# Tabletop Exercise Kit

**Template version:** 1.0.0 · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/plans/tabletop-exercise-kit/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

| Exercise title | Date | Facilitator | Plan exercised and version | Status |
| --- | --- | --- | --- | --- |
| [Fill in: exercise title] | [Fill in: date] | [Fill in: name and title] | [Fill in: for example Incident Response Plan, version and date] | [Fill in: planned, held, or report approved] |

## Part A. Exercise plan

### A.1 Purpose and scope

The incident response capability is tested [Fill in: frequency at which to test the effectiveness of the incident response capability for the system. Typical: annually] using [Fill in: tests used to test the effectiveness of the incident response capability for the system. Typical: a tabletop exercise based on a realistic scenario, and a functional test of notification and escalation] (IR-3). This exercise validates [Organization name]'s Incident Response Plan and incident handling playbook: whether the plan's content works in practice, whether participants know their roles and responsibilities, and whether the dependencies the plan names are accurate and current.

| Item | Description |
| --- | --- |
| Scenario | [Fill in: scenario chosen from Part B, or your own] |
| Level | [Fill in: senior-level, operational, or combined] |
| Systems and teams in scope | [Fill in: systems, sites and teams the scenario involves] |
| Related plans exercised | [Fill in: related plans and the teams responsible for them, for example the contingency plan and the crisis communications plan (IR-3(2))] |
| Out of scope | [Fill in: what is not tested] |
| Previous exercise and its open actions | [Fill in: date, and the actions from its after-action report still open] |

### A.2 Objectives and evaluation criteria

Set the criteria before the exercise, so the data collector knows what to record (SP 800-84 section 4.3).

| # | Objective | Evaluation criteria |
| --- | --- | --- |
| 1 | Validate that participants know their roles and responsibilities under the Incident Response Plan | [Fill in: for example each role names its first three actions without prompting] |
| 2 | Validate the escalation and declaration path, from first report to the decision on a major incident | [Fill in: for example the group reaches the declaration decision and names who makes it] |
| 3 | Validate the notification decisions: which outside parties must be told, by whom and by when | [Fill in: for example the group identifies every party on the notification list that applies, with its deadline] |
| 4 | Validate coordination with the related plans in scope (IR-3(2)) | [Fill in: for example the contingency team names the point at which the contingency plan is started] |
| 5 | Identify parts of the plan and playbook that need to change | [Fill in: for example at least the gaps found are recorded as actions] |
| 6 | [Fill in: objective] | [Fill in: criteria] |

### A.3 Participants and exercise staff

| Role in the exercise | Name | Role in the plan |
| --- | --- | --- |
| Facilitator | [Fill in: name] | Leads the discussion; knows the plan and the objectives |
| Data collector | [Fill in: name] | Records observations against the evaluation criteria |
| Logistics coordinator | [Fill in: name] | Runs the checklist in A.4 |
| Participant | [Fill in: name] | [Fill in: role in the Incident Response Plan, for example incident response lead] |
| Participant | [Fill in: name] | [Chief Information Security Officer] |
| Participant | [Fill in: name] | [Senior privacy official] |
| Participant | [Fill in: name] | [Fill in: other role, for example system owner, legal counsel, communications, contingency plan coordinator] |

### A.4 Logistics checklist

Adapted from SP 800-84 Table 4-1. Start at least a month ahead, or three months for a large exercise (section 4.2).

| Task | Owner | Target date | Done |
| --- | --- | --- | --- |
| Get management approval for the date and participants | [Fill in: name] | [Fill in: date] | |
| Choose the date; book the room or the video meeting | [Fill in: name] | [Fill in: date] | |
| Name the facilitator and data collector; meet to review the objectives and the last exercise's results | [Fill in: name] | [Fill in: date] | |
| Invite participants in writing | [Fill in: name] | [Fill in: date] | |
| Prepare the briefing, the facilitator guide and the participant guides | [Fill in: name] | [Fill in: date] | |
| Send participant guides, if sent ahead (about a week before) | [Fill in: name] | [Fill in: date] | |
| Set up screens, name cards, and copies of the plan and playbook | [Fill in: name] | [Fill in: date] | |

### A.5 Agenda and briefing

| Time | Activity |
| --- | --- |
| [Fill in: time] | Welcome and introductions: each participant gives their name and role |
| [Fill in: time] | Briefing: purpose, scope, objectives and ground rules |
| [Fill in: time] | Scenario discussion, module by module |
| [Fill in: time] | Debrief (hotwash) |

Ground rules for the briefing: this is a discussion, not a test of individuals; answer as you would in a real incident, using the plan and playbook; say when the plan is unclear, since finding gaps is the purpose; what is said in the exercise stays in the exercise, except what goes in the after-action report.

## Part B. Facilitator guide

The facilitator guide holds the purpose, scope and objectives (Part A), the scenario, and the questions that steer the discussion to the objectives (SP 800-84 section 4.3). Choose one scenario. Present one module at a time; give each inject, then ask the questions until the objectives for that module are met. Tailor questions to the level: decisions and oversight for senior leaders, procedures for operational staff.

### B.1 Scenario 1: Ransomware

**Module 1. Detection.** At [Fill in: time] on a weekday, the security operations team sees an alert for unusual encryption activity on a file server that supports [Fill in: a mission-critical service]. Twenty minutes later, the service desk receives calls from users who cannot open shared files.

| Inject | Facilitator questions | Expected response, from the plan and playbook |
| --- | --- | --- |
| Users report files renamed with an unknown extension | Who is told first, and how? When is this declared an incident, and by whom? What severity? | Playbook 5.1 and 5.2: report form or case opened, team alerted, incident declared and severity set; system owner and CISO told |
| A ransom note appears on several servers | What do you contain first? Who approves isolating the servers? What happens to the backups? | Playbook 5.4 and section 6: isolate, protect backups by taking them offline; system owner approves |

**Module 2. Escalation.** By midday, analysis shows the attacker copied data from the file server before encrypting it. The data includes [Fill in: a type of information the organization holds, for example customer records].

| Inject | Facilitator questions | Expected response, from the plan and playbook |
| --- | --- | --- |
| Data was copied out before encryption | Is this now a breach? Who decides? Who must be told outside the organization, and by when? | Playbook 5.2 step 3 and 5.8: privacy official engaged; notification list checked (5.7) |
| The service will be down for at least two days | When does the contingency plan start? Who decides? How do the incident and recovery teams coordinate? | Playbook 5.2 step 6 and 5.5; contingency plan activation (IR-4b, IR-3(2)) |
| An email arrives demanding payment | Who decides how to respond? Who may contact the attacker? | Playbook section 6: no contact or payment without the CISO and legal counsel |

**Module 3. Recovery and communication.**

| Inject | Facilitator questions | Expected response, from the plan and playbook |
| --- | --- | --- |
| A reporter calls asking about an outage | Who speaks for the organization? Who approves what is said? | Playbook 5.7 step 5: communications prepares; CISO approves |
| Backups are available from three days ago | How do you know they are clean? Who signs off before the system returns to production? | Playbook 5.5 steps 2 and 4 |

### B.2 Scenario 2: Compromised administrator account

**Module 1.** A cloud administrator's account signs in from an unfamiliar country at [Fill in: time], adds a new multifactor device, and creates an access key. The administrator is on leave.

| Inject | Facilitator questions | Expected response, from the plan and playbook |
| --- | --- | --- |
| Sign-in alert from the identity provider | Who receives the alert? How quickly is it triaged? Who can disable the account at this hour? | Playbook 5.1 step 3, 5.2, and section 6 (account takeover); on-call coverage (IR-7) |
| The new access key was used to list storage buckets | How do you find out what was accessed? What evidence do you keep, and where? | Playbook 5.3 steps 1 to 4 |

**Module 2.**

| Inject | Facilitator questions | Expected response, from the plan and playbook |
| --- | --- | --- |
| Two other administrator accounts show the same sign-in pattern | How do you find every affected account? When is containment complete? | Playbook 5.3 step 2 and 5.4 |
| The cloud provider sends a notice about a campaign against its customers | How do you work with the provider? What do you share with them? | Playbook 5.7 step 4 and section 6 (supplier or cloud provider incident; IR-6(3)) |

### B.3 Scenario 3: Breach of personally identifiable information

Use this scenario for the breach exercise the IR-2(3) clause sets in each annual training cycle.

**Module 1.** An employee emails a spreadsheet to a personal email address to work from home. A colleague mentions it to their supervisor two days later. The spreadsheet holds [Fill in: for example names, dates of birth and account numbers] for about [Fill in: number] people.

| Inject | Facilitator questions | Expected response, from the plan and playbook |
| --- | --- | --- |
| The supervisor hears about it | Is this an incident? Must the supervisor report it, and how quickly? Is it a breach if no one outside saw it? | IR-2(3) training: report confirmed and suspected breaches within the reporting time; playbook 5.1 |
| The employee says they deleted it | What do you need to confirm? Who talks to the employee? | Playbook 5.8 steps 1 and 2; section 6 (insider or misuse): involve human resources and legal counsel |

**Module 2.**

| Inject | Facilitator questions | Expected response, from the plan and playbook |
| --- | --- | --- |
| The personal email account was itself compromised last month | How likely is harm now? What kinds of harm? | Playbook 5.8 step 3: harm assessment (IR-8(1)(b)) |
| Legal counsel asks which laws and contracts apply | Where is the list? Who decides whether to notify the individuals, and when? | Plan breach section; playbook 5.8 steps 4 and 5 (IR-8(1)(a), (c)) |
| The individuals live in several states or countries | Does that change who must be told, or how fast? | Applicable requirements list (IR-8(1)(c)) |
| Notices are approved | What do they say? What help is offered? Who answers the calls? | Playbook 5.8 steps 6 to 8 |

### B.4 Your own scenario

| Module | Inject | Facilitator questions | Expected response |
| --- | --- | --- | --- |
| [Fill in: module] | [Fill in: new information given to participants] | [Fill in: questions tied to an objective in A.2] | [Fill in: what the plan or playbook says should happen] |

## Part C. Participant guide

Give participants Part A (A.1, A.2 and A.5), the scenario's opening paragraph for each module, and these orientation questions, without the facilitator's questions and expected responses (SP 800-84 section 4.3).

- What is your role in the Incident Response Plan, and what would you do first?
- Who do you need to hear from, and who needs to hear from you?
- What decisions would you make, and what information would you need to make them?
- Where does the plan or playbook not match what you would really do?

## Part D. Debrief (hotwash)

Hold the debrief right after the discussion (SP 800-84 section 4.4). The data collector records the answers.

- What worked well, and which areas do you feel the team handles well?
- Where do you need more training?
- Which parts of the plan or playbook should be updated?
- Are there issues we did not discuss that we should have?
- How could the next exercise be better?

### Data collector's log

| Time | Objective | Observation | Plan or playbook section |
| --- | --- | --- | --- |
| [Fill in: time] | [Fill in: objective number from A.2] | [Fill in: what was said or decided, and by whom] | [Fill in: section] |

## Part E. After-action report

Write the report within [Fill in: time, for example 10 business days] of the exercise. SP 800-84 section 4.5 puts the debrief comments and the data collector's lessons learned in the report, with background on the exercise, the observations, and recommendations for the plan.

### E.1 Introduction

On [Fill in: date], [Organization name] held a [Fill in: duration]-hour tabletop exercise to validate its Incident Response Plan, using the [Fill in: scenario] scenario, with [Fill in: number] participants from [Fill in: teams].

### E.2 Objectives and results

| # | Objective | Met? | What was observed |
| --- | --- | --- | --- |
| [Fill in: number] | [Fill in: objective from A.2] | [Fill in: met, partly met, or not met] | [Fill in: observation against the evaluation criteria] |

### E.3 Findings and recommendations

General findings: [Fill in: overall observations, including what worked well]

| ID | Finding | Recommendation | Owner | Due date | Tracking reference |
| --- | --- | --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: finding] | [Fill in: recommended action] | [Fill in: role] | [Fill in: date] | [Fill in: plan of action and milestones item or ticket] |

### E.4 Changes that follow

The results were reviewed by [Fill in: who] on [Fill in: date]. These changes follow from them (IR-4c, IR-8c):

- **Incident Response Plan:** [Fill in: sections to update, or none]
- **Incident handling playbook:** [Fill in: steps to update, or none]
- **Training:** [Fill in: changes to incident response training (IR-2), or none]
- **Related plans:** [Fill in: changes to the contingency plan or other related plans (IR-3(2)), or none]
- **Next exercise:** [Fill in: what the next exercise should cover, and its planned date]

### E.5 Approval

| Name | Title | Signature | Date |
| --- | --- | --- | --- |
| [Fill in: name] | [Chief Information Security Officer] | | [Fill in: date] |