How to Build a 12-Month Cybersecurity Exercise Programme

A 12-month cybersecurity exercise programme should test a sequence of focused decision boundaries rather than repeat one broad annual event. Schedule quarterly live exercises, vary scenarios and participants, and use each after-action report to shape the next exercise.

What should a 12-month programme include?

A practical cybersecurity exercise programme combines four exercise cycles with preparation, delivery and follow-up. Each cycle should answer a specific question about how the organisation will respond under pressure.

For example, one quarter might test initial escalation and authority. Later quarters can examine operational containment, executive decisions, communications or recovery dependencies.

A simple annual structure is:

• Quarter 1: Establish the baseline and test escalation.
• Quarter 2: Test technical and operational coordination.
• Quarter 3: Test executive, legal and communications decisions.
• Quarter 4: Run an integrated exercise and review programme progress.

TableTop Sim exercises typically run for 60-120 minutes. This makes it possible to place focused sessions throughout the year without turning every exercise into a full-day event.

Start with programme outcomes

Before choosing scenarios, decide what the programme needs to reveal. Avoid goals such as testing everything or confirming that the plan works.

Use outcomes that a facilitator can observe, such as:

• Whether the incident is escalated to the correct roles.
• Who has authority to make containment and business decisions.
• How technical findings reach executives.
• When legal counsel and communications leaders become involved.
• How decisions, assumptions and unresolved questions are recorded.
• Whether actions from one exercise are completed before the next.

These outcomes create continuity across the year. They also give facilitators criteria for selecting injects and writing useful after-action reports.

Scope one decision boundary per exercise

A decision boundary is the part of incident response that the room must examine closely. Keeping it narrow prevents the session from becoming a general discussion of every possible issue.

Possible boundaries include:

• Declaring a major incident.
• Isolating a critical system.
• Operating through a workforce or service disruption.
• Approving an external statement.
• Coordinating legal, executive and technical advice.
• Prioritising restoration when several services are affected.

The boundary should influence the participant list, scenario and inject timeline. TableTop Sim provides 12+ ready scenarios, which facilitators can select and tailor to the organisation's stack, workforce model and sector.

Build the calendar quarter by quarter

Quarter 1: Baseline escalation and command

Use the first exercise to establish how the current response process behaves. Test detection, escalation, role assignment and the transition from technical investigation to wider incident command.

Include the people who receive initial reports and those expected to declare or lead an incident. Injects should expose unclear thresholds, competing sources of information and gaps in decision authority.

After the hot wash, assign owners and due dates to actions. Preserve the findings as the baseline for later sessions rather than trying to resolve every issue during the exercise.

Quarter 2: Technical and business coordination

The second exercise should test how technical containment choices affect business operations. Give the room incomplete evidence and require participants to compare the risks of continued operation, isolation and service interruption.

Relevant roles may include the CISO, IT lead, operational leaders and executive decision-makers. TableTop Sim supports role-based participant views, while the facilitator can monitor responses, control the countdown, pause the exercise and keep private notes.

Check the Quarter 1 action list before delivery. If escalation routes were changed, make the room use them rather than merely report that the documentation was updated.

Quarter 3: Legal, communications and executive pressure

The third exercise can focus on decisions made with uncertain facts and external attention. Bring in the CEO, General Counsel, Communications Director and appropriate technical roles.

Use staged injects to test how the organisation approves messaging, reconciles conflicting advice and records the basis for decisions. The facilitator should apply pressure through timing and consequences instead of reading a slide deck.

Avoid treating this as a compliance certification exercise. A tabletop can help participants examine procedures and evidence gaps, but TableTop Sim does not deliver regulatory compliance on its own.

Quarter 4: Integrated response and annual review

The final exercise should connect several previously tested capabilities without becoming unbounded. Select one central decision boundary, then introduce dependencies involving technical response, leadership and communications.

Use earlier findings to design pressure points. If previous sessions identified uncertain authority, slow escalation or weak action ownership, build moments that require those revised arrangements to work.

Finish with an annual review covering recurring lessons, closed actions, open risks and priorities for the next calendar. The cybersecurity tabletop exercise guide provides a delivery walkthrough for each session.

Schedule preparation and follow-up work

A programme calendar needs more than four exercise dates. Reserve time around each event so tailoring and remediation are not left to chance.

For every cycle, schedule:

• Scoping: Confirm the decision boundary, objectives and intended roles.
• Scenario selection: Choose a relevant scenario and remove distractions.
• Environment tailoring: Match injects to the organisation's technology, workforce model and sector.
• Participant briefing: Assign seats, explain the exercise rules and clarify that participants will make decisions with imperfect information.
• Live delivery: Run staged injects with a clock and capture responses.
• Hot wash: Hold an immediate discussion about decisions, friction and alternatives.
• Reporting: Issue decisions, lessons learned, recommended alternatives, owners and due dates.
• Action review: Check progress before planning the next event.

Participants join TableTop Sim with a code, without accounts or installs, and enter a role-specific incident bridge. This reduces administrative preparation when different groups rotate through the annual calendar.

Vary roles without losing continuity

Not every participant needs to attend every exercise. Select seats according to the decision boundary, while maintaining a small group of recurring incident leaders who can carry lessons across the year.

TableTop Sim includes views for roles such as CEO, CISO, General Counsel, Communications Director, IT lead and observers. The facilitator can choose the room composition without presenting every participant with the same information.

Use observers carefully. Give them defined points to monitor, such as escalation quality or decision ownership, rather than allowing them to interrupt the response.

Turn each exercise into programme evidence

The value of the calendar depends on what happens between sessions. Complete a hot wash immediately, then convert the discussion into a structured action list.

TableTop Sim generates a web and branded PDF after-action report on the day of the exercise. Reports can record:

• Decisions made during the scenario.
• Lessons identified by participants and the facilitator.
• Recommended alternatives to choices made under pressure.
• Action owners.
• Due dates.

Review these items at the start of the next planning cycle. An unresolved lesson should influence either the next scenario or the organisation's remediation work.

Use a repeatable facilitator rhythm

Consistency allows results to be compared while scenarios and participants change. For each exercise, scope one boundary, tailor the environment, brief the room, run staged injects, apply pressure, conduct the hot wash and issue the report.

The TableTop Sim control room provides an inject timeline, countdown control, response feed, private notes and pause controls. AI-improvised injects can follow the room when the discussion takes a relevant turn, while the facilitator remains responsible for scope and pacing. Explore the platform features when designing the operating model for your programme.

Common calendar mistakes to avoid

• Planning only one annual event: This limits opportunities to verify whether actions changed behaviour.
• Using a scope that is too broad: Participants discuss the entire response plan but test few decisions deeply.
• Repeating the same audience: Important handoffs between technical, executive, legal and communications roles remain untested.
• Choosing scenarios before objectives: An interesting threat can distract from the decisions the programme needs to examine.
• Skipping the hot wash: Observations lose detail and ownership.
• Leaving actions outside the calendar: Findings are recorded but not reviewed before the next exercise.
• Confusing participation with readiness: Attendance alone does not show that teams can make and execute decisions.

Frequently asked questions

How often should cybersecurity exercises run?

A quarterly rhythm gives a 12-month programme four opportunities to test different decision boundaries and revisit earlier actions. The appropriate schedule still depends on the organisation's objectives, participants and capacity to complete follow-up work.

How long should each tabletop exercise take?

TableTop Sim exercises typically run for 60-120 minutes. Keep the scope focused enough for participants to reach meaningful decisions within that window.

Should every executive attend every exercise?

No. Invite roles that own or advise on the decisions being tested, then maintain continuity through recurring incident leaders, action reviews and after-action reports.

Can the programme use the same scenario more than once?

Yes, if the decision boundary, participants or environment differs. Reusing a scenario can also verify whether revised escalation paths and response procedures work under pressure.

Does a cybersecurity exercise programme provide compliance?

No. Exercises can examine response procedures, decision-making and evidence gaps, but TableTop Sim does not provide regulatory compliance on its own.

Start your 12-month programme

Choose the first decision boundary, reserve quarterly dates and define how actions will be reviewed between sessions. Start a free TableTop Sim trial to select a scenario and build your first live exercise.