Tabletop Exercise Kit

Tabletop Exercise Kit template: Everything for one incident response tabletop exercise, from planning and logistics through the facilitator guide, participant guide, scenarios with injects, the debrief and the after-action report, based on the sample tabletop exercise documentation in NIST SP 800-84.

Type	Program stage	Status	Template version	NIST basis
Plan	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Everything for one incident response tabletop exercise, from planning and logistics through the facilitator guide, participant guide, scenarios with injects, the debrief and the after-action report, based on the sample tabletop exercise documentation in NIST SP 800-84.

Controls satisfied

Control	Title
IR-3	Incident Response Testing
IR-3(2)	Coordination with Related Plans
IR-2(3)	Breach
IR-4	Incident Handling
IR-8	Incident Response Plan

Downloads

Variant	Ready to adopt	Annotated
All baselines	Word · Markdown	Word · Markdown

Preview (annotated)

Guidance

NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities (September 2006; current as of October 2026), section 4.3, says a tabletop exercise usually has four documents: a briefing with the agenda and logistics, a facilitator guide, a participant guide, and an after-action report written afterwards. Its Appendix A gives a sample of each. This kit puts all four in one template, so the exercise and its results stay together as the evidence IR-3 asks for: Part A plans the exercise, Part B is the facilitator guide, Part C the participant guide, Part D the debrief, and Part E the after-action report. Part B offers three scenarios; use one per exercise and write your own as the program matures. SP 800-84 section 4.3 warns that long, detailed scenarios pull discussion away from the objectives, so keep each one short. The typical values come from the IR-3 clause; keep them in step. For a contingency plan test, use the contingency plan test plan and after-action report, which follow the same structure.

For help running the exercise, CISA publishes Tabletop Exercise Packages (CTEPs; more than 100 as of October 2026). They are free, and organizations can customize them to run their own exercises. Each package gives template objectives, a scenario, discussion questions and reference materials. CISA also provides templates for planner, facilitator and evaluator, and participant roles, an invitation, a slide deck for the planning meetings and the exercise, a participant feedback form and an after-action report. The cyber scenarios include ransomware, insider threat, phishing and industrial control system compromise, with sets for sectors such as local government, water, healthcare, ports and elections. A practical way to use them with this kit: choose a package that matches a risk from your risk assessment, copy its scenario into B.4, and tie its discussion questions to the objectives in A.2 and the steps of the incident handling playbook. Then record the results in Parts D and E, so the evidence stays in this one document.

Exercise title	Date	Facilitator	Plan exercised and version	Status
Fill in: exercise title	Fill in: date	Fill in: name and title	Fill in: for example Incident Response Plan, version and date	Fill in: planned, held, or report approved

Part A. Exercise plan

A.1 Purpose and scope

The incident response capability is tested Fill in: frequency at which to test the effectiveness of the incident response capability for the system Typical: annually using Fill in: tests used to test the effectiveness of the incident response capability for the system Typical: a tabletop exercise based on a realistic scenario, and a functional test of notification and escalation (IR-3). This exercise validates Organization name’s Incident Response Plan and incident handling playbook: whether the plan’s content works in practice, whether participants know their roles and responsibilities, and whether the dependencies the plan names are accurate and current.

Item	Description
Scenario	Fill in: scenario chosen from Part B, or your own
Level	Fill in: senior-level, operational, or combined
Systems and teams in scope	Fill in: systems, sites and teams the scenario involves
Related plans exercised	Fill in: related plans and the teams responsible for them, for example the contingency plan and the crisis communications plan (IR-3(2))
Out of scope	Fill in: what is not tested
Previous exercise and its open actions	Fill in: date, and the actions from its after-action report still open

Guidance

SP 800-84 section 4.2.2 has senior-level and operational teams exercise separately at first, then together to check coordination between them. Senior-level exercises run two to four hours and focus on decisions and oversight; operational exercises run two to eight hours and focus on procedures. Section 4.1 suggests holding the exercise soon after the participants are trained on their roles, and getting management’s approval before it is scheduled. To meet IR-3(2) and CP-4(1) together, choose the ransomware scenario and invite the contingency plan’s team, so the discussion runs from containment into recovery under the contingency plan.

A.2 Objectives and evaluation criteria

Set the criteria before the exercise, so the data collector knows what to record (SP 800-84 section 4.3).

#	Objective	Evaluation criteria
1	Validate that participants know their roles and responsibilities under the Incident Response Plan	Fill in: for example each role names its first three actions without prompting
2	Validate the escalation and declaration path, from first report to the decision on a major incident	Fill in: for example the group reaches the declaration decision and names who makes it
3	Validate the notification decisions: which outside parties must be told, by whom and by when	Fill in: for example the group identifies every party on the notification list that applies, with its deadline
4	Validate coordination with the related plans in scope (IR-3(2))	Fill in: for example the contingency team names the point at which the contingency plan is started
5	Identify parts of the plan and playbook that need to change	Fill in: for example at least the gaps found are recorded as actions
6	Fill in: objective	Fill in: criteria

A.3 Participants and exercise staff

Role in the exercise	Name	Role in the plan
Facilitator	Fill in: name	Leads the discussion; knows the plan and the objectives
Data collector	Fill in: name	Records observations against the evaluation criteria
Logistics coordinator	Fill in: name	Runs the checklist in A.4
Participant	Fill in: name	Fill in: role in the Incident Response Plan, for example incident response lead
Participant	Fill in: name	Chief Information Security Officer
Participant	Fill in: name	Senior privacy official
Participant	Fill in: name	Fill in: other role, for example system owner, legal counsel, communications, contingency plan coordinator

A.4 Logistics checklist

Adapted from SP 800-84 Table 4-1. Start at least a month ahead, or three months for a large exercise (section 4.2).

Task	Owner	Target date	Done
Get management approval for the date and participants	Fill in: name	Fill in: date
Choose the date; book the room or the video meeting	Fill in: name	Fill in: date
Name the facilitator and data collector; meet to review the objectives and the last exercise’s results	Fill in: name	Fill in: date
Invite participants in writing	Fill in: name	Fill in: date
Prepare the briefing, the facilitator guide and the participant guides	Fill in: name	Fill in: date
Send participant guides, if sent ahead (about a week before)	Fill in: name	Fill in: date
Set up screens, name cards, and copies of the plan and playbook	Fill in: name	Fill in: date

A.5 Agenda and briefing

Time	Activity
Fill in: time	Welcome and introductions: each participant gives their name and role
Fill in: time	Briefing: purpose, scope, objectives and ground rules
Fill in: time	Scenario discussion, module by module
Fill in: time	Debrief (hotwash)

Ground rules for the briefing: this is a discussion, not a test of individuals; answer as you would in a real incident, using the plan and playbook; say when the plan is unclear, since finding gaps is the purpose; what is said in the exercise stays in the exercise, except what goes in the after-action report.

Part B. Facilitator guide

The facilitator guide holds the purpose, scope and objectives (Part A), the scenario, and the questions that steer the discussion to the objectives (SP 800-84 section 4.3). Choose one scenario. Present one module at a time; give each inject, then ask the questions until the objectives for that module are met. Tailor questions to the level: decisions and oversight for senior leaders, procedures for operational staff.

B.1 Scenario 1: Ransomware

Module 1. Detection. At Fill in: time on a weekday, the security operations team sees an alert for unusual encryption activity on a file server that supports Fill in: a mission-critical service. Twenty minutes later, the service desk receives calls from users who cannot open shared files.

Inject	Facilitator questions	Expected response, from the plan and playbook
Users report files renamed with an unknown extension	Who is told first, and how? When is this declared an incident, and by whom? What severity?	Playbook 5.1 and 5.2: report form or case opened, team alerted, incident declared and severity set; system owner and CISO told
A ransom note appears on several servers	What do you contain first? Who approves isolating the servers? What happens to the backups?	Playbook 5.4 and section 6: isolate, protect backups by taking them offline; system owner approves

Module 2. Escalation. By midday, analysis shows the attacker copied data from the file server before encrypting it. The data includes Fill in: a type of information the organization holds, for example customer records.

Inject	Facilitator questions	Expected response, from the plan and playbook
Data was copied out before encryption	Is this now a breach? Who decides? Who must be told outside the organization, and by when?	Playbook 5.2 step 3 and 5.8: privacy official engaged; notification list checked (5.7)
The service will be down for at least two days	When does the contingency plan start? Who decides? How do the incident and recovery teams coordinate?	Playbook 5.2 step 6 and 5.5; contingency plan activation (IR-4b, IR-3(2))
An email arrives demanding payment	Who decides how to respond? Who may contact the attacker?	Playbook section 6: no contact or payment without the CISO and legal counsel

Module 3. Recovery and communication.

Inject	Facilitator questions	Expected response, from the plan and playbook
A reporter calls asking about an outage	Who speaks for the organization? Who approves what is said?	Playbook 5.7 step 5: communications prepares; CISO approves
Backups are available from three days ago	How do you know they are clean? Who signs off before the system returns to production?	Playbook 5.5 steps 2 and 4

B.2 Scenario 2: Compromised administrator account

Module 1. A cloud administrator’s account signs in from an unfamiliar country at Fill in: time, adds a new multifactor device, and creates an access key. The administrator is on leave.

Inject	Facilitator questions	Expected response, from the plan and playbook
Sign-in alert from the identity provider	Who receives the alert? How quickly is it triaged? Who can disable the account at this hour?	Playbook 5.1 step 3, 5.2, and section 6 (account takeover); on-call coverage (IR-7)
The new access key was used to list storage buckets	How do you find out what was accessed? What evidence do you keep, and where?	Playbook 5.3 steps 1 to 4

Module 2.

Inject	Facilitator questions	Expected response, from the plan and playbook
Two other administrator accounts show the same sign-in pattern	How do you find every affected account? When is containment complete?	Playbook 5.3 step 2 and 5.4
The cloud provider sends a notice about a campaign against its customers	How do you work with the provider? What do you share with them?	Playbook 5.7 step 4 and section 6 (supplier or cloud provider incident; IR-6(3))

B.3 Scenario 3: Breach of personally identifiable information

Use this scenario for the breach exercise the IR-2(3) clause sets in each annual training cycle.

Module 1. An employee emails a spreadsheet to a personal email address to work from home. A colleague mentions it to their supervisor two days later. The spreadsheet holds Fill in: for example names, dates of birth and account numbers for about Fill in: number people.

Inject	Facilitator questions	Expected response, from the plan and playbook
The supervisor hears about it	Is this an incident? Must the supervisor report it, and how quickly? Is it a breach if no one outside saw it?	IR-2(3) training: report confirmed and suspected breaches within the reporting time; playbook 5.1
The employee says they deleted it	What do you need to confirm? Who talks to the employee?	Playbook 5.8 steps 1 and 2; section 6 (insider or misuse): involve human resources and legal counsel

Module 2.

Inject	Facilitator questions	Expected response, from the plan and playbook
The personal email account was itself compromised last month	How likely is harm now? What kinds of harm?	Playbook 5.8 step 3: harm assessment (IR-8(1)(b))
Legal counsel asks which laws and contracts apply	Where is the list? Who decides whether to notify the individuals, and when?	Plan breach section; playbook 5.8 steps 4 and 5 (IR-8(1)(a), (c))
The individuals live in several states or countries	Does that change who must be told, or how fast?	Applicable requirements list (IR-8(1)(c))
Notices are approved	What do they say? What help is offered? Who answers the calls?	Playbook 5.8 steps 6 to 8

B.4 Your own scenario

Module	Inject	Facilitator questions	Expected response
Fill in: module	Fill in: new information given to participants	Fill in: questions tied to an objective in A.2	Fill in: what the plan or playbook says should happen

Guidance

Good scenarios come from the organization’s own risk assessment and recent incidents, including incidents at others in the same sector. Rotate scenarios from year to year, and make sure at least one exercise each year reaches a decision about notifying outside parties; an exercise that stops at containment leaves the hardest decisions untested. CISA’s Tabletop Exercise Packages, described at the top of this template, are a ready source of further scenarios, including sector-specific ones.

Part C. Participant guide

Give participants Part A (A.1, A.2 and A.5), the scenario’s opening paragraph for each module, and these orientation questions, without the facilitator’s questions and expected responses (SP 800-84 section 4.3).

• What is your role in the Incident Response Plan, and what would you do first?
• Who do you need to hear from, and who needs to hear from you?
• What decisions would you make, and what information would you need to make them?
• Where does the plan or playbook not match what you would really do?

Part D. Debrief (hotwash)

Hold the debrief right after the discussion (SP 800-84 section 4.4). The data collector records the answers.

• What worked well, and which areas do you feel the team handles well?
• Where do you need more training?
• Which parts of the plan or playbook should be updated?
• Are there issues we did not discuss that we should have?
• How could the next exercise be better?

Data collector’s log

Time	Objective	Observation	Plan or playbook section
Fill in: time	Fill in: objective number from A.2	Fill in: what was said or decided, and by whom	Fill in: section

Part E. After-action report

Write the report within Fill in: time, for example 10 business days of the exercise. SP 800-84 section 4.5 puts the debrief comments and the data collector’s lessons learned in the report, with background on the exercise, the observations, and recommendations for the plan.

E.1 Introduction

On Fill in: date, Organization name held a Fill in: duration-hour tabletop exercise to validate its Incident Response Plan, using the Fill in: scenario scenario, with Fill in: number participants from Fill in: teams.

E.2 Objectives and results

#	Objective	Met?	What was observed
Fill in: number	Fill in: objective from A.2	Fill in: met, partly met, or not met	Fill in: observation against the evaluation criteria

E.3 Findings and recommendations

General findings: Fill in: overall observations, including what worked well

ID	Finding	Recommendation	Owner	Due date	Tracking reference
Fill in: ID	Fill in: finding	Fill in: recommended action	Fill in: role	Fill in: date	Fill in: plan of action and milestones item or ticket

E.4 Changes that follow

The results were reviewed by Fill in: who on Fill in: date. These changes follow from them (IR-4c, IR-8c):

• Incident Response Plan: Fill in: sections to update, or none
• Incident handling playbook: Fill in: steps to update, or none
• Training: Fill in: changes to incident response training (IR-2), or none
• Related plans: Fill in: changes to the contingency plan or other related plans (IR-3(2)), or none
• Next exercise: Fill in: what the next exercise should cover, and its planned date

E.5 Approval

Name	Title	Signature	Date
Fill in: name	Chief Information Security Officer		Fill in: date

Guidance

Assessors look for three things in IR-3 evidence: the exercise met the stated frequency, the after-action report exists, and its actions were tracked to closure and changed the plan, playbook or training. A report with every objective “met” and no findings is a common finding in itself; ask what the exercise taught.