Exercise setup
- Scenario chosen
- Date, time, and duration
- e.g. 90 minutes
- Participants and their real roles
- Include legal and comms, not technical staff alone.
Tabletop Exercise Facilitator Pack
Tabletop exercises fail when they become a presentation about the plan. The value comes from injects that invalidate assumptions mid-exercise and force the group to decide with incomplete information.
What you get
- Three ready scenarios with timed injects
- Facilitator guidance including the questions that produce findings
- A findings capture sheet tied to actions
- A structure that works in ninety minutes
How to use this template
- 1
Do not circulate the scenario in advance. Participants who have prepared answers give you a rehearsal rather than a test. Share the scope and the time, not the scenario.
- 2
Use injects to break assumptions. The exercise becomes useful at the moment the plan stops applying: the incident commander is unreachable, backups are also encrypted, a journalist calls. Injects should remove the comfortable answer.
- 3
Capture findings as actions with owners. An exercise producing a general sense of unpreparedness changes nothing. Every finding needs an owner and a date, tracked like any other action.
What's inside
Here's a preview. Unlock the free download to get all 4 sections (3 more below).
Related templates
More free templates IT teams use alongside this one.
Incident Response
Get templateIncident Response Plan Template
Security incident response plans are usually written for an auditor and discovered to be unusable during the first real incident. The sections that matter are the ones you read in the first hour: who decides, who to call, and what not to touch.
Backup & Continuity
Get templateRansomware Recovery Playbook
Ransomware recovery differs from ordinary disaster recovery in one decisive way: the environment you restore into may still be compromised. This playbook sequences containment and credential reset before restoration, so you do not recover twice.
Backup & Continuity
Get templateIT Disaster Recovery Plan
Most DR plans are written to satisfy an auditor and are unusable in an actual disaster: too long, structured by system rather than by sequence, and assuming the authors are available. This one is ordered the way the event unfolds.
Frequently asked questions
How long should a tabletop exercise last?
+
Ninety minutes is usually right: long enough for several injects and real discussion, short enough that senior people attend and stay engaged. Longer exercises tend to lose the legal and communications participants who matter most.
Who should attend an incident response tabletop?
+
The people who would actually respond: technical leads, the incident commander, legal, communications, and an executive. Technical-only exercises miss the decisions that cause the most delay in real incidents.
What makes a tabletop exercise useful rather than theatre?
+
Injects that invalidate assumptions mid-exercise (backups are also encrypted, the commander is unreachable, a journalist calls) and capturing findings as owned, dated actions rather than as a general impression.