Tabletop and cybersecurity exercises
What is a tabletop exercise, and how do you run one?
For Emergency, operations, security, and leadership teams
- Last updated
- Reading goal
- Understand the format and run a first discussion-based exercise
Start here
A tabletop exercise is a facilitated, discussion-based session in which participants talk through how they would respond to a realistic scenario. To run one, define a small number of objectives, invite the people who own relevant decisions, write a plausible sequence of events, ask decision-focused questions, capture gaps without turning the session into a test, and finish with named improvement actions.
What to prepare
- Start with decisions and objectives, not a dramatic storyline.
- Keep the scenario plausible enough to expose dependencies and assumptions.
- Use a neutral facilitator who asks what, who, when, and on what authority.
- Treat the output as an improvement plan, not a pass-or-fail score.
What makes an exercise a tabletop exercise?
A tabletop is discussion-based. Participants describe decisions, coordination, communications, and expected actions while a facilitator advances the scenario. People usually do not deploy equipment or perform full operational tasks. FEMA distinguishes this analytical format from operations-based exercises, while NIST describes table tops as a way to exercise plans and roles through facilitated discussion.Federal Emergency Management AgencyNIST Computer Security Resource Center
| Part | Purpose | Useful question |
|---|---|---|
| Objective | Defines what the group is examining | Which decision or handoff do we need to understand? |
| Scenario | Creates a shared, plausible context | What has happened, and what is still uncertain? |
| Inject | Adds a new fact or constraint | What changes now? |
| Discussion | Surfaces roles, assumptions, and dependencies | Who acts, with what information and authority? |
| Improvement action | Converts discussion into follow-through | What will change, who owns it, and by when? |
Swipe or use the left and right arrow keys to see more
How do you run a tabletop exercise step by step?
Name the purpose
Choose one scenario domain and two to four observable objectives. An objective such as “clarify who can authorize an external notification” is easier to facilitate than “test our resilience.”
Invite decision owners
Include the roles that would exchange information, make approvals, perform work, or experience downstream effects. List role names rather than relying only on seniority.
Build a plausible timeline
Write an opening situation and a short set of injects that create decisions tied to the objectives. Remove details that are merely theatrical.
Prepare prompts and ground rules
Ask participants to work from current plans and normal authority. Make it safe to identify uncertainty, and separate what the plan says from what people believe would happen.
Facilitate the conversation
Advance one event at a time. Probe unclear ownership, missing information, timing, escalation, and dependencies. Keep the group on the objective without solving every policy issue live.
Debrief and assign actions
Record strengths, gaps, unresolved questions, owners, and target dates. Confirm the written record with participants after the session.
FEMA's HSEEP doctrine organizes exercises around program management, design and development, conduct, evaluation, and improvement planning. A small team does not need to reproduce every artifact in the doctrine, but that lifecycle is a sound check against treating the live meeting as the whole exercise.Federal Emergency Management AgencyFEMA Preparedness Toolkit
What should the facilitator say and capture?
- Ask “What would you do next?” before offering options.
- Follow with “Who owns that decision?” and “What information would they need?”
- Mark assumptions explicitly so they are not mistaken for current policy.
- Capture a strength when an existing plan or relationship works as intended.
- Capture a gap when ownership, information, capability, or timing is unclear.
- Park policy redesign for follow-up unless it blocks the exercise objective.
Where a game-based format fits—and where it does not
In Escape Scenario, people make one team decision and then unpack how they shared evidence and negotiated. The facilitator controls the reveal and leads the debrief.
Use that experience to practice discussion. It cannot replace an emergency or cybersecurity exercise, and a game result cannot prove compliance or show that a response plan works.
Related practical questions
- How long does a tabletop exercise take?
- A narrowly scoped discussion can fit into a short meeting; more participants, objectives, injects, or cross-functional decisions require more time. Scope the exercise to the time available instead of rushing a long scenario.
- Who should facilitate?
- Choose someone who can remain neutral, manage time, ask follow-up questions, and capture gaps. Subject-matter expertise helps, but the facilitator does not need to supply every answer.
Sources and limits
FEMA and NIST explain how discussion-based exercises are designed; neither source evaluates Escape Scenario. We rechecked the facilitator guide, catalog, Pricing page, and scoring page on August 29, 2026.
- Tabletop ExerciseNIST Computer Security Resource Center. A concise definition of a discussion-based tabletop exercise.
- Exercise TypesFederal Emergency Management Agency. Distinguishes discussion-based tabletops from more operational exercise types.
- Homeland Security Exercise and Evaluation ProgramFederal Emergency Management Agency. A common doctrine for exercise program management, design, conduct, evaluation, and improvement planning.
- Exercise Design and DevelopmentFEMA Preparedness Toolkit. Planning resources for objectives, scenarios, documentation, and evaluation.