---
{
  "title": "Tabletop exercises",
  "summary": "Practice decisions and coordination before an actual incident.",
  "topic": "grc",
  "level": "Beginner",
  "updated": "2026-10-12",
  "units": [
    3
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: Contingency Planning Guide",
      "url": "https://csrc.nist.gov/pubs/sp/800/34/r1/final"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

A tabletop exercise walks participants through a plausible scenario to test roles, assumptions, communication, and decisions. It does not usually perform all technical recovery steps. Define objectives, use realistic injects, and avoid treating the exercise as a performance to pass. Capture gaps with owners and follow-up actions. Pair discussion-based exercises with practical tests where technical execution needs verification.

## In practice

A team discusses a cloud identity outage and discovers its emergency contacts and recovery credentials depend on the same unavailable identity service.

## A common misunderstanding

A smooth discussion does not prove that backup restoration or containment commands will work.

## Check your understanding

What should happen after the exercise?

**Think it through:** Record lessons, assign improvements, and test or verify important unresolved dependencies.


## Rehearse decisions without causing an incident

A tabletop exercise uses a fictional scenario to explore how participants would coordinate and decide. It is not a penetration test or proof that technical recovery works. Its value comes from exposing unclear authority, missing information, conflicting assumptions, and communication gaps in a controlled discussion. Define the objective before writing an elaborate story.

Participants should represent the responsibilities needed for that objective. A ransomware coordination exercise may involve technical response, service ownership, leadership, communications, privacy, and suppliers. A facilitator introduces developments and asks what people would do, who can authorize it, and what information they need. Avoid rewarding confident guesses over honest uncertainty.

## A fictional lost-access scenario

An academy discovers that several administrators cannot access critical systems while unusual account changes appear in logs. The exercise asks how the team validates the report, preserves relevant evidence, activates response leadership, and communicates service impact. Later information introduces an unavailable supplier contact and a possible data-access concern.

The aim is not to force one predetermined answer to every inject. Capture the reasoning and identify where the existing plan is unclear. Follow-up actions need owners and verification. An enjoyable exercise with no resulting improvement can leave the same coordination weaknesses untouched.

## Write one useful inject

Choose a fictional learning-platform outage and an objective such as testing escalation. Write a short new fact that requires a decision, not merely another alarming detail. State which roles should respond and what evidence would demonstrate a workable process. After the discussion, turn one uncertainty into an owned improvement. Use technical drills separately when you need to validate actual tools or restoration capability.

## Keep exploring

- [[incident-playbooks]]
- [[business-continuity]]
- [[lessons-learned]]