Guides · 6 min read
Cybersecurity Tabletop Exercise Template
Copy this structure for any cybersecurity tabletop exercise. It is deliberately short — a template that takes an hour to fill in gets used; a 40-page exercise plan does not.
Exercise header
- Exercise title and date
- Client or business unit
- Primary objective (one sentence)
- Scenario type and difficulty
- Duration and hard stop
- Facilitator, note-taker, observers
Participant roster
| Seat | Person | Decision they own |
|---|---|---|
| Executive lead | — | Trading, downtime, public posture |
| Incident commander | — | Containment and scope |
| IT operations | — | Systems, accounts, recovery |
| Legal / privacy | — | Notification clocks and obligations |
| Communications | — | Internal and external messaging |
| Observer | — | Notes only, no participation |
90-minute agenda
| Time | Segment |
|---|---|
| 0:00–0:05 | Ground rules, objective, no-fault framing |
| 0:05–0:20 | Detection phase injects |
| 0:20–0:40 | Triage and containment |
| 0:40–1:00 | Escalation and business decision |
| 1:00–1:15 | Public, legal and regulatory pressure |
| 1:15–1:30 | Hot wash and confidence scoring |
Inject worksheet
- Inject number and release time
- Phase
- Type: standard, technical artefact, hot seat, media, wildcard
- Which seat receives it (and who does not)
- The text as participants will read it
- The decision it is designed to force
- Facilitator prompt if the room stalls
After-action report structure
- Executive summary: what happened and how the team performed
- Strengths observed
- Gaps observed
- Recommended alternative actions
- Lessons learned
- Action plan: recommendation, owner, due date
- Timeline and decision log
- Participant feedback and confidence delta
Ground rules to read out loud
- No-fault. We are testing the process, not the people.
- Play your seat. If you would not know it, you do not know it.
- Decisions get logged with a timestamp.
- "We would call someone" is not a decision. Who, and what do you ask them?
Frequently asked questions
- Do I need a formal exercise plan document?
- For regulated or contractual testing, yes — objectives, participants, injects and findings should be documented. For internal quarterly exercises, the template above is enough.
- Can one person facilitate and take notes?
- Poorly. Split the roles, or use software that logs decisions and timestamps automatically so the facilitator can watch the room.
Run this exercise in TableTop Sim
The scenario library, the facilitator control room and the after-action report — included in the free trial.