CISA Tabletop Exercise Packages (CTEP): How to Use Them

CISA Tabletop Exercise Packages (CTEPs) are free, downloadable exercise kits published by the US Cybersecurity and Infrastructure Security Agency. Each package is built around a scenario, cyber or physical, and follows the HSEEP methodology, with templates, a situation manual and facilitator and evaluator material that an organisation can use to run its own discussion-based exercise.

They are one of the best free starting points available, particularly for teams running their first exercise. They are also generic by design, US-centric and document-heavy, so getting real value from one means adapting it. This guide covers what is typically inside, where CTEPs shine and where they fall short, and how to turn one into an exercise that fits your organisation.

What a CTEP is

CISA publishes CTEPs as a resource for critical infrastructure owners and operators and other organisations that want to exercise their plans without starting from a blank page. They are aligned with HSEEP, FEMA's Homeland Security Exercise and Evaluation Program, whose doctrine was revised in 2020. HSEEP distinguishes discussion-based exercises (seminars, workshops, tabletops and games) from operations-based ones (drills, functional and full-scale exercises). CTEPs sit firmly on the discussion-based side.

Using a package does not involve CISA directly. Your own team plans, facilitates and evaluates the exercise; the package provides the structure and content. Because the collection changes over time, check CISA's website for the current list of scenarios rather than relying on any summary.

What is typically inside

Packages vary and not every package contains every item, but the materials usually come from this family, reflecting the HSEEP lifecycle:

Scenarios are generally organised into modules that follow an incident from early warning signs through response and into recovery, with discussion questions at the end of each module. The questions are usually broad and cover several functions: detection, escalation, communications, continuity, and coordination with external partners.

Strengths

• Free and credible. Materials published by a national agency and aligned with a recognised doctrine are easy to justify to a sponsor or an auditor.
• Complete lifecycle. Planning, conduct and evaluation are all covered, so a first-time exercise planner is less likely to skip the evaluation and improvement steps.
• Good question banks. The discussion questions are a useful checklist of topics, even if you rewrite most of them.
• Scenario breadth. Cyber and physical scenarios mean the same format can serve security, continuity and emergency management teams.
• Common language. HSEEP terminology helps if you exercise with public-sector partners or other organisations that use it.

Limits

None of these are criticisms of CISA. They follow from what a free, general-purpose package has to be.

• Generic by design. A package written for many sectors cannot name your systems, your people or your suppliers. Unadapted, it invites generic answers: "we would follow the plan".
• US-centric. References to US agencies, reporting routes and legal frameworks need replacing for organisations elsewhere, and even for US organisations with sector-specific regulators.
• Document-heavy. Several long documents are practical for an emergency management team with an exercise planner; they are a lot for a two-person security team.
• Broad questions, few forced decisions. Open questions produce discussion; they do not always produce decisions. Exercises are most revealing when an inject makes someone choose between two bad options against a clock.
• The facilitator does all the work. Releasing information, tracking time, capturing responses and writing the report all sit with the facilitator and a scribe, usually with paper, slides and a notes document.

Choosing the right package

Before adapting anything, pick the package that gives you the least rework. A few questions help:

• Does the scenario match a risk you actually carry? Look at your risk register and recent incidents in your sector. A ransomware package is a safe default for most organisations; an industrial control system scenario only makes sense if you run operational technology.
• Who is the audience? Some scenarios suit a technical response team, others an executive or cross-functional crisis team. Mixing both audiences in one session is possible but harder to facilitate.
• Which plan are you testing? A package that exercises continuity and crisis communication is a poor fit if your objective is to test the security team's escalation path, and vice versa.
• How much time do you have? Estimate the session length from the number of modules and questions, then decide what you will cut before you start editing.
• Who else is involved? If you exercise with public-sector partners, local emergency management or sector peers, an HSEEP-aligned package gives everyone a shared structure and vocabulary.

If two packages look equally suitable, choose the one with fewer modules. Adding depth to a short scenario is easier than cutting a long one.

How to adapt a CTEP to your organisation

Treat the package as a well-organised first draft. The steps below usually take a few days of planning effort spread over several weeks.

1. Start from your objectives, not the package

Write three to five objectives before opening the situation manual. Then choose the package whose scenario best exercises them. If no package matches, take the structure from one and the scenario from somewhere else. The how to run a tabletop exercise guide covers objective writing.

2. Replace every generic noun

Go through the situation manual and swap placeholders for specifics: "a critical system" becomes your ERP or EHR; "the IT department" becomes the named on-call team; "a vendor" becomes your managed service provider. Realism is what turns a discussion into a test.

3. Localise the external world

Replace agencies, regulators and reporting channels with the ones that apply to you. For a European organisation that means your national CSIRT or competent authority and any NIS2, DORA or GDPR reporting steps; the NIS2 and DORA tabletop guide shows how to build those clocks into the scenario. Add your insurer, your incident response retainer and your outside counsel.

4. Turn questions into injects

Keep the best discussion questions, but convert several of them into injects that force a decision. "How would your organisation communicate with customers?" becomes "A journalist has emailed asking you to confirm the outage by 16:00; the draft statement is not approved. What do you do?" The guide to designing tabletop injects covers this in detail.

5. Cut to fit the time

Packages often contain more material than a two to three-hour session can absorb. Drop modules or questions that do not serve your objectives. Eight to ten well-chosen injects are plenty.

6. Right-size the documents

Merge the planning and facilitator material into a single facilitator guide. Give players a short starting situation and release each inject separately rather than handing out the whole situation manual, which reveals what is coming.

7. Plan the evaluation

Keep the package's evaluation approach, but map evaluation criteria directly to your objectives. Decide in advance what "good" looks like for each. The article on scoring tabletop exercises gives a practical rubric.

8. Close the loop

Use the after-action report template, or your own, and convert findings into an improvement plan with owners and dates. Schedule the retest.

Running it live instead of on paper

A CTEP is designed to be run with printed documents and slides. That works, but it puts the whole mechanical load on the facilitator and loses much of what happens in the room: side conversations, hesitations and the exact time a decision was made.

An alternative is to move the adapted scenario into a live tool. The site's live exercise runner lets a facilitator release injects to players' phones through a join code, collect responses and decisions against each inject, run the hotwash and export the after-action report. Its scenario builder lets you write your adapted CTEP scenario inject by inject, or start from a library scenario and edit it. The facilitator can then focus on the conversation instead of paperwork.

Whichever format you use, the CTEP's HSEEP structure still applies: objectives, modules, evaluation, report, improvement plan.

CTEP vs scenario library vs building your own

These options combine well. Many teams take the structure and evaluation approach from a CTEP, borrow injects from a library scenario such as the ransomware tabletop, and add organisation-specific details of their own. Browse the scenario library to see what is available.

Common mistakes with CTEPs

• Running the package as-is. The most common failure. Players spot generic content immediately and disengage.
• Handing out the whole situation manual. Participants read ahead, and the exercise loses any sense of uncertainty.
• Skipping evaluation. The evaluation material is there for a reason. Without it, the exercise produces opinions rather than findings.
• No follow-up. A completed after-action report template with no owners or dates is not an improvement plan.

Related

• How to run a tabletop exercise
• Designing tabletop injects
• Scoring tabletop exercises
• Scenario library
• Glossary: HSEEP