Insights · Kit
Tabletop exercise design kit
A tabletop is cheap, safe and revealing when it is designed well: a realistic scenario, the right people in the room, injects that force decisions, and a record of what broke. This kit covers design, facilitation and follow-through.
How to use it
Before the first step.
- Two to three hours with leadership and the response team.
- The facilitator does not answer questions the plan should answer.
Steps
Each one owned and evidenced.
| # | Step | Owner | Evidence |
|---|---|---|---|
| 01 | Set objectives: which decisions, roles and plan sections the exercise should test. | Security lead | Objectives statement |
| 02 | Choose a scenario relevant to the organization: ransomware during month-end, a vendor breach, a lost device with client data. | Security lead | Scenario brief |
| 03 | Write the timeline of injects: new information at intervals that forces escalation, communication and decisions. | Facilitator | Inject script |
| 04 | Invite participants by role: executives, response team, legal, communications, IT; confirm attendance. | Security lead | Attendance list |
| 05 | Brief participants on ground rules: decide as you would, no hypothetical resources, note every gap. | Facilitator | Briefing notes |
| 06 | Run the exercise; a scribe records decisions, questions, delays and gaps against the timeline. | Facilitator and scribe | Exercise log |
| 07 | Debrief immediately: what worked, what broke, what was unknown. | Facilitator | Debrief notes |
| 08 | Write the exercise report: objectives, scenario, participants, observations, gaps, actions with owners and dates. | Security lead | Exercise report |
| 09 | Update the response plan, contact lists and playbooks from the findings. | Security lead | Plan change record |
| 10 | Schedule the next exercise and the drills the tabletop showed are needed. | Security lead | Exercise calendar |
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days