Published October 28, 2026
What a tabletop exercise is
A tabletop exercise is a facilitated discussion of a scenario. The people named in a plan talk through what they would do.
FEMA's Homeland Security Exercise and Evaluation Program (HSEEP) classes the tabletop as a discussion-based exercise, alongside seminars, workshops and games. Its purpose, in HSEEP's words, is to identify strengths and areas for improvement and to change perceptions about plans, policies and procedures. The expected outputs are recommended revisions to those plans and an After-Action Report/Improvement Plan (AAR/IP).
NIST SP 800-84 says the objectives of any tabletop should be to validate the content of the plan, the roles and responsibilities it documents, and the interdependencies it describes. It is discussion-based only and does not involve deploying equipment or other resources.
Executives, technical staff, or both
First decide whose part of the plan you are testing. NIST SP 800-84 recommends separate exercises for senior-level and operational-level teams at first, because their responsibilities differ. Once both have been exercised on their own, it recommends a combined exercise to test coordination between them.
For senior staff, SP 800-84 says questions should be general and focus on decision-making and oversight. For operational staff, they should focus on the specific procedures each person follows.
Executive questions include who authorizes taking systems offline, who speaks to regulators and who decides on a ransom demand. For a US public company, add who decides whether the incident is material. The SEC requires a Form 8-K filing generally within four business days after a company determines that a cybersecurity incident is material.
The formats
| Format | Who attends | What it tests | Length |
|---|---|---|---|
| Seminar | Teams developing or revising a plan | Orientation to plans, roles and authorities | Minimal time constraints (HSEEP) |
| Executive tabletop | Senior leaders, legal, communications | Decisions, authority and oversight | 2 to 4 hours (SP 800-84) |
| Operational tabletop | Security, IT operations, service owners | Procedures, handoffs and escalation | 2 to 8 hours (SP 800-84) |
| Combined tabletop | Both groups, after each has exercised alone | Coordination between decision-makers and responders | Set by objectives |
| Functional exercise | Teams that run the response | Plans and procedures applied in real time, driven by scripted events | Set by objectives |
HSEEP describes a progressive program: a series of exercises that grow in complexity, each building on the one before.
The order of the work
- Get a senior sponsor. HSEEP names early and frequent engagement of senior leaders as the key to an exercise program. Ask the sponsor to get executives to attend.
- Pick the plan under test. Start with the incident response plan and the recovery and communications plans it depends on.
- Write the objectives. HSEEP asks for a reasonable number of objectives, each specific, measurable, achievable, relevant and time-bound (SMART). Draw on corrective actions from earlier exercises and real incidents.
- Choose the scenario. HSEEP says the scenario's threat originates from the organization's own risk assessments. CISA's 2021 fact sheet lists three ransomware packages: industrial controls, a third-party vendor and vendor phishing.
- Set the evaluation criteria. SP 800-84 says to write them before the exercise, from the objectives, so the note-taker knows what to record.
- Write the materials. A situation manual, a facilitator guide with the questions, a slide deck and a feedback form. CISA's packages include a version of each.
- Invite participants early, in writing. SP 800-84 allows the invitation to come from management.
- Run the session, then the hotwash immediately afterward.
- Write the AAR/IP, agree it, and track the actions.
What takes longer than expected
SP 800-84 says design is often the most time-consuming phase. It suggests starting at least three months ahead for a large, complex exercise and at least one month ahead for a simpler one.
Executive calendars set the date. Book the session before writing the scenario.
HSEEP says corrective actions should be tracked and reported on until completion.
Detailed scenarios slow the session down. SP 800-84 notes that with long scenarios, participants spend more time dissecting the scenario than meeting the objectives. It recommends a short, concise scenario.
The facilitator, injects and ground rules
HSEEP says a tabletop requires an experienced facilitator. The facilitator presents the scenario, keeps the discussion on the objectives and makes sure every issue is covered in the time allowed. SP 800-84 pairs the facilitator with a data collector, who records what participants say and decide. Both should know the plan and meet beforehand to review earlier exercise results.
The scenario unfolds in modules. CISA's ransomware situation manual uses two: early events such as a lost laptop and a phishing email, then data exfiltration, website defacement and ransomware. HSEEP defines an inject as an event the control staff introduce to players to build the exercise environment, and a contingency inject as one introduced when an expected player action did not occur. If the discussion stalls, SP 800-84 says the facilitator should ask further questions from the guide until all objectives are met.
The planning team are trusted agents. HSEEP says they are typically not players, and if they must play, they must take care not to divulge sensitive exercise information.
- The exercise is held in an open, no-fault environment.
- Respond using existing plans and capabilities.
- Decisions do not set precedent and may not reflect the organization's final position.
- There is no hidden agenda and there are no trick questions.
- Assumptions and artificialities are needed to finish in the time allowed.
Those ground rules are adapted from CISA's ransomware situation manual. Read them aloud at the start.
The after-action report and improvement plan
In the hotwash, SP 800-84 suggests asking where participants felt they did well, where they need more training, and which parts of the plan need updating.
HSEEP's AAR/IP contains an exercise overview, an analysis of performance against each objective, and a list of corrective actions. Each observation is labeled a strength or an area for improvement. A good observation states the issue, the analysis behind it and its impact.
The draft goes to senior leaders to confirm. HSEEP then calls for an After-Action Meeting to agree the findings, the corrective actions, an owner for each and a concrete deadline. The improvement plan can be an appendix.
HSEEP asks for SMART corrective actions. "Update the plan" is not one. "Name a deputy incident commander for each region, with an owner and a date" is.
Requirements and cadence
NIST SP 800-53 Rev. 5 control IR-3 requires testing the incident response capability at an organization-defined frequency, and its discussion names tabletop exercises as one form of testing. Enhancement IR-3(2) asks for coordination with the owners of related plans, such as business continuity, disaster recovery and crisis communications.
NIST Cybersecurity Framework 2.0 subcategory ID.IM-02 expects improvements to be identified from security tests and exercises, including those done with suppliers and relevant third parties. The AAR/IP, with evidence that its actions closed, can serve as that record.
SP 800-84 says to exercise periodically, and also after organizational changes, after updates to the plan, and when new guidance is issued.
Who runs it and how to tell it worked
Choose a facilitator from outside the participants' reporting line, so they can question senior leaders freely. Keep the data collector out of the play.
Measure the exercise against its objectives, not against how the room felt. Each objective should end the day marked met or not met, with the reason recorded. IR-3(3) in SP 800-53 asks for qualitative and quantitative data from testing, used to judge effectiveness and improve the process.
The real measure comes later. Count how many corrective actions closed by their deadlines. HSEEP asks for a system to validate that past corrective actions worked, and the next exercise is one way to do it.
Settle these first
- Which plan is under test, and is the copy everyone has the current one?
- Who is the senior sponsor, and will they attend?
- Is this session for executives, for responders, or for both together?
- What decisions must the scenario force, and which objectives do they serve?
- Who facilitates, who takes notes, and are either of them also players?
- Who owns the improvement plan, and where will its actions be tracked?
Questions
- How long should a cyber tabletop exercise last?
- NIST SP 800-84 gives 2 to 4 hours for senior-level tabletops and 2 to 8 hours for operational ones. It suggests adding a training session to any tabletop longer than four hours.
- How often should we run a tabletop?
- NIST SP 800-53 Rev. 5 leaves the frequency to the organization. NIST SP 800-84 says to exercise periodically and also after organizational changes or plan updates.
- Where can we get a ready-made scenario?
- CISA publishes tabletop exercise packages at https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages. CISA's fact sheet says each includes a situation manual, an exercise planner handbook, a facilitator and evaluator handbook, feedback forms and an HSEEP-aligned AAR/IP template.
- What goes in the after-action report?
- Under HSEEP, an exercise overview, performance against each objective, observations labeled as strengths or areas for improvement, and an improvement plan listing corrective actions with owners and deadlines.