What Is a Tabletop Exercise?

Definition

A tabletop exercise is a guided discussion in which the people who would handle a real incident walk through a realistic scenario, such as ransomware or a hacked website, and talk through what they would do at each step. No systems are touched. The goal is to find gaps in the plan before an attacker does.

How It Works

NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, describes tabletop exercises as "discussion-based events" where personnel with roles in a plan discuss their responses to a particular emergency, guided by a facilitator toward predefined objectives. NIST says they typically last two to eight hours and calls them "cost-effective tools to validate the content of IT plans, such as contingency plans and incident response plans."

A small business tabletop usually follows this shape:

Set objectives: for example, "Can we reach our IT provider, insurer, and bank on a weekend?"
Pick a scenario: CISA's Tabletop Exercise Packages (CTEPs) offer over 100 ready-made packages, including ransomware, insider threats, and phishing, each with objectives, scenario text, and discussion questions.
Run it in stages: the facilitator adds new facts ("the backups are encrypted too") and asks who decides what.
Capture findings: NIST's guide includes a sample after action report; each gap gets an owner and a date.

Include the owner or manager, whoever handles IT, finance, and whoever talks to customers. Many gaps are business decisions, not technical ones.

Real-World Example

CISA's Cyber Storm IX, held in April 2024 with over 2,200 participants, was a larger, operations-based national exercise, and its after-action report records the kinds of gaps a tabletop surfaces. Some organizations "did not have set processes internally for who to contact, when to contact them, and what information is appropriate to share." Some found their primary communication method was inoperable during the incident and "did not have a secondary method on record." Many had trouble identifying external points of contact. The report also found single points of failure, including inexperienced staff at critical points such as the help desk and the absence of experienced decision makers.

Why It Matters for a Small Business

A small business can rarely afford to learn its incident plan during an incident. CISA's small business guidance tells owners to approve a written incident response plan in "peace time," noting that "there will be no time to digest and refine it during an incident," and to invoke the plan even for suspected false alarms, because near misses drive improvement. A two-hour tabletop costs staff time, not equipment, and it tests the parts small firms most often lack: an off-network contact list, a decision maker, and a known next call.

How to Spot It / How DTS Handles It

Signs you need one: your plan has never been read aloud, nobody knows who can authorize shutting systems down, contacts live only in email, and no one has asked "what if the backups are gone?"

DTS designs and facilitates tabletop exercises around your real systems and vendors, then delivers a short after-action report with owners and dates. Talk to our vCISO team, or see our incident response service.

Related Terms

Incident response plan: the document a tabletop tests.
Post-incident review: the same lessons-learned habit, after a real event.
NIST SP 800-61: the incident response guidance your scenarios can follow.
Incident response retainer: invite your retained responder to play.
Recovery time objective (RTO): tabletops test whether your RTOs are realistic.
Ransomware: one of the scenarios CISA's exercise packages cover.

Sources

NIST, SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities (2006): https://csrc.nist.gov/pubs/sp/800/84/final
CISA, CISA Tabletop Exercise Packages: https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages
CISA, Cyber Storm IX: National Cyber Exercise (After-Action Report): https://www.cisa.gov/resources-tools/resources/cyber-storm-ix
CISA, Cyber Guidance for Small Businesses: https://www.cisa.gov/cyber-guidance-small-businesses

Last updated October 14, 2026.