Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we run a tabletop that tests decisions rather than rehearsing a script?

5 decision pointsThe pack behind this answer: Cyber Incident Exercises & Tabletop Scenario Library

Add to board memo

The short answer

Recommendation
Keep the answers out of the room and make it decide for itself. The facilitator gives each inject at its minute, asks for a decision and who takes it, never says whether it is right, and the scribe records every prompt.
Reasoning
A tabletop becomes a rehearsed script when participants know what is coming, when the facilitator steers them to the answer, or when nobody records who decided what. Participants hear the objectives but never see the injects or what Met looks like. A wrong decision, or one taken by the wrong person, runs on uncorrected, because correcting it in the room hides the finding. The observers judge it afterwards from the log, and a prompted decision is rated at most Partly met.
Considerations
  • The timings are defaults in the CISO Times exercise pack: a 3-hour tabletop, a wait of 2 minutes before prompting, a 30-minute hot debrief, and more than 10 minutes behind as the point to drop an inject. Your own procedure may set different ones.
  • Without approved objectives and an observer independent of the team, the exercise cannot be rated. Postponing is better than running it.
  • The exercise tests the plan and the organisation, never the people. The decision log and observers' notes record roles, never names.
  • A phase that overruns loses an inject, never the hot debrief. An objective the session never reaches is rated Not tested and carried forward.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 16 steps.
  1. Start

    The objectives are approved and the injects are written

    A tabletop becomes a rehearsed script when participants know what is coming, when the facilitator steers them to the answer, or when nobody records who decided what. The pack guards against each. The exercise tests the plan and the organisation, never the people in the room.

    In the pack

  2. Step

    Send the plan and the ground rules, never the injects

    About 5 working days before, in the pack's default, send each participant the parts of the plan their role uses, the playbook for the scenario family, the ground rules and the times. Say which kind of incident it concerns only if the sponsor agrees. Never send the injects or the expected answers. The scenario pack stays in a folder only the facilitator and the scenario checker can open.

    In the pack

  3. Decision

    Are the objectives approved and an independent observer confirmed?

    The day before, the exercise lead runs the final check. Without approved objectives the exercise cannot be rated. Without an observer independent of the team, nobody outside it judges the decisions. If the facilitator holds a role in the scenario, their deputy plays it or another facilitator runs the session.

    In the pack

  4. Outcome

    Postpone, or have the sponsor approve a replacement observer

    Postponing is better than running an exercise that cannot be rated. With no independent observer, the sponsor decides between postponing and a named replacement. If a postponement would take the audience past its interval, executive management decides whether to accept the delay with a date or find another slot.

    In the pack

  5. Step

    Pre-brief: objectives and decisions, never injects or answers

    The first 15 minutes: why this exercise, the objectives with the decision each tests, the ground rules read out in full, who is who, and the two clocks. The ground rules include no blame; play your own role with what you know at that moment; decide, because 'I would check the plan' is not an answer; accept the scenario. Agree a stop phrase that ends the exercise if a real incident needs someone.

    In the pack

  6. Step

    Give each inject at its minute, read as written

    The facilitator reads each inject at its minute on the timing card and states the scenario time when it jumps. Then asks for a decision and who takes it: 'so what do you do now, and who does it?' Questions about the scenario are answered from the facilitator's card. The facilitator never says whether a decision is right and takes no decisions.

    In the pack

  7. Decision

    Has the room decided, and named who takes the decision?

    Discussion without a decision is not an answer. A decision says what is done and who does it. If the room is still on the previous decision when the next inject is due, the pack's default allows up to 5 more minutes, asks for the decision, then gives the new inject.

    In the pack

  8. Step

    Climb the prompt ladder, one rung at a time

    Wait first, 2 minutes in the pack's default: silence is often thinking. Then restate the inject and the decision; ask the person whose role holds it; ask what the plan says; give the phase's spare inject; finally state the fact the scenario needs, note that the decision was not reached and move on. The scribe records every rung after the first, because a decision reached only after a prompt is rated at most Partly met.

    In the pack

  9. Decision

    Was the decision wrong, or taken by someone not entitled to it?

    The best findings often come from a decision taken by the wrong person, or a rule nobody remembered. A facilitator who corrects it in the room hides the finding. The facilitator's job here is to leave the judgement to the observers and the report.

    In the pack

  10. Step

    Let the scenario run on the decision as taken

    Do not correct it and do not say it was wrong. Let the scenario run on what the room decided, and let the scribe and observers record who decided. If it would end the exercise, ask 'who holds that decision under the plan?' If the room turns to blame, restate the no-blame rule and move to the next role.

    In the pack

  11. Step

    The scribe logs the decision, who took it and any prompt

    One line per decision: exercise time, scenario time, the inject, the decision in the words used, who took it, and whether a prompt came first. Observers write what happened as fact, with the time and the objective, without names or opinions, and note strengths as well as gaps. The log is the record every rating rests on.

    In the pack

  12. Decision

    Is the session more than 10 minutes behind the timing card?

    The facilitator compares the clock with the timing card, and at the break decides what to do if the session is late. Rushing the last injects to cover everything produces ratings nobody can trust. Late, in the pack's default, means more than 10 minutes behind.

    In the pack

  13. Step

    Drop an inject whose objective another inject also tests

    Choose it at the break, and tell the observers which one. A phase that overruns loses an inject, never the hot debrief. An objective the session never reaches is rated Not tested and carried to the next exercise. It is never counted as met.

    In the pack

  14. Decision

    Are there injects left to give?

    Keep going to the end of the last phase. If a phase finishes early, use its spare inject or a discussion question, and do not start the next phase early: the observers need the break. If a real incident needs anyone in the room, stop with the stop phrase; untested objectives are rated Not tested.

    In the pack

  15. Step

    Start the hot debrief on time, the same day

    In the pack's run of show it starts at +145 on the session clock, whatever has happened, and takes 30 minutes. Each participant gives one thing that worked and one to change; observers give a first view per objective on the evaluation scale; the facilitator reads back the likely findings. Nobody defends a decision. A gap that would break a legal clock or a decision right today goes to the sponsor the same day.

    In the pack

  16. Outcome

    Rate each objective from the log, not from how the room felt

    Observers rate against the approved success statement, in order. Not reached is Not tested. Wrong, not taken, or breaking a rule, a legal clock or a decision right is Not met. The right person, in time, without a prompt and in full is Met; anything less is Partly met. Where observers disagree, take the lower rating. The after-action report fixes the rating.

    In the pack

Practical checklist

  1. Send the plan extracts, the playbook and the ground rules beforehand, and never the injects or expected answers.
  2. Confirm the day before that the objectives are approved and an independent observer is coming.
  3. Open with the pre-brief: the objectives and the decision each tests, the ground rules and a stop phrase.
  4. Give each inject at its minute and ask what the room does now and who does it.
  5. Climb the prompt ladder one rung at a time when the room stalls, and have the scribe log each prompt.
  6. Let wrong decisions, or decisions taken by the wrong person, run on without correction.
  7. Drop an inject whose objective another inject also tests when the session runs late.
  8. Hold the hot debrief the same day, then rate each objective from the log against its success statement.

Evidence to have ready

  • The pre-read pack as sent, showing it held no injects or expected answers.
  • The decision log: each decision in the words used, who took it, both clocks and any prompt.
  • The observers' written notes, as fact with the exercise time, against each objective.
  • The hot debrief notes and the after-action report with every objective rated.
  • The go or postpone decision from the final check, including who approved any replacement observer.

Assumptions

  • The objectives are approved and the scenario and injects are written. Choosing them is “How do we decide which decisions an incident exercise should test?”.
  • The timings shown (a 3-hour tabletop, a 30-minute hot debrief, a wait of 2 minutes before prompting, 10 minutes behind as the trigger to drop an inject) are the defaults in the CISO Times exercise pack. Your own procedure may set different ones.

Not covered here