How do we…
How do we run a tabletop that tests decisions rather than rehearsing a script?
Add to board memoOpen the memo
The short answer
- Recommendation
- Keep the answers out of the room and make it decide for itself. The facilitator gives each inject at its minute, asks for a decision and who takes it, never says whether it is right, and the scribe records every prompt.
- Reasoning
- A tabletop becomes a rehearsed script when participants know what is coming, when the facilitator steers them to the answer, or when nobody records who decided what. Participants hear the objectives but never see the injects or what Met looks like. A wrong decision, or one taken by the wrong person, runs on uncorrected, because correcting it in the room hides the finding. The observers judge it afterwards from the log, and a prompted decision is rated at most Partly met.
- Considerations
- The timings are defaults in the CISO Times exercise pack: a 3-hour tabletop, a wait of 2 minutes before prompting, a 30-minute hot debrief, and more than 10 minutes behind as the point to drop an inject. Your own procedure may set different ones.
- Without approved objectives and an observer independent of the team, the exercise cannot be rated. Postponing is better than running it.
- The exercise tests the plan and the organisation, never the people. The decision log and observers' notes record roles, never names.
- A phase that overruns loses an inject, never the hot debrief. An objective the session never reaches is rated Not tested and carried forward.
The decision, step by step
Select any step for the reasoning behind it and where the pack covers it.
- Start
- Step
- Decision
- Outcome
- Loop back
Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.
Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.
Read as text
The same flow written out: each step, its reasoning and where the pack covers it. 16 steps.
Start
The objectives are approved and the injects are written
A tabletop becomes a rehearsed script when participants know what is coming, when the facilitator steers them to the answer, or when nobody records who decided what. The pack guards against each. The exercise tests the plan and the organisation, never the people in the room.
In the pack
- P10-A02 Tabletop Exercise Design MethodologyPrinciples
- P10-A02 Tabletop Exercise Design MethodologyLimitations
Step
Send the plan and the ground rules, never the injects
About 5 working days before, in the pack's default, send each participant the parts of the plan their role uses, the playbook for the scenario family, the ground rules and the times. Say which kind of incident it concerns only if the sponsor agrees. Never send the injects or the expected answers. The scenario pack stays in a folder only the facilitator and the scenario checker can open.
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureStep P6: pre-read (rule EX-06)
- P10-A03 Exercise Planning & Facilitation ProcedureOutputs and records produced
Decision
Are the objectives approved and an independent observer confirmed?
The day before, the exercise lead runs the final check. Without approved objectives the exercise cannot be rated. Without an observer independent of the team, nobody outside it judges the decisions. If the facilitator holds a role in the scenario, their deputy plays it or another facilitator runs the session.
- Yes: Pre-brief: objectives and decisions, never injects or answers
- No, or not known: Postpone, or have the sponsor approve a replacement observer
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureStep P7: final check, and the decision to go
- P10-A10 Exercise Logistics & Participant Readiness ChecklistChecklist
Outcome
Postpone, or have the sponsor approve a replacement observer
Postponing is better than running an exercise that cannot be rated. With no independent observer, the sponsor decides between postponing and a named replacement. If a postponement would take the audience past its interval, executive management decides whether to accept the delay with a date or find another slot.
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureEscalation
- P10-A03 Exercise Planning & Facilitation ProcedureStep P7: final check, and the decision to go
Step
Pre-brief: objectives and decisions, never injects or answers
The first 15 minutes: why this exercise, the objectives with the decision each tests, the ground rules read out in full, who is who, and the two clocks. The ground rules include no blame; play your own role with what you know at that moment; decide, because 'I would check the plan' is not an answer; accept the scenario. Agree a stop phrase that ends the exercise if a real incident needs someone.
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureThe pre-brief (rule EX-06)
- P10-A03 Exercise Planning & Facilitation ProcedureThe run of show
Step
Give each inject at its minute, read as written
The facilitator reads each inject at its minute on the timing card and states the scenario time when it jumps. Then asks for a decision and who takes it: 'so what do you do now, and who does it?' Questions about the scenario are answered from the facilitator's card. The facilitator never says whether a decision is right and takes no decisions.
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureThe facilitator's rules (rule EX-06)
- P10-A03 Exercise Planning & Facilitation ProcedureTimekeeping
Decision
Has the room decided, and named who takes the decision?
Discussion without a decision is not an answer. A decision says what is done and who does it. If the room is still on the previous decision when the next inject is due, the pack's default allows up to 5 more minutes, asks for the decision, then gives the new inject.
- Yes: Was the decision wrong, or taken by someone not entitled to it?
- No, or not clear: Climb the prompt ladder, one rung at a time
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureThe facilitator's rules
- P10-A03 Exercise Planning & Facilitation ProcedureTimekeeping
Step
Climb the prompt ladder, one rung at a time
Wait first, 2 minutes in the pack's default: silence is often thinking. Then restate the inject and the decision; ask the person whose role holds it; ask what the plan says; give the phase's spare inject; finally state the fact the scenario needs, note that the decision was not reached and move on. The scribe records every rung after the first, because a decision reached only after a prompt is rated at most Partly met.
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureWhen the room stalls: the prompt ladder
Decision
Was the decision wrong, or taken by someone not entitled to it?
The best findings often come from a decision taken by the wrong person, or a rule nobody remembered. A facilitator who corrects it in the room hides the finding. The facilitator's job here is to leave the judgement to the observers and the report.
- Yes, or not sure: Let the scenario run on the decision as taken
- No: The scribe logs the decision, who took it and any prompt
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureWhen the room goes off track
Step
Let the scenario run on the decision as taken
Do not correct it and do not say it was wrong. Let the scenario run on what the room decided, and let the scribe and observers record who decided. If it would end the exercise, ask 'who holds that decision under the plan?' If the room turns to blame, restate the no-blame rule and move to the next role.
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureWhen the room goes off track
- P10-A03 Exercise Planning & Facilitation ProcedureThe facilitator's rules
Step
The scribe logs the decision, who took it and any prompt
One line per decision: exercise time, scenario time, the inject, the decision in the words used, who took it, and whether a prompt came first. Observers write what happened as fact, with the time and the objective, without names or opinions, and note strengths as well as gaps. The log is the record every rating rests on.
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureThe scribe and the observers
Decision
Is the session more than 10 minutes behind the timing card?
The facilitator compares the clock with the timing card, and at the break decides what to do if the session is late. Rushing the last injects to cover everything produces ratings nobody can trust. Late, in the pack's default, means more than 10 minutes behind.
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureTimekeeping
- P10-A03 Exercise Planning & Facilitation ProcedureWhen the room goes off track
Step
Drop an inject whose objective another inject also tests
Choose it at the break, and tell the observers which one. A phase that overruns loses an inject, never the hot debrief. An objective the session never reaches is rated Not tested and carried to the next exercise. It is never counted as met.
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureTimekeeping
- P10-A02 Tabletop Exercise Design MethodologyThe evaluation scale
Decision
Are there injects left to give?
Keep going to the end of the last phase. If a phase finishes early, use its spare inject or a discussion question, and do not start the next phase early: the observers need the break. If a real incident needs anyone in the room, stop with the stop phrase; untested objectives are rated Not tested.
- Yes: Give each inject at its minute, read as written (back to an earlier step)
- No: Start the hot debrief on time, the same day
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureWhen the room goes off track
- P10-A03 Exercise Planning & Facilitation ProcedureThe three phases
Step
Start the hot debrief on time, the same day
In the pack's run of show it starts at +145 on the session clock, whatever has happened, and takes 30 minutes. Each participant gives one thing that worked and one to change; observers give a first view per objective on the evaluation scale; the facilitator reads back the likely findings. Nobody defends a decision. A gap that would break a legal clock or a decision right today goes to the sponsor the same day.
In the pack
- P10-A03 Exercise Planning & Facilitation ProcedureStage 3: the hot debrief (rule EX-08)
- P10-A03 Exercise Planning & Facilitation ProcedureAgree and close
Outcome
Rate each objective from the log, not from how the room felt
Observers rate against the approved success statement, in order. Not reached is Not tested. Wrong, not taken, or breaking a rule, a legal clock or a decision right is Not met. The right person, in time, without a prompt and in full is Met; anything less is Partly met. Where observers disagree, take the lower rating. The after-action report fixes the rating.
In the pack
- P10-A02 Tabletop Exercise Design MethodologyRating each objective
- P10-A02 Tabletop Exercise Design MethodologyPrinciples
Practical checklist
- Send the plan extracts, the playbook and the ground rules beforehand, and never the injects or expected answers.
- Confirm the day before that the objectives are approved and an independent observer is coming.
- Open with the pre-brief: the objectives and the decision each tests, the ground rules and a stop phrase.
- Give each inject at its minute and ask what the room does now and who does it.
- Climb the prompt ladder one rung at a time when the room stalls, and have the scribe log each prompt.
- Let wrong decisions, or decisions taken by the wrong person, run on without correction.
- Drop an inject whose objective another inject also tests when the session runs late.
- Hold the hot debrief the same day, then rate each objective from the log against its success statement.
Evidence to have ready
- The pre-read pack as sent, showing it held no injects or expected answers.
- The decision log: each decision in the words used, who took it, both clocks and any prompt.
- The observers' written notes, as fact with the exercise time, against each objective.
- The hot debrief notes and the after-action report with every objective rated.
- The go or postpone decision from the final check, including who approved any replacement observer.
Assumptions
- The objectives are approved and the scenario and injects are written. Choosing them is “How do we decide which decisions an incident exercise should test?”.
- The timings shown (a 3-hour tabletop, a 30-minute hot debrief, a wait of 2 minutes before prompting, 10 minutes behind as the trigger to drop an inject) are the defaults in the CISO Times exercise pack. Your own procedure may set different ones.
Not covered here
- Which decisions the exercise should test. That is “How do we decide which decisions an incident exercise should test?”.
- Who facilitates, observes and takes part. That is “Who should facilitate, observe and take part in an incident exercise?”.
- Fixing what the exercise finds. That is “If an exercise finds a gap, then how do we make sure it is fixed and stays fixed?”.