100+ Tabletop Exercise Questions for Incident Response

Good tabletop exercise questions turn a story into a test. A scenario on its own invites people to nod along; a sharp question such as "who can approve taking that system offline at 23:00, and how do you reach them?" forces the group to show whether the plan works. Below are 105 incident response tabletop questions, organised first by incident phase and then by role, followed by guidance on how to ask them.

Use them with any scenario in the scenario library, or with your own. Pick three to five per inject and adapt the wording to your systems and teams. For facilitation technique beyond the questions themselves, see facilitating a tabletop exercise.

How to ask tabletop questions

The same question can produce a useful answer or a useless one depending on how it is asked.

Prefer open questions. "Would you notify legal?" gets "yes". "Walk me through how legal finds out, and what you tell them" reveals whether anyone knows the number, the channel and the information legal needs.

Use closed questions to pin down facts. Once discussion has run, close it: "So who owns this decision? One name." Closed questions are for commitments, not exploration.

Always have a follow-up. Vague answers are where gaps hide. Useful follow-ups:

• "Show me where that is written down."
• "What if that person does not answer?"
• "How long does that take, and have you ever timed it?"
• "What would you need to know to decide?"

Ask "what would you need to know?" It is the most productive question in any tabletop. It exposes information gaps (no asset inventory, no data map) that no other question finds.

Direct questions to roles, not the room. "Legal, what is your first action?" gets an answer; "does anyone have thoughts?" gets silence or the loudest voice.

Do not rescue the group. If nobody knows, let the silence sit, then record it as a finding. "We don't know" is valuable output.

Weak vs strong question rewrites

Questions by phase

Detection and escalation

1. What is the first signal, and who sees it first?
2. How does that person decide whether it is a real incident or noise?
3. Who do they call first, and through which channel?
4. What happens if the on-call person does not respond within 15 minutes?
5. At what point does this become a high-severity incident under your plan?
6. Who has the authority to declare that severity?
7. How is the crisis team activated out of hours, on a weekend or on a public holiday?
8. Where is the contact list, and would you be able to reach it if this system is down?
9. Who starts the incident log, and where is it kept?
10. What would you need to know right now to decide whether this is serious?

Containment

11. What containment options do you have, and what does each one break?
12. Who can authorise taking a production system offline?
13. Is that authority written down, and who is the deputy?
14. What business impact would the containment action cause, and who assesses it?
15. What evidence might be lost by shutting down versus isolating?
16. Should privileged credentials be reset now? In what order?
17. How do you know the attacker has not got a second way in?
18. What is the risk of tipping off the attacker by acting too early?
19. Who tells the business owner before the service goes down?
20. How and where is the containment decision recorded?

Eradication and recovery

21. How do you confirm the attacker is gone?
22. Which systems are rebuilt and which are cleaned? Who decides?
23. What are the restoration priorities, and who agreed them?
24. Are those priorities based on tested restore times or on estimates?
25. Are your backups intact, and how do you know they are not compromised?
26. What is the recovery time objective for each critical service, and can you meet it?
27. What manual workarounds keep the business running meanwhile?
28. What must be true before a system is reconnected?
29. Who signs off that the incident is closed?

Communications

30. Who is the single owner of incident communications?
31. What do you tell employees in the first hour, and through which channel?
32. Which channel do you use if email and chat may be compromised? (See out-of-band communications.)
33. Who drafts, who approves and who sends external statements?
34. Do you have a pre-approved holding statement?
35. What does the service desk say to callers?
36. How do you respond to a journalist with a one-hour deadline?
37. What do you say if staff start posting about the incident on social media?
38. When and how do you brief major customers individually?
39. How do you keep internal and external messages consistent as facts change?

Legal and regulatory

40. When is legal brought in, and by whom?
41. Should outside counsel direct the investigation? Why or why not?
42. What facts do you need to decide whether personal data is affected?
43. Which notification clocks may have started, and from what moment?
44. Who tracks each deadline, and who decides to notify?
45. Are you subject to sector rules (for example NIS2, DORA, HIPAA or SEC disclosure) in addition to data-protection law?
46. What do you notify if the facts are still incomplete at the deadline?
47. When would you involve law enforcement, and who makes contact?
48. How are decisions and legal advice documented?
49. Do any contracts require you to notify customers or partners within a set time?

Third parties

50. Which suppliers are involved or affected, and who is their contact?
51. Does the contract require the supplier to notify you, and within what time?
52. What access does the supplier have to your environment right now? Should you cut it?
53. How do you engage your incident-response retainer, and is it approved by your insurer?
54. Where is the cyber-insurance policy number, and what does the policy require first?
55. What if the supplier gives you no information for 48 hours?
56. Who speaks to the supplier's security team, and who to their account manager?
57. Do you depend on the affected supplier for your own recovery?

Executive decisions

58. What level of downtime would you accept to stop the spread?
59. Which business services must be protected at all costs?
60. Who is authorised to speak for the organisation?
61. What would trigger informing the board, and who does it?
62. How would you decide on a ransom demand, and who must be consulted?
63. What legal constraints, such as sanctions screening, apply to any payment?
64. What spending can be approved immediately, and by whom?
65. What would you tell the largest customer if they called you now?
66. What would make you declare this a crisis rather than an IT incident?
67. What decision are you avoiding, and what does delay cost?

Hotwash

68. What worked better than you expected?
69. Where did you hesitate, and what would have helped you decide faster?
70. Which decision needed someone who was not in the room?
71. What information did you need but could not get?
72. Which part of the plan did you not use, and why?
73. What single change would help most if this happened tonight?
74. What should the next exercise test?

Questions by role

Incident-response lead

75. What is your first action when paged, and your first decision?
76. How do you divide work across the team in the first hour?
77. What do you need from IT operations, legal and communications, and by when?
78. How often do you brief leadership, and in what format?
79. When do you call in external responders?

IT operations

80. What can you isolate in the next 15 minutes, and what goes down with it?
81. Which systems depend on the affected one that people may have forgotten?
82. How long does a full restore of the top system take, based on the last test?
83. What credentials and consoles would you need if single sign-on is unavailable?
84. What would you rebuild from scratch rather than restore?

Legal

85. Who is your client, and does privilege apply to the investigation?
86. Which notification decisions are yours, and which need executive approval?
87. What do you need from the technical team to assess the data involved?
88. What must not be said publicly until you have reviewed it?

Communications

89. What is your first internal message, and who approves it?
90. Who is the spokesperson, and who is the deputy?
91. How do you monitor what is being said about you externally?
92. What would you never say in a statement at this stage?

HR

93. What do you tell staff whose personal data may be exposed?
94. How do you support people working long shifts during the incident?
95. If an employee is involved, how do HR, legal and security coordinate without tipping them off?
96. What do you say to staff who cannot work because systems are down?

Finance

97. Which payments or payroll runs are due in the next 72 hours, and can they still be made?
98. How would you detect and stop a fraudulent payment during the chaos?
99. What emergency spending authority exists, and who holds it?
100. How do you track incident costs for the insurer?

Executives

101. What is the worst plausible outcome, and are you prepared for it?
102. What do you need from the crisis team to make decisions, and how often?
103. Which regulators, customers or partners would you personally call?
104. What trade-off between speed and certainty are you willing to make?
105. After this, what will you fund or change?

Putting the questions to work

1. Map questions to objectives. For each exercise objective, choose the three or four questions that test it. Record the objective ID next to each question in your tabletop exercise template.
2. Assign questions to injects. Each inject in the MSEL should carry its own short list.
3. Tailor names. Replace "the system" with your real ERP, identity platform or hospital record system.
4. Capture answers verbatim. The scribe records exact words, especially "we don't know" and "we would ask someone". Those become findings in the after-action report.
5. Collect answers from everyone. In larger groups, ask players to answer individually before discussion. The site's live exercise runner can push a question to every player's phone and collect responses, which stops one voice from setting the answer.

For executive-only sessions, lead with the executive-decision and communications questions and summarise the technical phases as a briefing. The scoring guide explains how to turn answers into ratings without grading individuals.

Related

• What is a tabletop exercise?
• Facilitating a tabletop exercise
• Tabletop exercise examples
• Designing tabletop injects and the MSEL
• Ransomware tabletop scenario
• Glossary: hotwash, incident commander