Prepare an incident tabletop that tests real decisions

Choose the decision before the scenario

Start with an uncertainty about the response process. Can staff reach an authorized leader without email? Who can approve a temporary service change? Which provider should receive the first escalation? A scenario should create a reason to work through these questions. Keep the initial exercise focused enough that participants can examine choices and dependencies instead of racing through a long fictional crisis.

CISA’s cybersecurity tabletop resources include scenarios involving threats such as phishing and ransomware. Those resources can provide a starting point, but adapt the discussion to the organization’s actual services. For a nonprofit, consider disruption to the system used to schedule services. For a district, consider an administrative outage while operational staff still need reliable communication. Avoid assuming that every technology interruption has the same consequence.

Bring people who can explain the handoffs

Invite a leadership decision maker, the relevant operational owner, IT support, and the person responsible for staff or public communication. Add finance, human resources, or other advisers when the objectives need them. Ask an external provider whether a representative can participate or supply a documented escalation process. A provider’s name in a contact list does not establish its response availability.

Name a facilitator who keeps the exercise moving and a note taker who records decisions, assumptions, and gaps. Give participants a short pre-read with objectives, scope, ground rules, and the fictional starting situation. Make clear that the exercise does not authorize changes to live systems or real messages to customers. Use simulated messages and contacts so participants can practice decisions without creating confusion.

Prepare a few useful scenario updates

An update, sometimes called an inject, should add information that changes a decision. The initial update might describe an unavailable application. A later update might say the usual provider cannot yet confirm a restoration time. Another might introduce conflicting information from a staff member. Ask what participants know, what they need to verify, who has authority, and what they would record.

Illustrative example: a nonprofit cannot access its service scheduling application on a busy morning. Participants discuss how to confirm the scope, contact the provider through an independent channel, and use an approved alternate scheduling process. A later update introduces an unverified social media claim. The discussion then tests who approves a factual response and how the team avoids presenting assumptions as established events.

Evaluate the process without scoring confidence

Ask participants to locate the relevant contact or procedure rather than saying that somebody probably has it. Record when the team cannot identify an owner or has conflicting assumptions about authority. Those observations are more useful than a general statement that everyone felt prepared. Distinguish demonstrated information from a proposed solution that still needs work after the exercise.

Keep discussion respectful and specific. If an action would interrupt a physical process, ask who evaluates the operational and safety implications before authorization. If participants would request outside help, ask how that relationship works and which information the adviser needs. Capture uncertainties for follow-up instead of inventing an answer to keep the story moving. A useful exercise can end with open questions.

Leave with a small improvement list

Close with the most important lessons while participants still remember the discussion. Turn each selected improvement into an action with an owner, a target date, and a verification method. Updating a contact tree should include checking that the contacts work. Revising authority should include communicating the decision to the people expected to act on it. Store the record where the response team can retrieve it.

Schedule a follow-up that checks the improvements, then choose whether another exercise should test a different handoff or revisit the same gap. Ongoing coordination may fit the fractional CISO service at Fractional CISO. The exercise record should describe what participants discussed and demonstrated, with clear limits. It should not claim that a discussion alone established recovery speed or proved that technical defenses will stop an attack.

Sources and further reading

• CISA: cybersecurity tabletop scenarios

This field note is general educational guidance. Your organization’s requirements, scope, and service arrangements determine the work that applies.