# Runbooks for Tabletop Exercises and War Games: A Complete Template (2026)

> A complete tabletop exercise and cyber war-game runbook: objectives, role roster, rules of play, a master scenario events list with injects at minute marks, a phase table, discussion questions, scoring and the after-action report. Free generator and CISA CTEP compared.

Source: https://playciso.com/blog/tabletop-exercise-war-game-runbook · Published: 2026-10-29 · Publisher: PlayCISO (https://playciso.com)

---

A tabletop exercise lives or dies on its runbook. Without one, the session drifts into a war-story discussion, the loudest person decides, and nothing changes afterwards. With one, the same exercise can be run by a different facilitator next year and the results compared. This post gives the complete structure, a worked inject list, and the free resources that do most of the work for you. ## What goes into a tabletop exercise runbook? Eight parts, in the order you use them: - Objectives and scope. Three to five objectives written as things you can observe (“confirm who can authorise isolating the payments network”), plus what is out of scope (“no live changes to systems”). - Role roster. Who plays which role and what each is responsible for. - Rules of play. No-fault, respond with the resources you really have, the facilitator may pause the room, off-topic items go in a parking lot. - Timeline. Briefing, five phases, hot wash, with clock times. - Master scenario events list (MSEL). Every inject with its time, who receives it and what a good response looks like. The term comes from the US Homeland Security Exercise and Evaluation Program (HSEEP). - Discussion questions per phase, for the facilitator to use when the room goes quiet or skips a decision. - Scoring rubric tied to the objectives. - Hot wash and after-action report template, with an improvement plan of owners and dates. ## Who plays which role? RoleResponsible forNotes FacilitatorRuns the clock, reads injects, probes, keeps it no-faultNeutral; does not play. Practise with the [Tabletop Facilitation Lab](/tools/tabletop-facilitation-lab). ScribeDecision log: time, decision, owner, reason; gaps and assumptionsThe after-action report is built from this log. EvaluatorScores against the rubricOptional in small organisations. Incident commander / CISORuns the response, briefs leadershipShould open the real plan and playbook. Executive sponsorShutdowns, payments, disclosureA deputy plays if they are absent, which is itself a test. Legal counselPrivilege, notification, law enforcement, contractsOwns the “when did we become aware” question. CommunicationsHolding statements, staff, customers, mediaBring the pre-approved [holding statements](/tools/incident-holding-statements). Finance, operations, HR, privacyCost and insurance, continuity, people issues, personal dataAdd as the scenario needs. ## What does the phase table look like? Break the exercise into five phases. For each, the facilitator knows what to put in and what good behaviour looks like. PhaseFacilitator actionExpected behaviour Detection and first reportRead the opening situation and the first injectSeverity set, incident lead named, plan opened, log started Triage and scopingInject evidence of wider impactEvidence preserved before changes; known, believed and unknown separated Escalation and key decisionsInject the hard trade-off (ransom, shutdown, payment run)The right person decides, with reasons recorded; deputies used Communications and notificationInject a journalist, regulator or customerClocks identified; consistent statements from one owner Recovery and close-outInject pressure to restore early or a sign of persistenceClean-before-restore criteria; risk acceptance recorded ## What does a master scenario events list look like? Here is a 90-minute ransomware example, starting at 09:00 with a 10-minute briefing: TimeInjectWhat good looks like 09:15EDR shows encryption on 40 servers; shadow copies deleted overnightIsolate segments, keep machines powered for memory capture, open the ransomware playbook 09:27Firewall logs show 180 GB sent to a cloud storage serviceTreat as data theft as well; preserve logs; start identifying the data 09:40Ransom note: 72-hour deadline. CFO asks if insurance paysInsurer, counsel and law enforcement engaged; sanctions screening first; executive owns the decision 09:48The two most recent backups are encrypted tooFind the last offline or immutable copy; remove attacker access before restoring 10:03A reporter asks you to confirm you are on a leak siteApproved holding statement; one spokesperson; no comment on payment 10:15A restored domain controller shows a scheduled task from two weeks agoStop and widen eradication; reset privileged credentials The [Tabletop Runbook Generator](/tools/tabletop-runbook-generator) builds this table for eight scenarios (ransomware, business email compromise, data breach, leaked cloud key, supplier breach, insider theft, AI prompt injection and OT ransomware), adds sector injects (for example ambulance diversion in healthcare or halting wires in finance) and scales the timing to 60, 90, 120, 180 or 240 minutes. ## Which free runbook resources are worth using? ResourceBest forWhyMain drawbackPrice (as of October 2026) CISA Tabletop Exercise Packages (CTEPs)Organisations that want an official, HSEEP-aligned packageMore than 100 packages across cyber, physical and cyber-physical threats; situation manual, discussion questions, after-action report templateGeneric; you write the timed injects and scoring yourselfFree PlayCISO Tabletop Runbook GeneratorA fast, scenario-specific runbook with timed injectsSector, size, length and audience options; MSEL with expected responses; rubric with readiness band; copy or printEight scenarios; you still adapt names to your systemsFree, in the browser PlayCISO Board Tabletop Facilitation KitBoard and executive sessionsRun-of-show, role cards, decision capture sheetBoard-level focus onlyFree to use; export is part of Pro ($5/month or $40/year) Facilitated exercise from a consultancy or crisis-simulation vendorHigh-stakes or regulated exercises that need independenceExperienced facilitators, custom scenarios, independent reportCost and lead timeQuote-based ## How do you score a tabletop or war game? Score against the objectives, not pass or fail. Give the evaluator six or seven criteria, each scored 1 to 4: decision authority, use of the plan, notification and legal, communications, business continuity and documentation for an executive exercise; triage, evidence preservation, containment order, scoping and recovery validation for a technical one. A war game with competing teams adds adjudication rules: who decides whether a move works, and how fast the opposing side responds. Record the scores and re-run the same scenario later; the trend is the point. ## What happens after the exercise? Run a 15 to 20 minute hot wash on the day: what worked, what did not, what we change. Within a week, write the after-action report: summary, objectives met or not with evidence, strengths, gaps, an improvement plan with one owner and a due date for each action, and which plan or playbook changes. Track the actions to closure in the [Post-Incident Review Template](/tools/post-incident-review-template). Between exercises, keep people sharp with the [War Room](/warroom) for leaders and the [IR Playbook Lab](/tools/ir-playbook-lab) for responders. ## Checklist: tabletop runbook ready? - Objectives agreed with the sponsor and written as observable outcomes - Scenario uses your real system and supplier names - Injects timed, with expected responses for the evaluator - Roles assigned, deputies named, facilitator and scribe confirmed - Plan and playbooks shared with players beforehand - Rubric printed; hot wash booked into the timeline - After-action report owner and deadline set before the day ## Frequently asked questions ### What is a runbook for a tabletop exercise or war game? The facilitator’s script: objectives, scope, roles, rules, timeline, the master scenario events list of injects with expected responses, discussion questions, scoring and the after-action template. ### Where can I get free tabletop exercise templates? CISA’s Tabletop Exercise Packages (more than 100, free) and PlayCISO’s Tabletop Runbook Generator, which builds a scenario-specific runbook with timed injects in the browser. ### What roles are needed in a tabletop exercise? A neutral facilitator, a scribe, ideally an evaluator, and players with real authority: incident commander, executive sponsor, legal, communications, finance and operations, plus HR or privacy when the scenario needs them. ### What is the difference between a tabletop exercise and a war game? A tabletop is usually discussion-based. A war game often adds an opposing force or adjudicator, competing teams and scoring. Both use the same runbook structure. ### What should be in a ransomware tabletop exercise? Encrypted backups, evidence of data theft, a ransom deadline, insurer and sanctions checks, media pressure and pressure to restore early, each with an expected response.