Runbooks for Tabletop Exercises and War Games: A Complete Template (2026)
A tabletop exercise runbook has eight parts: objectives and scope; a role roster (facilitator, scribe, evaluator, incident commander, executive sponsor, legal, communications, finance, operations); rules of play; a timeline; a master scenario events list (MSEL) of timed injects with the expected response; discussion questions for each phase (detection, triage, decisions, communications, recovery); a scoring rubric; and a hot wash plus after-action report with owned, dated actions. CISA publishes more than 100 free Tabletop Exercise Packages (CTEPs) with situation manuals and after-action templates aligned to HSEEP. For a runbook tailored to your scenario, sector, size, length and audience, PlayCISO’s free Tabletop Runbook Generator builds one in the browser, and the War Room and IR Playbook Lab give participants scored practice between exercises.
A tabletop exercise lives or dies on its runbook. Without one, the session drifts into a war-story discussion, the loudest person decides, and nothing changes afterwards. With one, the same exercise can be run by a different facilitator next year and the results compared. This post gives the complete structure, a worked inject list, and the free resources that do most of the work for you.
What goes into a tabletop exercise runbook?
Eight parts, in the order you use them:
- Objectives and scope. Three to five objectives written as things you can observe (“confirm who can authorise isolating the payments network”), plus what is out of scope (“no live changes to systems”).
- Role roster. Who plays which role and what each is responsible for.
- Rules of play. No-fault, respond with the resources you really have, the facilitator may pause the room, off-topic items go in a parking lot.
- Timeline. Briefing, five phases, hot wash, with clock times.
- Master scenario events list (MSEL). Every inject with its time, who receives it and what a good response looks like. The term comes from the US Homeland Security Exercise and Evaluation Program (HSEEP).
- Discussion questions per phase, for the facilitator to use when the room goes quiet or skips a decision.
- Scoring rubric tied to the objectives.
- Hot wash and after-action report template, with an improvement plan of owners and dates.
Who plays which role?
| Role | Responsible for | Notes |
|---|---|---|
| Facilitator | Runs the clock, reads injects, probes, keeps it no-fault | Neutral; does not play. Practise with the Tabletop Facilitation Lab. |
| Scribe | Decision log: time, decision, owner, reason; gaps and assumptions | The after-action report is built from this log. |
| Evaluator | Scores against the rubric | Optional in small organisations. |
| Incident commander / CISO | Runs the response, briefs leadership | Should open the real plan and playbook. |
| Executive sponsor | Shutdowns, payments, disclosure | A deputy plays if they are absent, which is itself a test. |
| Legal counsel | Privilege, notification, law enforcement, contracts | Owns the “when did we become aware” question. |
| Communications | Holding statements, staff, customers, media | Bring the pre-approved holding statements. |
| Finance, operations, HR, privacy | Cost and insurance, continuity, people issues, personal data | Add as the scenario needs. |
What does the phase table look like?
Break the exercise into five phases. For each, the facilitator knows what to put in and what good behaviour looks like.
| Phase | Facilitator action | Expected behaviour |
|---|---|---|
| Detection and first report | Read the opening situation and the first inject | Severity set, incident lead named, plan opened, log started |
| Triage and scoping | Inject evidence of wider impact | Evidence preserved before changes; known, believed and unknown separated |
| Escalation and key decisions | Inject the hard trade-off (ransom, shutdown, payment run) | The right person decides, with reasons recorded; deputies used |
| Communications and notification | Inject a journalist, regulator or customer | Clocks identified; consistent statements from one owner |
| Recovery and close-out | Inject pressure to restore early or a sign of persistence | Clean-before-restore criteria; risk acceptance recorded |
What does a master scenario events list look like?
Here is a 90-minute ransomware example, starting at 09:00 with a 10-minute briefing:
| Time | Inject | What good looks like |
|---|---|---|
| 09:15 | EDR shows encryption on 40 servers; shadow copies deleted overnight | Isolate segments, keep machines powered for memory capture, open the ransomware playbook |
| 09:27 | Firewall logs show 180 GB sent to a cloud storage service | Treat as data theft as well; preserve logs; start identifying the data |
| 09:40 | Ransom note: 72-hour deadline. CFO asks if insurance pays | Insurer, counsel and law enforcement engaged; sanctions screening first; executive owns the decision |
| 09:48 | The two most recent backups are encrypted too | Find the last offline or immutable copy; remove attacker access before restoring |
| 10:03 | A reporter asks you to confirm you are on a leak site | Approved holding statement; one spokesperson; no comment on payment |
| 10:15 | A restored domain controller shows a scheduled task from two weeks ago | Stop and widen eradication; reset privileged credentials |
The Tabletop Runbook Generator builds this table for eight scenarios (ransomware, business email compromise, data breach, leaked cloud key, supplier breach, insider theft, AI prompt injection and OT ransomware), adds sector injects (for example ambulance diversion in healthcare or halting wires in finance) and scales the timing to 60, 90, 120, 180 or 240 minutes.
Which free runbook resources are worth using?
| Resource | Best for | Why | Main drawback | Price (as of October 2026) |
|---|---|---|---|---|
| CISA Tabletop Exercise Packages (CTEPs) | Organisations that want an official, HSEEP-aligned package | More than 100 packages across cyber, physical and cyber-physical threats; situation manual, discussion questions, after-action report template | Generic; you write the timed injects and scoring yourself | Free |
| PlayCISO Tabletop Runbook Generator | A fast, scenario-specific runbook with timed injects | Sector, size, length and audience options; MSEL with expected responses; rubric with readiness band; copy or print | Eight scenarios; you still adapt names to your systems | Free, in the browser |
| PlayCISO Board Tabletop Facilitation Kit | Board and executive sessions | Run-of-show, role cards, decision capture sheet | Board-level focus only | Free to use; export is part of Pro ($5/month or $40/year) |
| Facilitated exercise from a consultancy or crisis-simulation vendor | High-stakes or regulated exercises that need independence | Experienced facilitators, custom scenarios, independent report | Cost and lead time | Quote-based |
How do you score a tabletop or war game?
Score against the objectives, not pass or fail. Give the evaluator six or seven criteria, each scored 1 to 4: decision authority, use of the plan, notification and legal, communications, business continuity and documentation for an executive exercise; triage, evidence preservation, containment order, scoping and recovery validation for a technical one. A war game with competing teams adds adjudication rules: who decides whether a move works, and how fast the opposing side responds. Record the scores and re-run the same scenario later; the trend is the point.
What happens after the exercise?
Run a 15 to 20 minute hot wash on the day: what worked, what did not, what we change. Within a week, write the after-action report: summary, objectives met or not with evidence, strengths, gaps, an improvement plan with one owner and a due date for each action, and which plan or playbook changes. Track the actions to closure in the Post-Incident Review Template. Between exercises, keep people sharp with the War Room for leaders and the IR Playbook Lab for responders.
Checklist: tabletop runbook ready?
- Objectives agreed with the sponsor and written as observable outcomes
- Scenario uses your real system and supplier names
- Injects timed, with expected responses for the evaluator
- Roles assigned, deputies named, facilitator and scribe confirmed
- Plan and playbooks shared with players beforehand
- Rubric printed; hot wash booked into the timeline
- After-action report owner and deadline set before the day
Frequently asked questions
What is a runbook for a tabletop exercise or war game?
The facilitator’s script: objectives, scope, roles, rules, timeline, the master scenario events list of injects with expected responses, discussion questions, scoring and the after-action template.
Where can I get free tabletop exercise templates?
CISA’s Tabletop Exercise Packages (more than 100, free) and PlayCISO’s Tabletop Runbook Generator, which builds a scenario-specific runbook with timed injects in the browser.
What roles are needed in a tabletop exercise?
A neutral facilitator, a scribe, ideally an evaluator, and players with real authority: incident commander, executive sponsor, legal, communications, finance and operations, plus HR or privacy when the scenario needs them.
What is the difference between a tabletop exercise and a war game?
A tabletop is usually discussion-based. A war game often adds an opposing force or adjudicator, competing teams and scoring. Both use the same runbook structure.
What should be in a ransomware tabletop exercise?
Encrypted backups, evidence of data theft, a ransom deadline, insurer and sanctions checks, media pressure and pressure to restore early, each with an expected response.
Ready to practise the decisions these articles describe?
Run your first War Room free →One run free with a free account · more runs with Pro