Tabletop and cybersecurity exercises
How do I run a tabletop exercise without hiring a consultant?
For Small security, HR, operations, learning, and leadership teams
- Last updated
- Reading goal
- Run a credible first exercise with internal staff and limited budget
Start here
You can run a useful tabletop exercise in-house if you keep the scope narrow. Assign an exercise owner, choose one or two decisions to examine, adapt a credible public scenario, ask a neutral colleague to facilitate, rehearse the timing and technology, and capture strengths, gaps, owners, and dates. Bring in specialist help only when the risk, regulation, technical complexity, or organizational conflict exceeds the team's competence.
What to prepare
- A narrow, well-run exercise is better than a broad scenario the team cannot evaluate.
- Use public government guidance and packages as inputs, then adapt them truthfully.
- Separate facilitation, subject-matter advice, and note-taking when possible.
- Know when legal, safety, regulatory, or technical stakes justify outside expertise.
What is the minimum in-house exercise team?
| Role | Responsibility | Can one person combine it? |
|---|---|---|
| Exercise owner | Approves purpose, scope, participants, and follow-through | Yes, with the planner |
| Planner or writer | Builds objectives, scenario, prompts, and timing | Yes, with a subject expert |
| Facilitator | Guides discussion neutrally and protects time | Preferably separate |
| Recorder | Captures strengths, gaps, decisions, and actions | Possible, but difficult for the facilitator |
| Subject expert | Checks plausibility and explains current plans when needed | Yes, but should not dominate |
Swipe or use the left and right arrow keys to see more
CISA's tabletop packages are intentionally customizable and include objectives, scenarios, questions, and references. FEMA and NIST also publish exercise-development guidance. These sources reduce the need to invent a methodology, but they do not remove the need to adapt content to local roles, plans, and constraints.Cybersecurity and Infrastructure Security AgencyFEMA Preparedness ToolkitNational Institute of Standards and Technology
What is a practical four-week workplan?
Week 1: approve the brief
Name the scenario, participants, one or two objectives, session length, sensitivity, and desired output.
Week 2: draft the materials
Write the opening, three to five injects, prompts, ground rules, and an action-record template. Ask a subject expert to check plausibility.
Week 3: rehearse
Have the facilitator and recorder walk through every stage. Remove ambiguous prompts, check timing, and test the backup plan.
Week 4: conduct and follow up
Run the session, complete the hotwash, confirm the notes, and assign improvement actions. Schedule the first status review before attention fades.
When should you still use an outside specialist?
- The exercise concerns life safety, regulated operations, or legal duties the internal team cannot interpret.
- An independent evaluator is needed because internal politics would limit candor.
- The scenario requires technical simulation, red-team activity, or operational testing beyond discussion.
- Leaders need benchmarking or cross-industry experience that the team does not have.
- The organization cannot safely hold or sanitize the sensitive information involved.
- A certification, regulator, insurer, or contract explicitly requires qualified external participation.
Running an exercise internally is a resourcing decision, not a claim that all expertise can be improvised. Document the scope, assumptions, and limits so the final record does not suggest more assurance than the exercise produced.
What the platform handles—and what remains yours
Escape Scenario handles participant access, phase changes, one shared decision, the reveal, and debrief prompts for its available game. That leaves the facilitator more attention for the room.
The platform does not provide your emergency plan, legal advice, technical validation, or an independent evaluator. Use it only when the published scenario fits the learning objective, and bring in specialists when the stakes require them.
Sources and limits
CISA, FEMA, and NIST support focused in-house planning while recognizing when expertise is needed. They do not endorse Escape Scenario; we rechecked the current platform scope on August 29, 2026.
- CISA Tabletop Exercise PackagesCybersecurity and Infrastructure Security Agency. Customizable packages with objectives, scenarios, discussion questions, and supporting references.
- Exercise Design and DevelopmentFEMA Preparedness Toolkit. Planning resources for objectives, scenarios, documentation, and evaluation.
- Guide to Test, Training, and Exercise Programs for IT Plans and CapabilitiesNational Institute of Standards and Technology, 2006. Guidance for designing, developing, conducting, and evaluating IT test, training, and exercise events.