Supply chain tabletops fail for predictable reasons: no objectives, the wrong people, a facilitator who gives away the answers, vague responses, a scenario that is too famous, no written record, and no follow up. Each is cheap to fix before the next session.
1. No objectives
If you cannot say what the session is meant to prove, you cannot tell whether it did. Write three objectives in advance, such as "list all affected repositories in 30 minutes" or "name who can revoke each credential type."
Fix: objectives in the invitation, scored in the report.
2. The wrong people in the room
A tabletop with only managers misses how things are done. One with only engineers misses approvals and communication. CISA's exercise templates separate planner, facilitator or evaluator and participant roles for good reason.
Fix: invite whoever would actually be paged, plus one communications or customer contact. See roles explained.
3. Facilitator rescue
When the team stalls, the facilitator supplies the answer. The exercise now measures the facilitator.
Fix: ask "who would know?" and record the stall as a finding.
4. Vague answers accepted
"We would check the logs" is not an answer. Which logs, held where, searched by whom, how long?
Fix: adopt the rule that each answer names a tool, a command or a person.
5. A scenario copied from the news
A famous incident invites storytelling and arguments about what really happened. Real details can also be wrong or outdated.
Fix: use fictional names and tie the scenario to a threat category. The SLSA mapping guide helps. If you borrow from a real case, use only public, confirmed facts.
6. No written record
Memory fades within days. Without a record, nobody can show what was found or compare against the next run.
Fix: a scribe, a shared document, and a short report within a week. Use the after-action template. HSEEP's approach is to document strengths, areas for improvement, capability performance and corrective actions in an after action report and improvement plan.
7. No follow up
The most common failure. Findings go in a document and nothing changes.
Fix: put every corrective action in your normal tracker with an owner and a date. Open the next session by reviewing last time's actions.
A quick self-test
| Question | Yes means healthy |
|---|---|
| Did we write objectives first? | Yes |
| Did every response name a person or tool? | Yes |
| Did the facilitator stay quiet? | Yes |
| Do we have a report with owners and dates? | Yes |
| Did we close last time's actions? | Yes |
Four or more yeses is a decent session. Two or fewer means fix the process before running another scenario. Also see why drill metrics matter.
Try it yourself
Click through it at your own pace, or open it full screen. See how findings carry an owner and a status, which is the discipline that mistake seven is missing.
Safeguard offers policies, compliance evidence automation and a free scan to help turn findings into tracked work.
Quick check
What is the single biggest mistake?
No follow up. A drill that produces no changes has not improved readiness, however well it ran.
Should a tabletop ever be a surprise?
The injects should be a surprise, but the date, scope and rules should not. A real surprise risks confusion with a live incident.
Sources
Last reviewed: 19 October 2026.
