A supply chain tabletop needs five roles: a facilitator who runs the clock and reads injects, an evaluator who judges against objectives, a scribe who records, responders who make the decisions, and optional observers. One person can double up, but the facilitator and scribe should never be the same.
The roles in plain terms
CISA's exercise package templates separate planners, facilitators and evaluators, and participants. Engineering teams can map those to a smaller set that fits a 60 minute session.
| Role | Does | Does not |
|---|---|---|
| Facilitator | Reads injects, keeps time, asks "who would know?" | Answer for the team or solve the problem |
| Evaluator | Compares answers with the expected evidence | Join the discussion mid session |
| Scribe | Writes decisions, times and open questions | Interpret or summarise early |
| Responders | Decide and name real tools, people and commands | Say "we would look into it" |
| Observers | Watch, take notes for their own team | Speak during injects |
Choosing responders for a supply chain scenario
Pick people who would actually be paged. For dependency and pipeline incidents that usually means:
- someone who owns CI and build configuration
- an application engineer who knows what is deployed
- the person who can revoke credentials in your cloud and code hosting
- a security or on-call lead who can declare an incident
- a communications or customer contact for later injects
If a role has no real owner, that is your first finding. Record it.
Staffing a team of five
On a small team, combine like this:
- Engineering manager as facilitator.
- A senior engineer from another team as evaluator and scribe pair, or one person with a template.
- Three responders: CI owner, application engineer, security lead.
The key rule is that the person who wrote the scenario should not also play a responder. They know the answers.
The facilitator's job
Good facilitation is mostly restraint.
- State the rules: no blame, name real systems, say what you do not know.
- Read each inject once, then stop talking.
- If the group stalls, ask a question, not a hint.
- Stop discussion on time. Unfinished topics go on the open questions list.
The evaluator's job
Before the session, write three or four objectives, such as "identify all repositories using the affected component within 30 minutes" and "name who can revoke each secret type." Score each as met, partly met or not met, and note the evidence. This feeds directly into your after-action report. HSEEP, the FEMA program, describes recording strengths, areas for improvement, capability performance and corrective actions in an after action report and improvement plan, which is a useful model even outside emergency management.
Remote sessions
Use a shared document as the scribe's board and a separate channel for the facilitator's private notes. See running the exercise remotely.
Try it yourself
Click through it at your own pace, or open it full screen. Check who a finding would be assigned to, then ask whether your own responders map to those owners.
Safeguard provides asset discovery and policies that help identify owners for components and systems, which makes the responder roster easier to fill.
Quick check
Can the facilitator also be a responder?
It is better not to. Running the clock and playing a decision maker compete for attention, and the facilitator usually knows the scenario.
Do executives need to attend?
Not for the first technical run. Invite them for a later session built around business decisions and customer communication.
Sources
Last reviewed: 19 October 2026.
