Run a tabletop to test decisions and ownership, a functional drill to test a specific tool or procedure with real commands, and a game day to test everything together under realistic conditions. Most teams should start with tabletops and add the others as they find gaps.
Three formats, three questions
| Format | Question it answers | What people do | Risk |
|---|---|---|---|
| Tabletop | Do we know who decides what? | Talk through injects | Very low |
| Functional drill | Can we actually do this one thing? | Run real commands in a safe setting | Low to medium |
| Game day | Does the whole response hold up? | Handle a simulated event across systems | Medium |
The names are not universal. FEMA's HSEEP program, widely used in emergency management, covers exercise design, evaluation and improvement planning and records outcomes in an after action report and improvement plan. NIST SP 800-84, published in 2006, offers guidance on test, training and exercise programs for IT plans. Use any vocabulary your organisation already knows, but define it in the invitation.
Examples for supply chain work
Tabletop. The team discusses a compromised dependency. Output: a list of unknown owners and slow decisions. See the GitHub Action script.
Functional drill. One engineer must list every repository using a component and rotate a sandbox credential. Output: real times and missing permissions. Two ready examples are the SBOM incident drill and the timed rotation drill.
Game day. A planted, harmless marker package appears in a staging build and the team must find it, contain it and report, with injects arriving through normal channels. Output: an honest picture of detection and coordination. Plan it carefully, tell the right leaders in advance, and keep it out of production.
How to choose
- No incident plan or unclear owners: tabletop.
- Plan exists but untested tools: functional drill.
- Both exist and you want to find integration gaps: game day.
- New team members or new tooling: repeat a tabletop first.
A sensible yearly mix
- Two tabletops on different scenarios.
- Two functional drills on high-risk procedures such as rotation and rebuild.
- One game day once the first two are comfortable.
Common errors
- Jumping to a game day with no tabletop, so nobody knows the roles.
- Running only tabletops forever and never touching real tools.
- Skipping the written report, so lessons fade. Use an after-action report.
- Failing to tell on-call staff that a planned exercise is live.
Try it yourself
Click through it at your own pace, or open it full screen. Try the check that decides whether a finding matters, which is a good step to rehearse in a functional drill.
Safeguard provides reachability analysis, SBOM scanning and a free scan, which give you realistic material for hands-on drills.
Quick check
Is a tabletop enough for an audit?
Requirements vary by framework and auditor, so check the specific control. A documented tabletop with findings and follow up is commonly offered as evidence of incident response testing, but confirm with your auditor.
Is a game day safe in production?
Avoid it at first. Run in staging or with harmless markers, with leaders informed in advance.
Sources
- FEMA Homeland Security Exercise and Evaluation Program
- NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities
Last reviewed: 19 October 2026.
