How to Run a Cybersecurity Tabletop Exercise: 90-Minute Script and Scenarios

You have an incident response plan. Maybe it’s a polished document, maybe it’s a page in a shared drive. Either way, the real question is whether anyone could follow it at 2 a.m. on a holiday weekend with the file server encrypted.

A tabletop exercise is how you find out, cheaply and safely. You put the right people in a room, describe an attack as it unfolds, and ask “What do you do now?” The gaps show up fast: nobody knows who calls the insurer, the backup admin is the only person with the vault password, and legal assumed IT would handle customer notices.

This guide gives you everything you need to run your first session in 90 minutes, including a facilitator script, 3 ready-to-use scenarios and a simple after-action template.

What a tabletop exercise is (and isn’t)

NIST’s glossary, drawing on SP 800-84 (its guide to test, training and exercise programs), describes a tabletop exercise as a discussion-based session where people with roles in a plan meet to validate it by talking through their responsibilities during an emergency. A facilitator presents a scenario and asks questions.

What it is not:

• Not a technical test. Nobody restores a server or runs a scan. That’s a functional exercise or a drill.
• Not a pass/fail audit. The goal is to find gaps, not to grade people.
• Not an IT-only meeting. The hardest calls in a real incident, such as paying a ransom, telling customers or shutting down operations, are business decisions.

Key takeaway: A tabletop tests your decisions and communication, not your technology. That’s why it’s the right first exercise for almost every organization.

Who should be in the room

Keep it to 6–12 people. Too few and you miss perspectives; too many and nobody talks.

• Facilitator: runs the clock, releases injects and asks questions. Ideally someone who won’t be a key decision-maker during a real incident.
• Scribe: records decisions, open questions and gaps. Don’t skip this role.
• Executive decision-maker: owner, CEO or COO who can approve spending and shutdowns.
• IT or security lead and, if you have one, your managed service provider.
• Legal or compliance, or the person who would call outside counsel.
• Communications or marketing for customer and media messaging.
• Finance, especially for payment fraud scenarios.
• Operations or HR, depending on the scenario.

Tell participants it’s a no-fault exercise. People need to say “I don’t know” out loud for the session to work.

Before the session: a 2-week prep checklist

1. Pick 1 objective. For example, “Confirm we can decide within 1 hour whether to take systems offline” or “Confirm who notifies customers and how.”
2. Choose a scenario that matches your real risks (see below).
3. Gather your documents: incident response plan, contact list, cyber insurance policy, backup procedures and vendor contacts.
4. Write 3–4 injects, the new pieces of information released during the exercise.
5. Book 90 minutes and a room or video call with cameras on.
6. Send a short invite that explains the purpose, says it’s no-fault and asks people to bring their phones (to check whether they actually have the contact numbers they need).

If you don’t have a plan yet, build one first using our incident response plan template. A tabletop without a plan still works, but it becomes a planning session.

You don’t have to write everything from scratch. CISA publishes Tabletop Exercise Packages (CTEPs) with template objectives, scenarios, discussion questions, role templates, slide decks, feedback forms and an after-action report template. Scenarios cover ransomware, phishing, insider threats and industrial control systems, plus sector packages for areas such as healthcare, water and local government.

The 90-minute facilitator script

Opening lines you can read aloud: “Thanks for being here. Today we’re walking through a realistic cyber incident to test our plan, not each other. There are no wrong answers. If you don’t know something, say so; that’s exactly what we’re here to find. Our scribe will capture gaps, and we’ll leave with a short list of fixes and owners.”

Facilitator tips: - Ask “who specifically?” whenever someone says “we would.” Names, not departments. - Ask “where is that written down?” when people describe a process from memory. - Ask “how would you reach them?” for every outside call: insurer, lawyer, bank, IT provider. - Don’t fight the scenario. If someone says “that couldn’t happen to us,” note it and keep going. - Watch the clock. It’s better to finish all injects briefly than to spend 60 minutes on the first one.

Scenario 1: ransomware on a Monday morning

Setup: At 7:45 a.m. Monday, the front desk reports that files on the shared drive have strange extensions and a ransom note appears on 2 computers.

• Inject 1 (detection): IT confirms 3 servers are encrypted. Backups ran Saturday night. Questions: Who declares an incident? Do we disconnect systems? Who calls our IT provider and cyber insurer, and do we have the numbers on hand?
• Inject 2 (escalation): The attackers claim they stole customer data and will publish it in 72 hours unless paid. Questions: Who decides whether to engage a negotiator? Who calls outside counsel? Does our insurance require using specific vendors?
• Inject 3 (external pressure): A reporter emails asking about an outage. Customers are calling. Questions: Who approves public statements? What do staff say on the phone today?
• Inject 4 (recovery): Backups are clean but restoring will take 2 days. Questions: Which systems come back first? How do we operate manually until then? How do we confirm the attacker is out?

Our guide to ransomware protection covers the backup and prevention side.

Scenario 2: business email compromise and a wire transfer

Setup: Finance receives an email, apparently from a longtime supplier, with new bank details for an upcoming payment.

• Inject 1: The payment of a large invoice was sent Friday. On Tuesday, the real supplier asks why they haven’t been paid. Questions: Who calls the bank, and how fast? Who reports to law enforcement?
• Inject 2: IT finds a mail rule in the controller’s mailbox forwarding messages externally. Questions: Who resets credentials and checks for other compromised accounts? Was MFA enabled?
• Inject 3: The attacker has emailed 15 other vendors from the controller’s account. Questions: Who warns them, and with what wording?
• Inject 4: Questions: What payment verification rule would have stopped this? Who owns writing it?

Learn the warning signs in our explainer on business email compromise.

Scenario 3: lost laptop with customer data

Setup: A sales manager’s laptop is stolen from a car. It holds a spreadsheet of customer names and account details.

• Inject 1: Questions: Was the device encrypted? Can we wipe it remotely? Who confirms what data was on it?
• Inject 2: The laptop wasn’t encrypted. Questions: Does this trigger notification duties? Who decides? Which states do the affected customers live in?
• Inject 3: Questions: Who drafts the notice, and who approves it? Do we need to inform regulators or our insurer?

Breach notice rules vary by state; see our guide to data breach notification requirements.

After the session: the hot wash and action plan

FEMA’s Homeland Security Exercise and Evaluation Program (HSEEP) describes the hot wash as a short facilitated discussion right after the exercise to capture strengths and areas for improvement. HSEEP then documents results in an After-Action Report/Improvement Plan (AAR/IP).

You can keep it simple. Ask 3 questions:

1. What went well?
2. Where did we get stuck or disagree?
3. What must change before our next exercise?

Then fill in a short action table and send it within a week:

Treat it like a blameless postmortem: focus on the process, not on who froze.

Where to start and how often to repeat

1. This month: run Scenario 1 or 2 with your leadership team.
2. Within 30 days: close the top 3 gaps.
3. Every 6–12 months: run a new scenario, and after any major change such as a new IT provider, merger or system migration.
4. Rotate scenarios across ransomware, payment fraud, data loss and vendor outages, which also tests your business continuity and disaster recovery plans.

Some cyber insurers and compliance frameworks ask whether you test your response plan, so keep your AAR on file. Check your own policy and frameworks, such as our cyber insurance requirements guide, for specifics. NIST’s incident response guidance, SP 800-61 Revision 3 (April 2025), also treats lessons learned and continuous improvement as part of incident response.

The bottom line

A tabletop exercise costs you 90 minutes and a pot of coffee. In return, you find out who decides, who calls whom and what’s missing from your plan before an attacker forces the question. Pick a scenario, book the room and run your first one this quarter.

Sources

• NIST CSRC glossary: tabletop exercise (from SP 800-84) — definition of a tabletop exercise
• NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities — exercise program guidance
• CISA Tabletop Exercise Packages — scenario packages and templates
• FEMA Homeland Security Exercise and Evaluation Program (HSEEP) — hot wash and AAR/IP approach
• NIST SP 800-61 Revision 3 announcement — current incident response recommendations