A week before a supply chain tabletop, fix the objectives, finalise a fictional scenario and injects, invite the right roles, gather real reference material, test the tools and agree the ground rules. Two hours of preparation per hour of exercise is a fair guide.
Seven days out: objectives and scenario
- Write three objectives that can be scored, such as "identify every repository that uses the affected component" or "name who can revoke registry tokens."
- Choose a scenario tied to something you use. If unsure, see how to pick scenarios from the SLSA threat list.
- Use a fictional package or vendor name. Do not use real victims.
Five days out: injects and evidence
- Draft four to six injects with time, channel, content, decision forced and expected evidence. How to write injects has the template.
- Prepare any artifacts: a trimmed fake advisory, a sample log line, a workflow file with a mutable tag.
- Write the expected answers. They make evaluation fairer.
Four days out: invitations
CISA's tabletop packages include templates for participant invitations, role definitions, a slide deck and a post exercise feedback form, which are handy starting points.
The invitation should include:
- date, time and length
- the objectives, but not the injects
- ground rules
- the roles people will play
- what to bring: laptop and access to your usual tools
Three days out: reference material
Gather real information the team should consult, not memorise:
| Item | Why |
|---|---|
| Contact sheet | Who to call and how. See the contact sheet guide |
| Incident plan | To test whether it is usable |
| Repository and registry list | For scoping |
| Credential owner list | For rotation questions |
If any of these does not exist, note it as a pre-exercise finding rather than inventing it.
Two days out: logistics
- Book the room or video link, plus a backup.
- Prepare the scribe document with headers: timeline, decisions, open questions, actions.
- Brief the facilitator and evaluator separately. Agree on a stop rule for real alerts.
- Check calendars for on-call conflicts.
The day before: ground rules
- No blame. We are testing the process, not the person.
- Say what you do not know.
- Name real tools, commands or people.
- Decisions are recorded even when nothing is executed.
- If a real incident occurs, the exercise stops.
After the session
Hold the debrief while it is fresh and write up an after-action report within a week. Put actions in your tracker.
Try it yourself
Click through it at your own pace, or open it full screen. Use it to see what a repository and dependency list can look like, then check whether yours exists for the reference pack.
Safeguard offers SBOM and dependency scanning and a free scan, which can produce a starting repository and dependency list.
Quick check
Should participants prepare?
They should know the objectives, the rules and their role. Do not share the injects, because the surprise is part of the test.
How much preparation is too much?
If preparation takes longer than a few hours for a 60 minute exercise, simplify. A smaller scenario that gets run is better than an elaborate one that gets postponed.
Sources
Last reviewed: 19 October 2026.
