafts | Drafts approved by the right roles, facts separated from guesses |
| Evidence | Nothing preserved | Partial | Logs and artifacts preserved before cleanup | Preserved, timestamped and indexed |
Adjust the wording to your environment, but keep the anchors concrete. "Good" is hard to score. "Answer came from lockfiles within the exercise window" is easy.
How to run the scoring
- Assign an evaluator who is not a participant. CISA's materials separate facilitators and evaluators from participants for this reason.
- Capture timestamps as the exercise runs: when the first injection landed, when the team named affected systems, when containment was agreed.
- Score right after, while memory is fresh, then compare with a second evaluator if you have one.
- Record evidence for each score: a quote, a document, a missing document.
- Discuss gaps with the group and ask what would move each low score up one level.
Turning scores into work
Pick the two lowest dimensions and write one change for each, with an owner and a date. A change might be "export an SBOM per build and store it with the artifact" for scoping, or "name the person who may block a package at the mirror" for containment. Resist a list of twelve. Small, finished fixes improve the next score.
Track the scores in a simple table by date. The trend is more useful than any single number. Do not compare teams against each other, since scenarios and environments differ.
What the score cannot tell you
A rubric measures a rehearsal. It cannot say how you would perform at 2 a.m. with partial information, and it does not replace for the real incident record. NIST's incident response guidance, SP 800-61 Rev. 3, frames incident response as part of overall risk management, which is a good reminder to feed lessons back into the wider program, not just into one runbook.
Quick check
Should every dimension count equally?
Not necessarily. If your biggest risk is slow scoping, weight it higher. Decide the weights before the exercise, not after.
Can a small team use this?
Yes. Use three dimensions, such as scoping, decisions and communication, and one evaluator.
Safeguard can help with the inventory side of this work. SBOM and dependency scanning show where a package and version appear across your projects, and policies and gates can stop a flagged version at the pull request. You can try a free scan at gold.safeguard.sh/scan.
Sources
- CISA Tabletop Exercise Packages
- NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management
Last reviewed: 19 October 2026.
