Insights · Field note · Security assurance and compliance
Tabletop exercises: designing one that teaches
A tabletop that confirms everyone did well has taught nothing. Design it to find the gap that would have hurt.
A tabletop exercise teaches when its scenario is specific to the organization, its injects force real decisions under uncertainty, the people who would actually decide are in the room, the facilitator refuses to answer questions the plan should answer, and the record captures every hesitation, unknown and disagreement as a finding. Two to three hours, leadership and the response team, a scribe, and a report with actions and owners. NIST SP 800-84 describes exercise programs; the design choices below are what separate a useful exercise from a comfortable one.
In detail
What the evidence shows.
The scenario
Ransomware during month-end close. A vendor breach affecting client data. A lost laptop with privileged material. The scenario is drawn from the organization’s own risks and timed for maximum inconvenience, because incidents are. Generic scenarios produce generic discussion.
Injects that force decisions
New information arrives at intervals: the backups are also encrypted; a journalist has called; the insurer asks whether the application was accurate; a regulator’s deadline is tomorrow. Each inject requires a decision from a named person, and the facilitator records who decided, how long it took and what they did not know.
The room
The chief executive or deputy, because they will be in the real one. Legal, communications, IT, security, operations, HR. Not observers; participants who decide as they would. A facilitator who does not rescue them and a scribe who writes everything down.
The record
Objectives, scenario, participants, timeline, observations, gaps, actions with owners and dates. The report updates the plan, the contact lists and the playbooks, and schedules the drills the exercise showed were needed. It is evidence for regulators, insurers and customers. The tabletop exercise design kit covers the steps; see tabletop exercises and tabletop exercise versus live drill.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days