A tabletop exercise is a facilitated discussion in which people work through a simulated emergency to see how their plans, procedures, policies, agreements, and assigned responsibilities would guide a response. Participants talk through decisions rather than carrying out the response in an operational setting. The exercise can expose unclear steps and suggest improvements, but discussion alone does not prove that systems or capabilities will work under real conditions.
What is a tabletop exercise?
In the U.S. Department of Homeland Security’s Homeland Security Exercise and Evaluation Program (HSEEP) glossary, as reproduced by the National Initiative for Cybersecurity Careers and Studies (NICCS), a tabletop brings personnel together in a classroom or breakout groups and gives them a scenario to validate incident-management material: NICCS’s HSEEP glossary. FEMA likewise describes a tabletop as a discussion-based exercise used to build awareness, validate plans and procedures, rehearse concepts, and consider what systems are needed across prevention, protection, mitigation, response, and recovery: FEMA’s exercise training material.
In practical terms, a facilitator presents an emergency and asks participants to explain what they would do, who would make decisions, which plans or authorities apply, and how information would move. The group may identify what is clear and workable, as well as gaps, conflicting instructions, or questions that need follow-up.
What are the objectives of a tabletop exercise?
Set objectives before selecting a scenario. FEMA notes that objectives give exercise planners a framework for building the scenario and evaluating what participants learn. Depending on the need, a tabletop can:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
- Raise awareness of a hazard, threat, or incident type.
- Familiarize participants with plans, policies, agreements, and procedures—or help them develop these materials.
- Rehearse concepts and clarify decision-making authority, responsibilities, and communications.
- Identify strengths, capability gaps, resource needs, and steps that may need revision.
- Produce improvement recommendations that can be assigned and tracked after the session.
FEMA describes exercises as a low-risk, cost-effective environment for examining plans, policies, procedures, and capabilities. The useful output is not simply that a group completed a scenario; it is a clearer understanding of what works on paper, what remains uncertain, and what actions should follow. FEMA’s training material emphasizes active participant involvement and their assessment of recommended revisions.
What happens during a tabletop exercise?
A facilitator introduces a hypothetical incident and brings participants to a simulated point in time. They discuss the problems presented, consult relevant plans and procedures, and explain or record their decisions. A basic tabletop may keep the scenario constant while the facilitator poses questions. A more advanced exercise can add pre-scripted developments, known as injects, through messages, simulated calls, video, or other means. Participants discuss each development, and their decisions may influence what happens next.
After the discussion, organizers can review observations and feedback, then turn agreed recommendations into improvement actions. CISA’s cybersecurity exercise materials include participant feedback and after-action report templates to support this work: CISA’s Cybersecurity Tabletop Exercise Package materials.
Examples of tabletop exercise scenarios
The right scenario depends on the organization’s risks and the objectives, not on how dramatic the incident sounds. Official examples include:
- Emergency plan: Participants receive a hypothetical emergency and discuss facilitator-provided problems using their plans and procedures.
- Cyber incident: CISA scenario topics include ransomware, insider threats, phishing, and compromise of industrial control systems. Its scenario page was revised August 15, 2023: CISA cybersecurity scenarios.
- Election security: CISA’s Elections Cyber Tabletop Exercise Package provides template objectives, a scenario, discussion questions, and references for discussing threats to election infrastructure: CISA Elections Cyber Tabletop Exercise Package.
These are examples, not a universal scenario catalog. A useful exercise reflects the participants’ responsibilities and the decisions they may actually need to make.
How a tabletop differs from a drill or other exercise
FEMA groups seminars, workshops, tabletops, and games as discussion-based exercises, distinct from operations-based exercises. The main difference is what participants do and what the format is intended to produce:
| Exercise type | Participant activity | Main purpose or output |
|---|---|---|
| Seminar | Primarily receives an overview | Familiarity with authorities, strategies, plans, policies, procedures, and concepts |
| Workshop | Interacts and works toward a product | Develops or improves a concrete plan, procedure, agreement, or similar product |
| Tabletop | Discusses a simulated emergency | Explores decisions, concepts, plans, strengths, and improvements |
| Operations-based exercise | Performs or tests activities in an operational environment | Validates plans and capabilities, clarifies roles, and identifies resource gaps |
A tabletop is therefore not a drill: participants discuss a response rather than physically performing tasks. FEMA’s comparison of discussion- and operations-based formats is available in its exercise training material. If the goal is to see how a plan or capability performs in an operational setting, a discussion alone is not enough.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to start planning one
Begin with the decisions or plans you want participants to examine, then choose a scenario that makes those objectives relevant. CISA’s Cybersecurity Tabletop Exercise Package page lists a planner handbook, facilitator/evaluator handbook, invitation template, participant feedback template, exercise brief slide deck, planner feedback form, and after-action report template. That page was revised February 2, 2023: CISA package documents.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- The 2024 ERG guide helps satisfy 49 CFR 172.602 DOT requirement. This requirement states that hazmat shipments be accompanied by emergency response info.
- Pocketbook aids in emergency preparedness, planning, and training with ERGs numerically indexed and color-coded to help emergency responders find vital information fast.
- 2024 Updates: The Pipeline and Hazardous Materials Safety Administration (PHMSA) released a comprehensive summary of updates. Most significantly a QR code on the back cover that provides access to critical incident reporting information.
- Other changes for 2024 have been made to continue to provide the most accurate emergency response information to help all front-line persons and all first responders stay safe during transportation emergencies.
- Specifications: 4" x 5 1/2" Pocketbook Size, English, Spiralbound. Copyright 2024.
The CISA planner handbook’s recommended actions assume planning begins at least three months before the target exercise date. That is the handbook’s planning assumption, not a universal minimum; the appropriate lead time depends on the scope and coordination required. FEMA’s HSEEP materials also summarize exercise program management, design, conduct, evaluation, and improvement planning: FEMA HSEEP.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
