Skip to content
CyberTabletop

Collection · 6 articles

Running a tabletop exercise

The full method, in the order you need it: scope the exercise, staff the room, facilitate, write injects, evaluate capabilities and close the loop with an after-action report.

  1. How to Run a Cyber Tabletop Exercise: A Planning Guide

    Plan a cyber incident-response tabletop exercise end to end: objectives, scenario choice, participants, a 6–8 week timeline, logistics and follow-up.

  2. Tabletop Exercise Roles: Who Does What in the Room

    Facilitator, controller, scribe, evaluators, players and trusted agents: responsibilities, a RACI matrix and sizing guidance for cyber tabletop exercises.

  3. Facilitating a Tabletop Exercise: Techniques That Work

    How to facilitate a cyber tabletop: ground rules, pacing, time compression, probing questions, handling dominant voices, remote play and a clean hotwash.

  4. Designing Tabletop Injects and the MSEL

    Write tabletop injects that force real decisions: inject anatomy, types, branching, realism artifacts, pacing, and a Master Scenario Events List you can reuse.

  5. Scoring Tabletop Exercises: Evaluation Guides and Rubrics

    Evaluate a cyber tabletop without grading people: capability targets, HSEEP-style evaluation guides, P/S/M/U ratings, maturity rubrics and decision-time metrics.

  6. Writing a Tabletop After-Action Report and Improvement Plan

    Turn a tabletop hotwash into an after-action report and improvement plan: structure, how to write findings, owners and due dates, tracking and re-testing.