What should a tabletop exercise template include?

At minimum: an exercise overview with scope, objectives, assumptions and artificialities; a participant and roles list; an agenda; a master scenario events list (MSEL) of timed injects; the inject cards themselves; facilitator questions; an evaluation guide tied to the objectives; hotwash prompts; and an after-action report outline with an improvement plan listing owners and due dates.

What is an MSEL in a tabletop exercise?

The MSEL, or master scenario events list, is the timeline of everything that happens in the exercise: each inject, when it is released, who delivers it, who receives it, and what response the planners expect. It is the facilitator's control document. Players never see it in full; they receive injects one at a time as the scenario unfolds.

How do you write an after-action report for a tabletop exercise?

Start with a one-page executive summary, then describe the exercise, analyse performance against each objective with observations and root causes, and finish with an improvement plan: each issue, the corrective action, an owner, a due date and status. Circulate a draft within one to two weeks of the exercise while memories are fresh, then agree actions with the sponsor.

Tabletop Exercise Template: Free Copy-Paste Kit

A tabletop exercise template gives you every document a facilitator needs in one place: the exercise overview, roles, agenda, MSEL, inject cards, questions, evaluation guide, hotwash prompts and after-action report. Copy the blocks below into your own document, replace the placeholders in angle brackets, and delete the example rows once you have written your own.

The template follows the discussion-based structure used by HSEEP, simplified for cyber incident-response teams. Each section explains what to fill in and why. If you prefer to work in a form rather than a document, the scenario builder in the site's live exercise runner walks you through the same fields and lets you run the result live, with injects pushed to players' phones.

How to use this template

Fill it in this order, which mirrors the planning timeline in how to run a tabletop exercise:

Overview and objectives with your sponsor, six to eight weeks out.
Participants and roles once objectives tell you whose decisions you need.
MSEL and inject cards with a small planning team, four weeks out.
Facilitator questions and evaluation guide after the injects are stable.
Agenda last, once you know how long each module takes in a dry run.
Hotwash and after-action report on and after the day.

Keep the full template confidential to the planning team. Players get the overview (without the scenario), their role, the agenda and the ground rules. Mark documents with a Traffic Light Protocol label, typically TLP:AMBER.

1. Exercise overview

The overview is the contract with your sponsor. Write it in plain language; if the sponsor cannot sign it off in five minutes, it is too long.

## Exercise overview
| Field              | Value                                                   |
|--------------------|---------------------------------------------------------|
| Exercise name      | <Q4 cross-functional ransomware tabletop>               |
| Date / time        | <2026-11-12, 13:30–16:00>                               |
| Location           | <Board room + video bridge>                             |
| Sponsor            | <Chief Operating Officer>                               |
| Exercise lead      | <IR lead>                                               |
| Type               | Discussion-based tabletop                               |
| Scenario summary   | <One sentence. Planning team only.>                     |
| Classification     | TLP:AMBER                                               |

### Scope
- In scope: <IR plan v3.2, crisis comms plan, ERP and e-commerce services>
- Out of scope: <Physical security, OT network, technical containment detail>

### Objectives (3–5, specific and observable)
1. OBJ-1: <Declare severity and activate the crisis team within 30 min of exercise time>
2. OBJ-2: <Name who authorises isolating production systems and the criteria used>
3. OBJ-3: <Confirm the approval chain for the first external statement>
4. OBJ-4: <Validate restoration priorities for the top five business services>

### Assumptions
- The scenario is plausible; players accept it and do not fight it.
- Players respond using current plans, roles and authority.
- Decisions are not precedents and are not attributed to individuals in the report.

### Artificialities
- Time is compressed; the facilitator will announce jumps ("It is now Saturday 09:00").
- External parties (insurer, regulator, media, attacker) are played by the white cell.
- No real systems are touched and no real calls are made.

How to fill it. Objectives drive everything else, so spend most time there. Each must map to at least one inject and one evaluation criterion. The table of weak versus strong objectives in the planning guide helps. Assumptions and artificialities are read aloud at the start; they stop the session derailing into "but in reality we would…".

2. Participants and roles

List every person, their exercise role and their real-world role. The roles guide explains each role.

## Participants
| Name        | Exercise role        | Real-world role          | Deputy       | Attending |
|-------------|----------------------|--------------------------|--------------|-----------|
| <A. Jones>  | Facilitator          | IR lead                  | —            | In person |
| <B. Smith>  | Scribe               | Security analyst         | —            | In person |
| <C. Patel>  | Player – incident commander | CISO              | <D. Lee>     | In person |
| <E. Moreau> | Player – IT ops      | Head of infrastructure   | <F. Kim>     | Remote    |
| <G. Rossi>  | Player – legal       | General counsel          | <H. Novak>   | In person |
| <I. Dubois> | Player – comms       | Head of communications   | —            | In person |
| <J. Weber>  | Player – business    | COO                      | —            | In person |
| <K. Sato>   | Evaluator            | Internal audit           | —            | In person |
| <L. Costa>  | White cell           | Risk manager (plays insurer, regulator, journalist) | — | In person |

How to fill it. Check that every objective has a decision-maker in the list. If OBJ-2 is about authority to shut down production, the person who holds that authority must attend. Invite deputies deliberately; they often surface the biggest gaps.

3. Agenda

## Agenda (150 minutes)
| Time  | Segment                                   | Lead         |
|-------|-------------------------------------------|--------------|
| 0:00  | Welcome, objectives, ground rules          | Sponsor / facilitator |
| 0:10  | Starting situation                        | Facilitator  |
| 0:15  | Module 1 – Detection and escalation        | Facilitator  |
| 0:50  | Module 2 – Containment and decisions       | Facilitator  |
| 1:25  | Break                                     | —            |
| 1:35  | Module 3 – Communications and recovery     | Facilitator  |
| 2:10  | Hotwash                                   | Facilitator  |
| 2:30  | Close and next steps                      | Sponsor      |

How to fill it. Allow roughly 10–15 minutes of discussion per inject. If the dry run overruns, cut injects rather than discussion time.

4. Master scenario events list (MSEL)

The MSEL is the facilitator's control sheet. Scenario time is the time in the story; exercise time is the wall clock. Example rows below use a ransomware storyline.

#	Exercise time	Scenario time	Inject	From → To	Expected action	Objective
1	0:15	Fri 22:40	EDR alert: mass file renames on file server FS-02	EDR → SOC analyst	Triage, escalate to IR lead	OBJ-1
2	0:25	Fri 23:00	Service desk: three sites cannot open shared drives	Service desk → IT ops	Correlate, assess scope	OBJ-1
3	0:35	Fri 23:25	Ransom note found on several virtual machines	IT ops → IR lead	Declare Severity 1, activate crisis team	OBJ-1
4	0:50	Sat 00:10	IT ops requests go/no-go to isolate the virtualisation network	IT ops → incident commander	Named approver decides; decision recorded	OBJ-2
5	1:05	Sat 02:30	Insurer requires its panel IR firm and a claim reference	White cell (insurer) → legal	Locate policy, engage counsel and IR firm	OBJ-2
6	1:35	Sat 08:00	Journalist asks for comment within one hour	White cell (media) → comms	Holding statement drafted and approved	OBJ-3
7	1:50	Sat 14:00	Restore of priority systems estimated at five days	IT ops → COO	Confirm restoration order with business owners	OBJ-4
8	2:00	Sun 10:00	Leak-site post includes employee HR records	White cell → legal / privacy	Assess notification duties and timing	OBJ-3

How to fill it. Write injects backwards from objectives: for each objective, ask which piece of news would force the decision you want to observe. Add one or two optional "curveball" rows for groups that move quickly. The guide to designing tabletop injects covers pacing and realism.

5. Inject card format

Each inject is released as a card, slide or message. Keep it short and in the voice of the source.

### INJ-04 — Containment request
Release at:   Exercise 0:50 | Scenario Sat 00:10
From:         Head of infrastructure (played by player E. Moreau)
To:           Incident commander
Channel:      Phone call on the crisis bridge

Content (read aloud or show):
"We can stop the spread by disconnecting the virtualisation management
network. Every VM on the cluster goes down, including order processing
and the warehouse system. I need a go/no-go in 15 minutes."

Attachments:  <Mock network diagram, clearly marked EXERCISE>
Objective:    OBJ-2
Expected discussion: approver named; business impact assessed with COO;
                     evidence preservation considered; decision time recorded
Facilitator prompts: see question bank Q-M2-01 to Q-M2-05

How to fill it. Every card needs a sender, a channel and a deadline if one exists. Mark all realism artefacts "EXERCISE" so nothing is mistaken for a real alert if it leaves the room.

6. Facilitator question bank

Organise questions by module and link each to an objective, so the facilitator can see which objectives still need coverage.

## Question bank
| ID       | Module | Objective | Question                                                        | Follow-up if answer is vague                  |
|----------|--------|-----------|-----------------------------------------------------------------|-----------------------------------------------|
| Q-M1-01  | 1      | OBJ-1     | Who does the SOC analyst call first, and through which channel? | What if they don't answer within 10 minutes?  |
| Q-M1-02  | 1      | OBJ-1     | At what point is this Severity 1 under your plan? Who declares? | Show me where the plan says that.             |
| Q-M2-01  | 2      | OBJ-2     | Who can approve taking production offline right now?            | Is that written down? Who is their deputy?    |
| Q-M3-01  | 3      | OBJ-3     | Who approves the reply to the journalist, and how fast?         | What if that person is unreachable?           |

How to fill it. Aim for three to five questions per inject, mostly open. The tabletop exercise questions article has more than 100 to choose from, grouped by phase and role.

7. Evaluation guide

Evaluators observe capabilities, not people. For each objective, list the critical tasks that show it was met. The scoring guide explains rating scales.

## Evaluation guide — OBJ-2 Containment decision-making
| # | Critical task                                         | Observed? | Exercise time | Notes / evidence |
|---|-------------------------------------------------------|-----------|---------------|------------------|
| 1 | Decision owner for a production-wide outage is named   |           |               |                  |
| 2 | Business impact assessed with the service owner        |           |               |                  |
| 3 | Evidence-preservation impact considered                |           |               |                  |
| 4 | Decision, approver and time recorded                   |           |               |                  |
| 5 | Business and comms informed before execution           |           |               |                  |

Overall rating (P / S / M / U): ___
Strengths:
Areas for improvement:

How to fill it. Write one guide per objective. Critical tasks must be observable in discussion, for example "decision owner named", not "team shows good judgement".

8. Hotwash prompts

The hotwash happens immediately after the last inject. Keep it to 20–30 minutes and capture answers verbatim.

## Hotwash
1. What is one thing that worked better than you expected?
2. Where did you hesitate, and what would have helped you decide faster?
3. Which decision needed someone who was not in the room?
4. What information did you need that you could not get?
5. Which part of the plan did you not use, and why?
6. If this happened tonight, what is the first thing you would fix?
7. What should the next exercise test?

How to fill it. Go round the room so every function speaks. The facilitator summarises the top three to five themes before closing.

9. After-action report outline

Draft within one to two weeks. The after-action report guide covers how to write strong findings.

# After-action report — <Exercise name>
1. Executive summary (one page: purpose, top strengths, top gaps, key actions)
2. Exercise overview (date, scope, objectives, scenario summary, participants by role)
3. Analysis by objective
   - OBJ-n: rating, observations, root cause, recommendations
4. Improvement plan (table below)
5. Participant feedback
Appendix A: MSEL
Appendix B: Participating roles

10. Improvement plan

ID	Issue	Corrective action	Owner	Due date	Status
IP-01	No named approver for external statements	Name approver and deputy in the crisis comms plan; cross-reference from IR plan	Head of communications	2026-12-15	Open
IP-02	Authority to isolate production not documented	Add decision-rights table to IR plan, approved by COO	CISO	2027-01-15	Open
IP-03	Contact list stored only on the file server	Keep offline and printed copies; store in the out-of-band channel	IR lead	2026-11-30	In progress
IP-04	ERP restore time unknown	Run and time a full ERP restore test	Head of infrastructure	2027-02-28	Open

How to fill it. One owner per line (a person, not a team), a real date, and a status that someone reviews monthly. Add a verification column if your auditors want evidence of closure. The next exercise should re-test the highest-priority lines.

Common template mistakes

Objectives with no matching inject. They will not be tested. Cross-check the MSEL's objective column.
Too many injects for the time. Eight to ten for a two-and-a-half-hour session is plenty.
Players see the MSEL. It removes surprise. Share injects one at a time.
An evaluation guide that grades people. Rate capabilities and plans.
An improvement plan with "IT" as owner. Name a person.