Cyber tabletop exercise: definition, process and examples
What is a tabletop exercise?
NIST SP 800-84 describes tabletop exercises as discussion-based exercises: a facilitator presents a scenario and asks the participants how they would proceed. This leads to a discussion about roles, responsibilities, coordination and decisions. No technology or other resources are used. The format suits cyber incidents well because much of what matters is decided outside the technology. Who may stop production? Who reports to the authority, and by when? What do you tell customers while the situation is still unclear? How to build the plan the exercise tests is explained in the article on the incident response plan.
Tabletop exercise, crisis simulation, cyber crisis exercise and crisis team exercise usually mean the same method. The terms only set a different emphasis: on the format, the management context, the practical delivery or the crisis team.
How does a tabletop exercise run?
Every tabletop exercise has three parts: preparation, delivery and evaluation. In detail, these are seven steps:
- Set objectives: what should the exercise test, for example the reporting chain or the decision on recovery? Good objectives derive from risks and controls.
- Prepare the scenario and injects: a short, credible starting situation and 4 to 8 injects that raise the pressure. Their order is set out in the master scenario events list (MSEL), the facilitator’s script.
- Fill the roles: the decision-makers in the functions they hold in a real incident, plus facilitation and observation.
- Briefing: clarify objectives, rules and the limits of the exercise. Say at the start: plans and procedures are being tested, not people.
- Delivery: the facilitator feeds in the injects. The team assesses, decides and communicates, and every decision is logged with a timestamp.
- Hot wash: straight afterwards the group collects what worked and where it got stuck, while the impressions are fresh.
- Evaluation: an after-action report records the findings. They become actions with an owner, a deadline and a priority.
Worked scenarios with injects, an agenda and facilitation questions are under Tabletop scenarios.
How often should you run tabletop exercises?
At least once a year, and additionally whenever something material changes. ISO 22301 asks in clause 8.5 for a programme of exercising and testing that validates the business continuity arrangements over time, with exercises that are planned, realistic and evaluated in a report.
ISO/IEC 27001 does not prescribe a fixed frequency. Controls such as A.5.24 (planning and preparation for managing information security incidents) and A.5.29 (information security during disruption) presuppose that the prepared procedures work. How often you check that is your risk-based decision, and you document it through monitoring and measurement (clause 9.1). The NIS2 Directive requires in Art. 21(2)(f) policies and procedures to assess the effectiveness of the cybersecurity risk-management measures. Regular exercises are an obvious way to show that. DORA goes one step further for financial entities: Art. 11(6) requires ICT business continuity plans to be tested at least yearly. You should also exercise on these occasions:
- after an incident or a near miss,
- after material changes to the organisation, the crisis team or the emergency plans,
- when new critical service providers, cloud migrations or sites are added,
- when new obligations take effect, for example changed reporting paths under NIS2.
How to derive an exercise programme in business continuity management from this is shown in BCM testing with the tabletop exercise.
Who takes part in a tabletop exercise?
At the table sit the people who decide in a real incident, plus a facilitator and at least one person who observes and takes the minutes. Invite the deputies as well. An attack does not follow the duty roster, and if it starts on a Friday evening, whoever can be reached decides. A cyber incident is also never purely technical. It is about reporting obligations, contracts and what you tell customers and staff. A typical line-up looks like this:
| Role | Task in the exercise | Typically filled by |
|---|---|---|
| Facilitation (facilitator) | Leads through the agenda and the scenario, feeds in the injects and asks the guiding questions. Does not play. | ISMS or BCM lead, or an external facilitator |
| Observation and minutes | Records who decided what and when, and assesses against criteria set beforehand. | A second person from the ISMS team, internal audit or quality management |
| Management / crisis team lead | Takes the fundamental decisions, sets priorities and approves measures and communication. | Management and the designated deputy |
| IT and security / incident response | Assesses the technical situation and proposes how to contain the incident and recover. | Head of IT, CISO or information security officer, SOC or MSSP |
| Legal and data protection | Checks the reporting obligations under NIS2 and the GDPR and the consequences under contracts. | Legal department, data protection officer |
| Communications | Formulates the messages inside and outside the organisation and answers enquiries from media and customers. | Corporate communications |
| Business units / operations | Assess what the incident means for the core processes and steer the emergency operation. | Depending on the scenario: production, sales, procurement or HR |
SecDrills assigns roles along the European Cybersecurity Skills Framework (ECSF). Everyone exercises in the function they hold in a real incident. That way you train your own specialist task and, at the same time, the coordination between IT and management.
What is documented in a tabletop exercise?
In an audit, an exercise only counts if it is documented in a traceable way, from the brief to the implemented action. The auditor asks when you last exercised, who took part and what has changed since. Complete exercise evidence consists of eight documents:
- Exercise brief and objectives: Which risk or which control the exercise tests.
- Scenario and scope: Starting situation, injects and the limits of the exercise.
- Participants and roles: Who took part in which function.
- Exercise log: Every decision with a timestamp.
- Observations / findings: What worked and where it got stuck.
- After-action report: The written evaluation of the exercise.
- Action plan: Every action with an owner, a deadline and a priority.
- Evidence of implementation and effectiveness check: Usually through a follow-up exercise.
Three of these are produced with SecDrills during the exercise: the list of participants with their roles, the exercise log with timestamps and the after-action report.
This chain supports the ISO 27001 requirements for continual improvement (10.1) and corrective action (10.2), feeds the management review (9.3) and shows that controls such as A.5.24 and A.5.26 are more than words on paper. Which evidence auditors check in detail is explained in ISO 27001: exercising and evidencing Annex A 5.24 to 5.30.
Examples: three typical tabletop scenarios
Ransomware
Monday morning. ERP and file servers are encrypted, and the attackers threaten to publish stolen data. Core questions: who decides whether systems are isolated and production stops? Who triggers the NIS2 early warning within 24 hours in the case of a significant incident?
Supply chain attack
A software supplier confirms a tampered update that was installed at your organisation as well. Core questions: how do you contain the damage without halting the whole operation? What does the contract say, and who talks to the supplier?
Cloud outage
Your most important SaaS provider has been unreachable for hours, and with it email and file storage. Core questions: how do the members of the crisis team reach each other without the usual channels? Which processes exceed their maximum tolerable period of disruption first?
These three and five more scenarios with all injects, guiding questions and an observation sheet are under Tabletop scenarios: 8 examples with injects.
Tabletop versus other exercise formats
Exercise formats differ in how close they get to reality and how much effort they take. Discussion-based formats test decisions and procedures. Operational and technical formats test whether measures and systems actually work:
| Format | What is exercised | Effort and risk |
|---|---|---|
| Plan walkthrough | A facilitator goes through an emergency or incident response plan with those responsible: is it plausible, complete and current? There is no running scenario and nothing is executed. | Low |
| Tabletop exercise | The team plays through a scenario with injects in its real roles: assess the situation, decide, report, communicate. | Low to medium, no risk to systems |
| Functional exercise | Individual measures are actually carried out, for example a restore test, a failover test, a recovery test or the move to an emergency workplace. | Medium, may affect operations |
| Full-scale exercise / simulation | All levels of the hierarchy and, where needed, external parties exercise under real conditions, from alerting to implementing the measures. | High, long preparation |
| Red teaming / TLPT | A red team attacks the production environment. What is tested is whether the attack is detected and how the response turns out. Under DORA, for financial entities designated by the supervisor, at least every three years. | High, only with specialised providers |
A tabletop exercise does not replace a technical test, and a technical test does not replace a tabletop exercise. A red team attack shows whether an attack is detected. The tabletop exercise shows whether the right decisions and reports follow. Mature exercise programmes combine both. To get started, the discussion-based exercise is usually the fastest route: the systems are not exposed to any risk, the preparation is manageable, and you have the first findings the same day. More on TLPT under DORA resilience testing and TLPT.
What does a tabletop exercise achieve?
- You find the gaps in plans, roles and communication before an attacker does.
- Team and management take decisions that they would otherwise face for the first time under pressure.
- You obtain evidence for your audits under ISO 27001, ISO 22301, TISAX and NIS2 (Art. 21(2)(c): business continuity and crisis management).
Tabletop software or ITSM/GRC tool: what do you need?
Four kinds of tool come into question for tabletop exercises: office documents, ticketing and wiki tools such as Jira and Confluence, ITSM, GRC and BCM platforms such as ServiceNow, and specialised tabletop software. They are built for different jobs. ITSM and GRC platforms manage tasks, risks and actions. They can plan an exercise as a record and track the results, but they do not guide you through the exercise. That is what specialised tabletop software is for: scenario, injects, roles and facilitation run in a guided flow, every decision gets a timestamp, and the after-action report is produced from that as evidence. ISMS leads therefore rarely have to choose one or the other. The question is which part belongs where: the exercise and the evidence in the tabletop software, the actions in the ticketing or GRC system you use anyway.
| Criterion | Office documents | Ticketing and wiki (e.g. Jira, Confluence) | ITSM/GRC/BCM platform (e.g. ServiceNow) | Specialised tabletop software |
|---|---|---|---|---|
| Scenario and injects | As a document, injects are read out | As a page or ticket, injects by hand | Depending on the module as a planned record. The exercise itself usually runs elsewhere. | Ready-made scenarios, injects in a guided flow |
| Facilitation and roles | The facilitator does everything | No exercise guidance | Roles and responsibilities through workflows | Guided flow, every person in their role |
| Log with timestamps | Written by hand | Comments and history, but not tied to the exercise | Workflow history | Every decision timestamped automatically |
| Report as audit evidence | Written by hand afterwards | Compiled by hand | Reports depending on configuration | After-action report produced automatically |
| Action tracking | Own list | Strong: tickets with owner and deadline | Strong: tasks, workflows, escalation | Findings and actions in the report. Implementation often runs in the ticketing or GRC system. |
| Effort to get started | Low, but every exercise needs a lot of preparation | Low if the tool is already in use | High (licence, configuration). Worth it if the platform is already there. | Low, runs in the browser |
The table describes how the categories are typically used. What a specific product can do depends on the module and the configuration.
When is an ITSM or GRC tool enough?
- You exercise rarely, and an experienced facilitator runs the scenario and the injects themselves.
- The platform is already licensed and set up so that exercises are recorded as records with results.
- What counts as evidence for you is mainly the action tracking, less the exercise log.
When is specialised tabletop software worth it?
- You want to exercise regularly, several times a year, with changing scenarios and teams.
- There is nobody to facilitate, or business units should be able to exercise without it becoming a project.
- The auditor expects a log with decisions and timestamps and a report with the same structure for every exercise.
- You want to compare the results of several exercises and show that your team is getting better.
Tabletop exercises with SecDrills
In SecDrills you pick a ready-made scenario and send your team a link. Everyone opens it in the browser, on tablets too, and talks as usual over Teams or Google Meet. The injects arrive in a guided flow, and every assessment and every decision is recorded with a timestamp. After the last decision the after-action report is ready, as PDF, Word or HTML. A short exercise takes 30 minutes, and you do not need an external facilitator. The method follows the Cybersecurity Exercise Methodology of ENISA, and the roles are assigned along the ECSF.
For your IT approval: nothing is installed, SecDrills needs no access to your systems or networks, and participants do not need their own account. Hosting is in the EU, in a Frankfurt data centre.
An externally facilitated exercise usually costs €5,000 to €15,000. The annual package Essentials costs €1,490 net for 3 participants. Professional costs €4,900 net for up to 10 participants and also includes evidence packs for ISO 27001 and NIS2. In both packages you exercise as often as you like. If you would rather have us facilitate an exercise, add the Guided Exercise for €3,900: a scoping workshop beforehand, live facilitation, and a debrief and review of the report afterwards. All packages are listed under Pricing.
Frequently asked questions
Which software is there for tabletop exercises?
There are four categories: office documents (Word, Excel), ticketing and wiki tools such as Jira and Confluence, ITSM, GRC and BCM platforms such as ServiceNow, and specialised tabletop software. ITSM and GRC platforms are strong at tracking actions. They do not guide you through the exercise itself. Specialised tabletop software guides scenario, injects and roles and produces the report as evidence. Many organisations use both: exercise and report in the tabletop software, the actions in the existing ticketing or GRC system.
What is a tabletop exercise?
A tabletop exercise is a facilitated, discussion-based exercise in which a team responds to a simulated scenario in its real roles, for example a cyber attack. What is tested are decisions, reporting paths, communication and coordination. Technical systems are not touched.
How long does a tabletop exercise take?
A focused tabletop exercise takes 60 to 90 minutes. With SecDrills a short exercise takes 30 minutes. Larger formats with several scenarios take longer: NIST SP 800-84 typically gives two to eight hours for tabletop exercises.
How often should you run a tabletop exercise?
At least once a year, plus after incidents and material changes. ISO 22301 expects a planned exercise programme, ISO/IEC 27001 sets no fixed frequency and expects risk-based planning, and DORA requires financial entities to test their ICT business continuity plans at least yearly.
What is the difference between a tabletop exercise, a crisis simulation and a cyber crisis exercise?
Usually it is the same discussion-based method seen from a different angle. Tabletop exercise names the format, crisis simulation stresses the management and crisis context, cyber crisis exercise the practical delivery.