Tabletop Exercise Roles: Who Does What in the Room

A tabletop exercise is only as good as the people around the table and the discipline of the people running it. Most exercise failures are staffing failures: the person who can authorise a shutdown is absent, nobody is writing down what was decided, or the facilitator is also trying to play the incident commander. This guide defines each role, explains what good looks like, and gives you a RACI matrix you can paste into your planning document.

If you have not planned an exercise before, start with the planning guide; this article assumes you have objectives and a scenario in mind.

Two groups: exercise staff and players

Every tabletop has two distinct populations.

• Exercise staff design, run, observe and document the exercise. They know the scenario in advance and never make response decisions.
• Players respond to the scenario as they would in a real incident. They do not see the scenario before the day.

Keeping these groups separate is what makes the exercise a genuine test. The moment a player knows what inject 6 says, they stop discovering gaps and start performing.

Exercise staff roles

Exercise sponsor

The sponsor is a senior leader who commissions the exercise and owns the outcome. They protect participants' time, open the session to signal its importance, and, most importantly, make sure the improvement plan is resourced. Sponsors may attend as observers; if they are also a natural player (for example, the COO in an executive exercise), decide in advance which hat they wear.

Exercise lead and planning team

The exercise lead coordinates planning: objectives, scenario, logistics and the report. They work with a small planning team of "trusted agents", subject-matter experts from security, IT, legal or communications who help make the scenario realistic. Trusted agents know the scenario, so they cannot play. HSEEP uses the same "trusted agent" concept: planning-team members who keep scenario details away from players.

Two to four trusted agents is usually enough. Choose people who know how things really work, not just how the policy says they work.

Lead facilitator

The facilitator owns the room and the clock. They brief the ground rules, read the starting situation, release injects, ask probing questions, keep discussion on the objectives and run the hotwash. They do not answer questions about what the "right" response is during play.

Good facilitators are neutral, comfortable with silence, and able to redirect a senior executive politely. They need enough technical knowledge to recognise a vague answer, but they do not need to be the most technical person in the room. The facilitation guide covers technique in depth.

Co-facilitator

For groups larger than about ten, or for hybrid sessions, a co-facilitator watches the room while the lead facilitator drives. They notice who has not spoken, manage the remote participants, track the parking lot and signal the lead when a thread is drifting from the objectives.

Controller and simulation cell

In a simple tabletop, the facilitator also delivers injects. In more elaborate exercises a controller (or a small simulation cell, sometimes called the white cell) plays everyone who is not in the room: the attacker, the regulator, a journalist, the cyber-insurer, the managed service provider, the bank. When players say "we would call the insurer", the controller answers in character, which keeps the scenario alive and tests whether players know what to ask.

Give the controller a short script for each simulated party: what they know, what they want and what they will refuse to do.

Scribe

The scribe records decisions, open questions, assumptions and gaps as they happen, ideally with a timestamp in exercise time. This record is the raw material for the after-action report. Without a dedicated scribe, findings are reconstructed from memory and the most senior voice wins.

Scribes should capture wording verbatim where possible, especially statements like "I assume IT would handle that" or "I'm not sure who decides". Those are findings.

Evaluators and observers

Evaluators watch the exercise against the objectives using a structured guide and later rate how well each capability was demonstrated. See scoring tabletop exercises. Observers are guests (auditors, board members, staff from another business unit) who watch but do not participate. Seat observers away from the table and brief them not to interject.

Player roles

Invite the people who would really hold each decision, plus their deputies. The exact list depends on the scenario, but a typical mixed exercise includes:

Third parties can be players too. Inviting your managed security provider, your incident-response retainer firm or your cloud provider's account team tests the real interfaces you will depend on. If they cannot attend, the controller can play them.

Who should not be in the room

• People with no decision role and no learning need. They dilute discussion.
• The whole reporting line of one player. A manager and three of their staff produce one voice.
• Anyone who designed the scenario, unless they are staff.
• Auditors acting as evaluators of individuals. If audit attends, make clear they are observing the process.

RACI matrix for the exercise

Use this matrix to agree who does what during planning, delivery and follow-up. R = responsible, A = accountable, C = consulted, I = informed.

Sizing guidance

A role briefing template

Send each staff member a one-page brief a week before the exercise. For players, the equivalent is the pre-read with ground rules and logistics, without scenario details.

## Role brief: Scribe

Exercise: Q3 ransomware tabletop — 15 Oct, 14:00–16:30
You report to: Lead facilitator

Before the day
- Read the objectives (OBJ-1 to OBJ-4) and the MSEL
- Set up the capture sheet: exercise time | inject | speaker role | decision / gap / question

During play
- Timestamp every decision in exercise time (T+hh:mm)
- Record assumptions verbatim ("I assume…", "Someone would…")
- Flag gaps with [GAP], open questions with [Q], strengths with [+]
- Do not participate in discussion

After the hotwash
- Send the raw capture sheet to the exercise lead within 24 hours

Getting the roles right on the day

A few habits prevent most staffing problems:

• Name tents with roles, not titles. "Incident commander" is more useful than "Head of Infrastructure".
• Confirm deputies at the start. If a primary role holder leaves early, the deputy steps in, which is realistic.
• Hold a five-minute staff huddle at each break. Facilitator, controller and scribe agree whether to skip, compress or add injects.
• Tell players they may say "I don't know". It is the most valuable sentence in any tabletop.

Related

• How to run a tabletop exercise
• Facilitating a tabletop exercise
• Glossary: incident commander, white cell, tabletop exercise