How should an MSP charge customers for a cybersecurity tabletop exercise?

Choose a commercial model

An MSP should charge for a cybersecurity tabletop exercise based on the complete delivery outcome, not simply the 60-120 minutes spent in the live session. The service includes preparation, environment tailoring, facilitation, observation, a hot wash, and an after-action report.

Three commercial models work naturally for this service:

• Fixed-fee engagement: Sell one defined exercise with a stated scope, participant group, live session, and report. This is straightforward for a customer buying its first exercise.
• Recurring readiness service: Include exercises in a quarterly or other agreed service cadence. This creates a repeatable programme in which scenarios and decision boundaries can change over time.
• Managed-service add-on: Add tabletop exercises to an existing security, incident response, vCISO, MSSP, or MDR agreement. Define the exercise allowance and any work that falls outside it.

Do not imply that buying or completing an exercise delivers regulatory compliance. An exercise can help a customer test plans, roles, escalation routes, and decisions, but it does not satisfy a regulation on its own.

Define the billable scope

Before setting a fee, specify exactly what the customer receives. A clear statement of work reduces disputes and prevents unlimited preparation from being absorbed into a fixed price.

A standard scope can include:

• One planning call to select the decision boundary and participants
• One scenario selected from a library or agreed with the customer
• Tailoring for the customer’s technology stack, workforce model, and sector
• A 60-120 minute facilitated exercise
• Participant access and role assignments
• A hot wash immediately after the exercise
• A web and PDF after-action report delivered on the day
• Decisions, lessons learned, recommended alternatives, owners, and due dates

TableTop Sim participants join using a code, with no accounts or installs required. Unlimited participants per exercise are included in the published Solo Facilitator plan, so an MSP can design its customer offer around the work and outcome rather than charging merely for account creation.

Build the fee from delivery effort

A defensible fee starts with the MSP’s delivery cost and required margin. Estimate the time needed for discovery, tailoring, rehearsal, facilitation, report review, follow-up, project management, and sales administration.

Then account for scope variables:

• Decision complexity: A narrow ransomware escalation decision requires less preparation than a cross-functional exercise covering legal, communications, executive, and technical decisions.
• Number of roles: CEO, CISO, General Counsel, Communications Director, IT lead, and observer seats create different facilitation requirements.
• Tailoring depth: Renaming systems is different from rewriting injects around the customer’s stack, workforce, and sector.
• Facilitator needs: Large or complex exercises may require additional people to observe, take notes, or manage the exercise.
• Reporting depth: A standard after-action report differs from a broader advisory engagement that includes plan rewrites or remediation support.
• Follow-up: Workshops, retests, and owner check-ins should be listed separately when they are not part of the base package.

The TableTop Sim features can reduce repeated production work through AI environment tailoring, staged injects, response capture, private notes, and report generation. MSPs should still budget for professional judgement, customer coordination, live facilitation, and quality review.

Package the service clearly

A tiered customer offer can make buying easier without relying on arbitrary participant fees. Each package should describe outcomes, inclusions, and boundaries.

Standard exercise

Use a ready scenario with agreed environment tailoring, one live session, a hot wash, and the standard web and PDF report. TableTop Sim includes 12+ ready scenarios, which supports repeatable delivery across a client portfolio.

Tailored executive exercise

Add deeper discovery, cross-functional roles, more detailed scenario adaptation, and executive decision emphasis. Use role-based incident bridges so participants receive information relevant to their assigned seats.

Readiness programme

Run a sequence of exercises, each scoped around one decision boundary. Vary scenarios or organisational layers, track assigned actions, and agree whether remediation reviews or repeat exercises are included.

MSPs can review the scenario library when designing packages and use the facilitator guides to standardise delivery practices across a team.

Control changes and optional work

A fixed fee only works when the boundaries are explicit. State how many discovery sessions, revisions, facilitators, live sessions, report reviews, and follow-up meetings are included.

Common chargeable additions include:

• A bespoke scenario outside the ready library
• Multiple rehearsals or stakeholder briefings
• Extra exercise sessions for separate teams
• Additional facilitation or observation staff
• Incident response plan rewriting
• Remediation workshops
• A repeat exercise to validate changes
• Travel or on-site delivery, when applicable

Also define cancellation, rescheduling, and late scope-change terms in the customer agreement. TableTop Sim’s platform pricing is separate from the MSP’s customer fee; published platform options are available on the pricing page.

Present value without overclaiming

Describe what the customer will do and receive. The exercise puts participants into a staged incident, asks them to make decisions under a live clock, captures responses, and turns observations into an after-action report.

Avoid selling the service as a slide presentation or pricing it as an ordinary meeting. The MSP is providing scenario design, controlled pressure, facilitation, evidence capture, structured review, and accountable follow-up.

The proposal should name the decision boundary, intended roles, duration, deliverables, exclusions, and commercial model. This gives the customer a concrete basis for comparing a one-off exercise with a recurring readiness programme and gives the MSP a repeatable way to price delivery.