What Is a Tabletop Exercise? Examples and How to Run One
A tabletop exercise is a guided discussion in which the people who would handle a real incident talk through a made-up one. A facilitator reads out a scenario, adds developments every few minutes, and asks what each person would do, decide and say. Nothing is touched; the point is to find gaps in the plan, the roles and the phone tree before an attacker does.
Below: what tabletops are for, the common formats, cyber examples, how to build one, and CISA's exercise packages. Last reviewed 12 November 2026.
Updated 12 November 2026
Formats
| Format | Who is in the room | Typical length |
|---|---|---|
| Executive tabletop | CEO, CFO, legal, communications, CISO | 60 to 90 minutes |
| Technical tabletop | Security operations, IT, cloud and identity owners | 90 to 120 minutes |
| Cross-functional | Both groups, with the handoffs between them | 2 to 3 hours |
| Third-party | Your team plus a key supplier, insurer or incident response firm | 60 to 90 minutes |
Lengths are planning rules of thumb, not a standard. Fit them to the scenario.
Cyber tabletop exercise examples
- Ransomware on a Friday night: file servers encrypted, backups partly affected, a ransom note with a deadline. Decisions: isolate, restore or negotiate, and who notifies whom.
- Business email compromise: a supplier's bank details change and a large payment has already gone. Decisions: recall, law enforcement, insurer.
- Compromised admin account: an identity provider alert at 2 a.m. shows a new MFA device on a global admin.
- Supplier breach: a SaaS provider says your data may be exposed but gives no detail.
- Data leak on a leak site: a criminal group claims to hold customer data and posts a sample.
The tabletop exercise library has ready-to-run versions of these, filtered by who will be in the room.
How to run a tabletop exercise
- Set two or three objectives. For example: confirm who can authorise taking systems offline; test the regulator notification decision.
- Pick one realistic scenario your organisation could actually face.
- Write three to five injects that each force a decision ("the attacker emails your CEO", "a journalist calls").
- Name a facilitator and a scribe who are not playing.
- Run it: state the rules (fictional, no grading), reveal the scenario, add an inject every 10 to 15 minutes.
- Debrief and write it up: what worked, what surprised you, and three to five corrective actions with owners and dates. CISA's packages include an After Action Report template.
CISA Tabletop Exercise Packages (CTEP)
CISA publishes over 100 tabletop exercise packages, in three groups:
- Cybersecurity: ransomware, insider threats, phishing and industrial control system compromise, plus sector sets for elections infrastructure, local governments, maritime ports, water and healthcare.
- Physical security: for example active shooters, vehicle ramming, IEDs and drones.
- Cyber-physical convergence: cyber attacks with physical impact and the reverse.
Each package includes template objectives, scenarios and discussion questions, an invitation to participants, a slide deck for planning and the session, a feedback form and an After Action Report. CISA gives cisa.exercises@cisa.dhs.gov as the contact for more information or to request an exercise.
Frequently asked questions
What is a tabletop exercise?
A tabletop exercise is a facilitated discussion in which the people who would handle a real incident talk through a made-up one, step by step. A facilitator presents the scenario and adds new developments (injects), and participants say what they would do, who decides and who they would tell. No systems are touched.
What is the purpose of a tabletop exercise?
To find gaps in your plan, roles and communications while the stakes are low: who has authority to take a system offline, who calls the insurer, which phone numbers are wrong, which decisions stall. The output is a short list of corrective actions with owners and dates.
Is it tabletop or table top exercise?
Both spellings are used. "Tabletop exercise" (one word) is the common form, and it is the spelling CISA uses for its Tabletop Exercise Packages.
What is a tabletop exercise in disaster management?
The same method applied to emergencies such as floods, pandemics or power loss. CISA's exercise packages cover natural disasters, pandemics and physical threats as well as cyber scenarios.
How do you build a tabletop exercise?
Pick one realistic scenario, set two or three objectives, choose who must be in the room, write three to five injects that force decisions, name a facilitator who is not playing, and plan a debrief. A 60 to 120 minute session suits most scenarios. The steps are below.
What are CISA Tabletop Exercise Packages?
CISA describes CTEPs as "a comprehensive set of resources designed to assist stakeholders in conducting their own exercises". It says there are over 100, covering cybersecurity (ransomware, insider threat, phishing, ICS compromise, and sector sets such as elections, local government, water and healthcare), physical security and cyber-physical scenarios. Each includes template objectives, scenarios and discussion questions, an invitation, a slide deck, a feedback form and an After Action Report. CISA lists cisa.exercises@cisa.dhs.gov for requests.