A good cyber tabletop surfaces the gaps you would rather not find in a real incident — the unclear decision authority, the playbook that does not exist, the assumption no one checked. This kit gives you the structure to run one well: the setup and objectives, a scenario with timed, escalating injects and a curveball, role cards that keep each leader in role, a live decision-capture sheet, and an after-action report that turns what you learned into owned, dated actions.
Educational template — not legal or compliance advice. Adapt it to your organisation and exercise programme; where disclosure or regulatory obligations are in play, confirm them with qualified counsel.
Free · no signup · adapt it in your own doc
Board Tabletop Exercise Facilitation Kit
A facilitator’s kit to design, run and close a board/executive-level cyber tabletop exercise that surfaces real gaps — scenario and injects built on your own crown jewels, role cards that keep leaders in role, a live decision-capture sheet, and an after-action report that turns observations into owned, dated action items.
01Exercise setup
Agree these with the sponsor before the exercise. The objectives are what you will score against; the scope is what keeps the session from sprawling.
Exercise title / date
e.g. Q2 Board Cyber Tabletop — 2026
Sponsor
Executive owning the exercise — e.g. CEO or board risk chair
Facilitator
Name — runs the room, stays neutral, does not make the decisions
Scribe
Dedicated note-taker — NOT the facilitator
Duration
e.g. 90–120 minutes
Objectives — the decisions and capabilities this exercise exists to test (3–5):
e.g. Test whether decision authority for taking a crown-jewel system offline is clear and reachable
e.g. Test the speed and quality of the materiality / disclosure decision
e.g. Test coordination between security, legal, comms and the board
In scope
Systems, decisions and functions being exercised
Out of scope
Explicitly excluded — e.g. live technical response, actual notifications
Ground rules to read out at the start: this is a NO-FAULT, learning exercise; finding a gap is a win, not a failure; it is a discussion — no system is actually touched; stay in your own role; one conversation at a time.
02Scenario & timed injects
Build the scenario on YOUR crown jewels and threat model, not a generic one. Each inject escalates and forces a decision — deliver them on a clock, not as a lecture. Keep one realistic curveball in reserve for when the room gets comfortable.
Scenario summary
e.g. Ransomware with data exfiltration hitting the EHR / core customer platform
Crown jewels at risk
The systems/data whose loss would hurt most
Inject 1 (T+0) — Detection: anomaly / alert surfaces → Decision forced: Do we declare an incident? Who leads?
Inject 2 (T+15) — Scope grows: a crown-jewel system is affected → Decision forced: Do we take it offline? Who authorises that?
Inject 3 (T+30) — Data exfiltration confirmed → Decision forced: Materiality / notification call; who is engaged?
Inject 4 (T+45) — CURVEBALL: A regulator calls / the story leaks to a reporter / a second vendor is affected → Decision forced: Re-prioritise; who speaks publicly, and what do we say?
Inject 5 (T+60) — Pressure to resume operations before the all-clear → Decision forced: Recovery go/no-go and the criteria for it
Watch for decisions that stall — "who can approve this?" — and for assumptions ("we assumed backups were current"). Those stalls and assumptions are usually where the real gap is; capture them in the sheet below rather than smoothing them over.
03Role cards
Hand each participant their card. The facilitator redirects any decision to the role that genuinely owns it — do not let the CISO answer for the CEO.
Role
Responsibilities in the exercise
Likely decisions they own
CEO / Board chair
Sets overall posture; external face of the company
Public statement; major business trade-offs; board notification
Time-box rat-holes: capture the detail in a "parking lot" and steer back to the decision the inject is testing. A stall over who can authorise something is a finding, not a delay — record it.
05After-action report
The durable deliverable. Write it within a few days while the session is fresh; it drives the fixes, briefs those who could not attend, and is the evidence of a real exercise for the board and auditors.
Objectives tested
Restate the objectives and whether each was met
What worked
Decisions, roles and coordination that held up well
Gaps found (from the capture sheet):
Gap: missing or unclear decision-authority for a key call
Gap: a playbook that does not exist or is out of date
Gap: a shaky assumption that should be verified or fixed
Gap: a communication or escalation path that broke down
Action items — each with ONE named owner and a due date, tracked to closure:
Action item
Owner
Due date
Status
Specific fix tied to a gap above
Single accountable name
Date
Open / In progress / Done
Maturity score (against objectives)
e.g. decision quality / speed / communication / authority clarity — rate each, not a single pass/fail
Next exercise cadence
At least annually, AND after a major change — new crown-jewel system, merger, re-org, or shift in threat landscape
Follow-up / live test needed?
A tabletop proves decisions, not capabilities — note anything (e.g. backup restore, failover) that needs a live/functional exercise
Educational template — adapt it to your organisation and your exercise programme. It is not legal or compliance advice; where disclosure, regulatory or contractual obligations are in play, confirm them with qualified counsel.
Practice the decision
This kit records how you run the exercise. The free Tabletop Facilitation Lab puts you in the facilitator’s chair and grades you on ~14 of the exact decisions this kit supports — choosing the right scenario, pacing the injects, keeping executives in role, surfacing the authority gap, and closing on owned action items.
TL;DR
What this template is
A facilitator’s kit to design, run and close a board/executive cyber tabletop exercise that surfaces real gaps instead of theatre.
Sections: exercise setup (objectives, scope, participants, no-fault rules), a scenario with five timed escalating injects and a curveball, role cards, a live decision-capture sheet, and an after-action report.
Copy it or download it as Markdown and adapt it in your own document — nothing is uploaded.
Practise the underlying facilitation decisions in the free Tabletop Facilitation Lab.
Educational template — not legal or compliance advice. Adapt it to your organisation and programme.
Frequently asked questions
What is this kit for?+
It is a facilitator’s kit for running a board/executive-level cyber tabletop exercise. It gives you the exercise setup (objectives, scope, participants and no-fault ground rules), a scenario with five timed injects that escalate and force decisions, role cards to keep each leader in their own role, a live decision-capture sheet, and an after-action report that turns observations into owned, dated action items.
How do I pick a good scenario?+
Build it on your own crown jewels and threat model — the systems and data whose loss would hurt most — not a dramatic but far-fetched generic scenario. A plausible scenario aimed at what the business actually depends on forces the decisions the team would really face, which is where gaps surface.
What is the most important output?+
The after-action report. The shared experience fades; the report — objectives tested, what worked, gaps found, and action items each with one owner and a due date — is what drives the fixes, briefs absentees, and stands as evidence of a real exercise for the board and auditors.
Does a tabletop prove our technical response works?+
No. A tabletop is a discussion-based exercise: it tests decisions, roles, communication and coordination, and it exposes gaps — but it does not execute anything. Proving a capability such as backup restoration or failover needs a live/functional exercise or a real test; note those as follow-ups in the report.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout