Exercise Planning & Facilitation Procedure
Takes a facilitator from scoping through run-of-show, timekeeping and hot debrief without losing the learning.
Available soon
- Format
- Word
- Size
- 74 KB
- Length
- 25 pages
- Version
- 1.1
- Updated
What's inside
- Purpose
- Scope
- Roles
- Triggers and inputs
- Stage 1: planning
- Stage 2: running the session
- Stage 3: the hot debrief
- Stage 4: the hand-off
- Decision points
- Worked example: the payment fraud tabletop, 22 October 2026
- Outputs and records produced
- Timing targets
- Escalation
- Evidence retained
- Related documents
- Adapting this template
- Framework references
- Definitions
What changed
- 1.1
DORA Article 11(6) quoted in full: the yearly test covers ICT systems supporting all functions.
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
Purpose
This procedure takes the person who runs an exercise from the first scoping conversation to the hand-off of findings, without losing what the exercise showed. It is the working routine behind the Tabletop Exercise Design Methodology: the methodology sets the rules (EX-01 to EX-12), the audiences and the evaluation scale; this procedure says who does what, in which order and by when.
It covers four stages: planning the exercise, running the session to a fixed run of show, the hot debrief the same day, and the hand-off to the Exercise After-Action Report Template and the Exercise Observations & Improvement Tracker. Learning from an exercise is easily lost in the days after it, in notes nobody writes up and findings nobody owns. The hand-off stage exists to stop that.
Scope
This procedure applies to:
- every exercise in the programme approved under EX-01: tabletops (180 minutes), board sessions and drills;
- the six scenario decks in this pack (A04 to A09) and any scenario the organisation writes;
- everyone who plans, facilitates, observes or takes part, including suppliers who join an exercise that involves their service.
It does not cover how the programme is set or objectives are designed (the Tabletop Exercise Design Methodology), the room and people checklist in detail (the Exercise Logistics & Participant Readiness Checklist), how findings are rated and written up (the Exercise After-Action Report Template) or how actions are followed to closure (the Exercise Observations & Improvement Tracker). It hands over to each at the step named. A live incident is not an exercise, and this procedure never runs during one.
The run of show below is for a 3-hour tabletop. A board session (90 minutes) keeps the same parts, shortened; a drill (60 minutes) keeps the planning, the pre-brief, the hot debrief and the hand-off, and replaces the phases with the task done for real.
Roles
Role | What they do in this procedure |
|---|---|
Exercise sponsor [[e.g. Chief Operating Officer, usually the executive incident lead]] | Asks for the exercise. Approves the audience, the objectives and the date before the scenario is written (EX-04). Opens the session in person if they can. Approves the after-action report (EX-09) and gives time to the actions it agrees. |
Exercise lead [[e.g. Head of Information Security, who owns the programme]] | Owns the exercise from scoping to the tracker. Books the date and the people, runs the readiness checklist, drafts the after-action report and enters the actions in the tracker. |
Facilitator [[the exercise lead, or an outside facilitator; never a participant]] | Writes or adapts the scenario and injects to the approved objectives. Runs the pre-brief, gives the injects, keeps time and keeps the discussion on the objectives. Runs the hot debrief. Takes no decisions in the scenario (EX-06). |
Scribe [[e.g. a security analyst or an assistant]] | Keeps the decision log: each decision, who took it, the exercise time and the scenario time, and any prompt the facilitator gave. Does not join the discussion. |
Observers [[at least one independent of the team tested, e.g. Internal Audit]] | Watch and record against the objectives, in fact form, with the exercise time. Give a first view per objective at the hot debrief, and send written notes within the time EX-08 sets. At least one is independent of the team tested (EX-06). |
Scenario checker [[a subject expert who does not take part, e.g. the managed IT provider's lead]] | Checks the scenario and injects for realism before the day, and keeps them to themselves. Never takes part. |
Participants [[the role holders and deputies of the audience being exercised]] | Play their own real role and take the decisions that role would take, with what they know at that moment. Deputies play the role when the holder is away, or alongside them. |
Participants must not see the injects in advance. The facilitator must take no decisions in the scenario, and at least one observer must be independent of the team being tested (EX-06).
Guidance — delete before approval
The facilitator may be the exercise lead, as long as they are not also a participant. If the lead holds a role in the plan (often the Head of Information Security), their deputy plays that role for the day. That is also practice for the deputy (EX-07).
Choose an independent observer who can read a decision log: Internal Audit, a risk manager, or a peer from another organisation under a confidentiality agreement. Two observers are better than one for a tabletop of more than eight participants.
Triggers and inputs
What starts the procedure
Trigger | Basis | Starts at |
|---|---|---|
An exercise falls due in the approved programme | EX-01, EX-02 | Step P1, at least 40 working days before the date |
An audience will pass its interval before the next exercise in the programme | EX-02; audience table | Step P1, as soon as it is seen |
An improvement action is done and its objective needs a re-test within 6 months | EX-11 | Step P1, adding the re-test to the objectives |
A deputy or role holder has not taken part in an exercise for close to the EX-07 limit | EX-07 | Step P2: invite them to the next exercise |
A Severity 1 incident, a major change to the plan, or a new critical supplier | EX-12; P09 IM-12 | Step P1: consider an extra exercise on the changed part |
Inputs
Input | Where it comes from | Used at |
|---|---|---|
The approved exercise programme and the audience table | Tabletop Exercise Design Methodology | P1 |
Objective categories, inject rules and the evaluation scale | Tabletop Exercise Design Methodology | P1, P3, the hot debrief |
The top risks and recent incidents (EX-05) | [[Risk register]]; the incident case log | P1 |
Open findings and re-tests due | Exercise Observations & Improvement Tracker | P1 |
The six scenario decks | This pack, A04 to A09 | P3 |
The incident response plan, its contact list and the playbooks | Incident Response Plan and playbooks (P09) | P3, P6 (the pre-read) |
Room, people and materials checklist | Exercise Logistics & Participant Readiness Checklist | P5, P7 |
The after-action report template | Exercise After-Action Report Template | H2, H3 |
Stage 1: planning
The planning timeline counts in working days from the exercise day, day 0. The offsets are defaults; set your own, but keep the order, and keep the two after the day, which EX-08 and EX-09 set.
Step | When | Owner | Output |
|---|---|---|---|
P1 Scope, audience and objectives approved by the sponsor (EX-04) | 40 working days before | Exercise lead | Scoping note approved by the sponsor: audience, exercise type, date, three to six objectives, re-tests due |
P2 Invitations sent: date, length, ground rules; deputies invited too | 30 working days before | Exercise lead | Invitations, with acceptances and named deputies |
P3 Scenario and injects written to test the objectives | 25 working days before | Facilitator | Scenario pack: premise, injects with facilitator cards, spare injects, timing card |
P4 Scenario checked for realism by someone who will not take part | 15 working days before | Scenario checker | Scenario checker's comments, and the changes made |
P5 Logistics and readiness checklist complete (A10) | 5 working days before | Exercise lead | Readiness checklist complete, with any gaps and who closes them |
P6 Pre-read sent: the plan, the playbook, the ground rules. Never the injects | 5 working days before | Facilitator | Pre-read pack sent to participants |
P7 Final check: room, observers, materials, dial-in | 1 working day before | Exercise lead | Final check done; go or postpone decided |
Day Exercise and hot debrief (EX-08) | Exercise day | Facilitator | Decision log, observers' notes in draft, hot debrief notes |
H1 Observers' written notes in (EX-08) | 2 working days after | Observers | Observers' written notes |
H2 Draft after-action report to the sponsor | 7 working days after | Exercise lead | Draft after-action report |
H3 After-action report approved; actions entered in the tracker (EX-09, EX-10) | 10 working days after | Exercise sponsor | Approved after-action report; actions in the tracker |
Guidance — delete before approval
40 working days is about two months. That is the time it takes to get a date into the diaries of an executive team and to write and check a scenario. A drill for the technical team can be planned in half the time.
Step P1: scope, audience and objectives
Between three and six objectives must be set, and approved by the sponsor, before the scenario is written. The scenario is then written to test them (EX-04).
- Confirm with the sponsor which audience the exercise is for, from the audience table, and the kind of exercise that suits it.
- Pick the scenario family. It must come from a top risk in the risk register or a recent incident, and must not repeat the scenario this audience had last time (EX-05).
- Write three to six objectives. Each names a decision, who takes it and the rule or plan step it is judged against (EX-03). Use the objective categories so results compare year on year.
- Add every re-test due: an objective rated Partly met or Not met whose improvement action is done (EX-11). A re-test is written as the same decision, in the same category.
- Add any objective rated Not tested at the last exercise for this audience. It is carried forward and never counted as met.
- Agree the date, the length, and which suppliers take part. Get the sponsor's approval of all of it in writing before step P3 starts.
The objective categories are OC-01 detection and escalation, OC-02 containment decisions, OC-03 reporting duties, OC-04 communication, OC-05 recovery priorities, OC-06 decision rights and governance, OC-07 supplier coordination, OC-08 evidence and records. The Tabletop Exercise Design Methodology gives the question each one answers.
Guidance — delete before approval
A good objective: "The incident manager decides to isolate the affected systems within 30 minutes of declaration, without waiting for the executive (IM-08)." A weak one: "Participants understand the incident response plan." The first can be rated on the evaluation scale; the second cannot (EX-03).
Step P2: invitations
Invite the role holders and, separately, every deputy named in the plan for those roles. Say the date, the start and finish times, that phones are away, and that the session is no-blame. Ask each invitee to confirm, and to name who comes if they cannot.
Every role holder in the incident response plan, and every deputy, must take part in an exercise at least every [[24]] months (EX-07). Check the attendance record and invite first the deputies closest to that limit. Invite each supplier that has a part in the plan for this scenario: the contract asks it to take part (audience AU-05).
Step P3: scenario and injects
Start from the scenario deck for the chosen family and adapt it to the approved objectives. Write a new scenario only when no deck fits. Every inject has a type, and each type forces its own question.
Inject type | What it is | The question it forces |
|---|---|---|
Development | The incident grows or changes: more systems, more data, a new fact. | Does the severity, the scope or the plan change? |
Outside contact | A customer, journalist, regulator, supplier, bank or attacker gets in touch. | Who answers, and what do we say? |
Complication | Something the plan relies on fails: a backup, a person, a tool, a log. | What is our fallback? |
Pressure | Time, money or a senior person pushes for a shortcut. | Do we hold to the rule, and who decides? |
Deadline | A legal or contractual clock is running out. | Do we report now, with what we know? |
The rules for injects, which every scenario deck already follows:
- Every inject forces at least one decision. The facilitator's card names the decision, the expected good answer and the rule it is judged against.
- Every objective has at least one inject that tests it.
- No more than one inject every 10 to 15 minutes, so each gets a decision before the next arrives.
- Scenario time can jump (Day 2, 09:00) while the exercise clock runs on. Each inject states both.
- At most one Complication per phase: a scenario where everything fails tests nothing.
- Injects are never shown to participants in advance (EX-06). The facilitator may hold one spare inject per phase for a discussion that stalls.
For each inject the facilitator's card holds the text to read, the decision asked, the expected good answer, the rule it is judged against and the objective it tests. Add a timing card: every inject at its exercise minute and its scenario time. The worked example below shows one.
Step P4: scenario check
Give the scenario, the injects and the cards to the scenario checker: a subject expert who will not take part. Ask three questions. Could this happen to us, in this order? Is any inject impossible given how our systems or contracts work? Does any inject give away the answer? Record the comments and the changes. The checker keeps the scenario to themselves (EX-06).
Step P5: logistics and readiness
Work through the Exercise Logistics & Participant Readiness Checklist five working days before. It covers the room, the dial-in for remote participants and suppliers, the screen and printed injects, the wall clock, name cards by role, the decision log template, the observers' note forms, and the confirmed attendance with deputies. Every gap on the checklist has an owner and a date before day minus 1.
Step P6: pre-read
Send participants a short pre-read at the same time: the parts of the Incident Response Plan their roles use, the playbook for the scenario family, the ground rules, and the start and finish times. Say which kind of incident the exercise concerns only if the sponsor agrees; never send the injects or the objectives' expected answers (EX-06).
Step P7: final check, and the decision to go
The day before, the exercise lead checks the room, the observers, the materials and the dial-in. Then decides, with the sponsor if anything is missing:
Check | If yes | If no |
|---|---|---|
Has the sponsor approved the objectives (EX-04)? | Next check. | Postpone. An exercise without approved objectives cannot be rated. |
Is at least one observer independent of the team tested, and confirmed (EX-06)? | Next check. | Postpone, or find a replacement independent observer today. |
Is the facilitator free of any role in the scenario (EX-06)? | Next check. | Their deputy plays the role, or another facilitator runs the session. |
Is each role the objectives name covered by its holder or deputy? | Go. | Go if the deputy attends; that tests the deputy. If neither can come, drop or change the objective, with the sponsor's agreement. |
Guidance — delete before approval
Postponing is better than running an exercise that cannot be rated. If a postponement would take the audience past its interval under EX-02, tell executive management when the exercise will now happen.
Stage 2: running the session
The run of show
A tabletop runs for 3 hours. The start times are minutes from the start of the session. Put the clock times for your day on the timing card; the worked example shows them for a 09:30 start.
Part | Starts at | Minutes | What happens |
|---|---|---|---|
Pre-brief | +0 | 15 | Objectives, ground rules, roles and how the session runs. Participants hear the objectives, never the injects. |
Phase 1: first signs and the first hour | +15 | 40 | Detection, triage, declaration, first containment. |
Break | +55 | 10 | Facilitator and observers check timing and which objectives are still untested. |
Phase 2: escalation and the big decisions | +65 | 40 | Severity, reporting, decision rights, suppliers. |
Phase 3: recovery, reporting and communication | +105 | 40 | Restoring safely, outside communication, the days after. |
Hot debrief | +145 | 30 | Round the table, the observers' first view, and the likely findings read back. See Stage 3. |
Close | +175 | 5 | Thanks, what happens next and when the after-action report is due. |
The pre-brief
15 minutes, in this order:
- Welcome from the sponsor: why this exercise, and why now.
- The objectives, as the sponsor approved them, each with the decision it tests. Never the injects, and never what Met looks like: a room that knows the answer plays to it (EX-06).
- The ground rules, read out in full.
- Who is who: participants in their real roles, the facilitator, the scribe and the observers. Deputies say whose role they play.
- How it runs: three phases, a break, the hot debrief, and the finish time.
- The two clocks: the exercise clock on the wall, and scenario time, which will jump.
- The stop phrase, and what happens if a real incident needs someone.
The ground rules, read out in full
- No blame. The exercise tests the plan and the organisation, never the people in the room.
- Play your own role, and say what you would actually do with what you know at that moment.
- Decide. "I would check the plan" is not an answer: say what the plan tells you to do.
- Accept the scenario. It is realistic enough, and arguing with it uses up the time.
- Findings are reported without names. What people say in the room stays there.
- Phones away, unless the scenario asks you to make a call.
- Anyone may stop the exercise with the stop phrase, [[Real world, stop the exercise]], if a real incident or a real emergency needs them. The facilitator ends it at once.
The last rule is the stop phrase, [[Real world, stop the exercise]]. Ask everyone to agree to it before the first inject.
The three phases
Each of the three phases in the run of show covers one part of an incident, in 40 minutes. Injects fall inside a phase, and no phase has more than one Complication inject. Between phases 1 and 2 there is a 10-minute break, in which the facilitator and the observers check timing and which objectives are still untested.
The facilitator's rules
On top of EX-06 and the ground rules, the facilitator keeps these:
- Give each inject at its minute on the timing card, and read it out as written. State the scenario time each time it jumps.
- Ask for a decision, and name who takes it. Discussion without a decision is not an answer: ask "so what do you do now, and who does it?"
- Never say whether a decision is right. Observers and the after-action report judge; the facilitator only moves the scenario on.
- Answer questions about the scenario from the facilitator's card. If the card does not say, give the most likely answer and tell the scribe, so the decision log shows it.
- Record every prompt. A decision reached only after a prompt is rated at most Partly met, so the scribe notes each one.
- Protect the hot debrief. A phase that overruns loses an inject, never the debrief (EX-08).
- Stop at once if a real incident needs any of the people in the room, and say so with the stop phrase, [[Real world, stop the exercise]].
The scribe and the observers
The scribe keeps one line per decision in the decision log: the exercise time, the scenario time, the inject, the decision in the words used, who took it, and whether a prompt came first. The log is the record every rating rests on.
Observers write observations as fact: what happened, the exercise time, the inject and the objective. No opinions and no names. They note strengths as well as gaps. At the break they tell the facilitator which objectives have not yet been reached, so the facilitator can protect the injects that test them.
Timekeeping
Two clocks run at once, and the facilitator keeps both.
- Scenario time can jump (Day 2, 09:00) while the exercise clock runs on. Each inject states both.
- No more than one inject every 10 to 15 minutes, so each gets a decision before the next arrives.
- Give each inject at its minute. If the room is still on the previous decision, allow up to [[5]] minutes, ask for the decision, and give the new inject.
- At the break, compare the clock with the timing card. If the session is more than [[10]] minutes behind, choose now which inject to drop in phase 2 or 3: one whose objective another inject also tests.
- Start the hot debrief at +145 whatever has happened. A phase that runs over loses an inject, never the debrief (EX-08).
- Finish at +180. The close takes 5 minutes: thanks, what happens next and when the after-action report is due.
Guidance — delete before approval
The evaluation scale covers an objective the session never reached. Not tested means: “The exercise did not reach the decision: time ran out or the discussion went another way. Carried to the next exercise, and never counted as met.” Rushing the last injects to "cover everything" produces ratings no one can trust.
When the room stalls: the prompt ladder
Climb one rung at a time. Tell the scribe each rung used after the first, because a decision reached only after a prompt is rated at most Partly met.
Rung | What the facilitator does |
|---|---|
1. Wait | Give the room [[2]] minutes of silence or discussion before stepping in. Silence is often thinking. |
2. Restate | Read the inject and the decision again: "The question is: isolate now, or investigate first?" |
3. Name the role | Ask the person whose role holds the decision: "Incident manager, what do you do now?" |
4. Point to the plan | Ask what the plan says for this step. "I would check the plan" is not an answer (ground rules). |
5. Spare inject | Give the phase's spare inject, which pushes the same decision from another side. Each phase may hold one. |
6. Move on | State the fact the scenario needs, note that the decision was not reached, and give the next inject. The objective is rated on what happened. |
When the room goes off track
What the facilitator sees | What the facilitator does |
|---|---|
The room argues that the scenario could not happen here | Read the ground rule on accepting the scenario, and give one fact that makes it plausible. If it goes on, note it for the hot debrief and move on. |
The discussion goes deep into technical detail | Park it on the flip chart for the after-action report and bring the room back to the decision the inject asks for. |
One person answers for everyone | Ask named roles in turn, starting with the most junior. Thank the dominant speaker and ask them to hold their view until the others have spoken. |
A participant asks the facilitator what to do | Turn it back: "What would you do if I were not here?" The facilitator takes no decisions (EX-06). |
A senior person takes a decision that belongs to someone else | Do not correct it in the room. Let the scenario run on it; the scribe and the observers record who decided. If it would end the exercise, ask "who holds that decision under the plan?" |
The room turns to blame, or someone goes quiet after a mistake | Restate the no-blame rule, and say the exercise tests the plan. Move to the next role. |
The room is running more than [[10]] minutes behind the timing card | Drop the lowest-value inject left in the phase: one whose objective another inject also tests. Tell the observers which one. |
The room finishes a phase early | Use the spare inject, or ask one of the scenario's discussion questions. Do not start the next phase early: the observers need the break. |
A key participant is called away | Their deputy takes the role, which is useful practice. Tell the scribe the time of the handover. |
A real incident, or a real business emergency, needs people in the room | Stop with the stop phrase, [[Real world, stop the exercise]]. The real work comes first. Record where the exercise stopped; untested objectives are rated Not tested and carried to the next exercise. |
Guidance — delete before approval
The best findings often come from a decision taken by the wrong person or a rule nobody remembered. A facilitator who corrects it in the room hides the finding. Let the scenario run on the decision as taken, and leave the judgement to the observers and the report.
Stage 3: the hot debrief
A hot debrief must be held the same day, before participants leave. Observers' written notes must follow within [[2]] working days (EX-08). It takes 30 minutes, in this order:
Step | Minutes | What happens |
|---|---|---|
Round the table | 10 | Each participant: one thing that worked, and one thing to change. |
Observers | 10 | A first view per objective, on the evaluation scale, with the facts behind it. |
Agree and close | 10 | The facilitator reads back the likely findings and the date of the after-action report. |
The observers give their first view on the evaluation scale. It is a first view: the report sets the final rating.
Rating | What it means |
|---|---|
Met | The right person took the decision the rule requires, within its time and for sound reasons, without a prompt from the facilitator. |
Partly met | The decision was right in substance but late, taken by the wrong person, or reached only after a prompt; or part of it was missed. |
Not met | The decision was wrong or not taken, or would have broken a rule, a legal clock or a decision right. |
Not tested | The exercise did not reach the decision: time ran out or the discussion went another way. Carried to the next exercise, and never counted as met. |
Running the round the table
- Go round in seating order, so no one chooses to stay silent. Each person gives one thing that worked and one thing to change, in a sentence each.
- The facilitator writes each point on the flip chart without discussion. Questions of fact only.
- Nobody defends a decision. If a point concerns a decision someone took, the facilitator thanks them and moves on (no blame).
Agree and close
The facilitator reads back the likely findings, each linked to an objective, and asks whether anyone saw it differently. Then the facilitator says what happens next: observers' notes within 2 working days, the after-action report to the sponsor for approval within 10 working days, and actions in the tracker once it is approved. The scribe photographs the flip chart and files it with the decision log.
Guidance — delete before approval
If the hot debrief shows a gap that would break a legal clock or a decision right in a real incident today, the exercise lead tells the sponsor the same day. It does not wait for the report: a High finding runs 30 days from the report's approval, but the sponsor may act sooner.
Stage 4: the hand-off
Step H1: observers' notes, within 2 working days
Each observer sends written notes to the exercise lead, one line per observation, in the tracker's first columns so nothing is retyped: observation ID (OB-nn, unique within the exercise); exercise (EX-YYYY-nn); objective (the objective it concerns, or "General"); inject (the inject that brought it out, if any); observer (role, not name); what happened (fact, with the exercise time, No opinion, no names); strength or gap (strength, or Gap).
The exercise lead merges the notes with the decision log and the flip chart, and removes duplicates. Where two observers disagree on a fact, the decision log settles it.
Step H2: the draft after-action report
The exercise lead drafts the Exercise After-Action Report Template within 7 working days. It rates every objective on the evaluation scale, states what held and what failed, turns each gap that needs a change into a finding, and proposes an improvement action for each: one owner, a due date set by its priority, and the document or control it changes (EX-10).
Priority | When it applies | Due, from the report's approval |
|---|---|---|
High | An objective Not met; or a gap that would break a legal clock, a decision right or a Severity 1 or 2 step | 30 calendar days |
Medium | An objective Partly met; or a gap that would slow the response | 90 calendar days |
Low | An improvement that would make the response easier | 180 calendar days |
Step H3: approval and the tracker, within 10 working days
The after-action report must be approved by the sponsor within [[10]] working days of the exercise, with every objective rated on the evaluation scale (EX-09). Once it is approved, the exercise lead enters every observation and every action in the Exercise Observations & Improvement Tracker the same day, with the statuses below.
Status | Meaning |
|---|---|
Open | Agreed, not started. |
In progress | Work started; due date unchanged. |
Done | The change is made. Where its objective was Partly met or Not met, it waits for its re-test (EX-11). |
Closed | Done, and re-tested where EX-11 requires it. |
Withdrawn | Dropped, with the sponsor's recorded reason. |
An objective rated Partly met or Not met must be re-tested within [[6]] months of its improvement action being done, and its finding stays open until then. A live incident can serve as the re-test when its post-incident review rates the same decision (EX-11). Put the re-test on the programme when the action is marked Done, not when it is agreed.
The plan and the playbooks an exercise tested must be reviewed after it. The exercise measures are reported to executive management every quarter, with the incident measures (P09 IM-12) (EX-12). Send the owners of the plan and of each playbook tested the findings that concern their documents.
Guidance — delete before approval
Results are compared by objective category and audience, as counts: Met, Partly met and Not met out of the objectives tested. Not tested is shown on its own line and never counted as met. A category rated Not met at two exercises in a row for the same audience is reported to executive management as a finding in its own right.
Decision points
The decisions this procedure asks for, in the order they come.
Stage | Decision | Who decides | Rule |
|---|---|---|---|
P1 | Audience, exercise type, scenario family, objectives, re-tests and date | Exercise sponsor | EX-03, EX-04, EX-05, EX-11 |
P3 | Which injects test which objective, and which are spare | Facilitator | Inject rules |
P4 | Whether the scenario is realistic enough, and what changes | Facilitator, on the scenario checker's advice | EX-05 |
P7 | Go, or postpone | Exercise lead; the exercise sponsor if a check fails | EX-04, EX-06 |
Stage 2 | Which inject to drop when behind | Facilitator | EX-08 |
Stage 2 | Whether to stop for a real incident | Anyone may call it; the facilitator stops | — |
Stage 3 | The likely findings read back | Facilitator, with the observers | EX-08 |
H2 | Each objective's rating and each finding's priority | Exercise lead, on the observers' notes | EX-09, EX-10 |
H3 | Approval of the report and its actions | Exercise sponsor | EX-09, EX-10 |
After H3 | Whether an action is Withdrawn | Exercise sponsor | EX-10 |
Worked example: the payment fraud tabletop, 22 October 2026
EXAMPLE, not part of the procedure. The organisation is the one used throughout the pack: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its exercise EX-2026-03 is a tabletop on Thursday 22 Oct 2026, on scenario SC-05, executive payment fraud (the Tabletop Scenario — Executive Payment Fraud). The plan is shown as at 30 Sep 2026. Replace every date and name with your own.
Why this exercise, and why now
R-02: payment fraud is outside appetite, and INC-2026-015 was a €84,000 near miss. Held before the peak season. (EXAMPLE)
- The executive exercise moved to payment fraud (SC-05): ransomware was exercised in March and handled for real in August, while payment fraud is outside appetite.
- The live incident did not reset the exercise clock. The incident response team and the technical responders are past their six-month interval, and both are exercised in October.
Audiences: executive management and the crisis team (AU-02) and incident response team (AU-03). Supplier taking part: Email and office software provider (SUP-005), which suspends accounts, removes mail rules and supplies mailbox audit logs. (EXAMPLE)
Who does what
Role | EXAMPLE |
|---|---|
Exercise sponsor | Chief Operating Officer (executive incident lead) |
Exercise lead | Head of Information Security |
Facilitator | Head of Information Security; their own role was played by their deputy |
Scribe | Security analyst |
Observers | Internal Audit Manager (independent) Credit Control Manager (Finance, outside the payment chain) |
Scenario checker | The bank's fraud relationship manager, who does not take part |
Participants | Chief Operating Officer (executive incident lead) Information Security Manager (incident manager) Deputy incident manager The two deputies named in the plan who had not yet taken part (EA-06) Financial Controller (finance lead), with the Accounts Payable team leader Data Protection Officer Legal counsel Head of Marketing and Communications Head of IT Email and office software provider (SUP-005) |
Room | Head office board room, with a dial-in for the email provider |
The planning dates
Each date is the default offset counted in working days from 22 Oct 2026. The scope was set on 27 Aug 2026, the day of the review of the August ransomware incident (INC-2026-014), which moved the executive exercise to payment fraud. As at 30 Sep 2026, 4 steps are still ahead before the day. (EXAMPLE)
Step | Date | Owner |
|---|---|---|
Scope, audience and objectives approved by the sponsor (EX-04) | 27 Aug 2026 | Exercise lead |
Invitations sent: date, length, ground rules; deputies invited too | 10 Sep 2026 | Exercise lead |
Scenario and injects written to test the objectives | 17 Sep 2026 | Facilitator |
Scenario checked for realism by someone who will not take part | 1 Oct 2026 | Scenario checker |
Logistics and readiness checklist complete (A10) | 15 Oct 2026 | Exercise lead |
Pre-read sent: the plan, the playbook, the ground rules. Never the injects | 15 Oct 2026 | Facilitator |
Final check: room, observers, materials, dial-in | 21 Oct 2026 | Exercise lead |
Exercise and hot debrief (EX-08) | 22 Oct 2026 | Facilitator |
Observers' written notes in (EX-08) | 26 Oct 2026 | Observers |
Draft after-action report to the sponsor | 2 Nov 2026 | Exercise lead |
After-action report approved; actions entered in the tracker (EX-09, EX-10) | 5 Nov 2026 | Exercise sponsor |
The objectives
Six objectives, the most EX-04 allows, each taken unchanged from the scenario deck. (EXAMPLE)
Objective | Category | Success looks like |
|---|---|---|
O1 Recall the money fast | OC-02 Containment decisions | The finance lead calls the bank's fraud team [[within 1 hour]] of finding the payment, and asks for a recall. |
O2 Declare and escalate | OC-01 Detection and escalation | Declared as business email compromise and payment fraud (IC-03), with severity set on the money at stake (Severity 2: loss likely between [[€250,000]] and [[€1,000,000]]), and the executive incident lead told within 2 hours (IM-04, IM-05). |
O3 Keep the evidence | OC-08 Evidence and records | The email is kept with its headers and never forwarded, and the mailbox audit log is checked within [[2 hours]] to see whether our own mailbox was taken over (IM-07). |
O4 Make the reports | OC-03 Reporting duties | The crime is reported (RD-16) and the insurer told, as money was lost (RD-15). Personal data is screened if a mailbox was taken over (IM-06). |
O5 Fix the control, blame nobody | OC-06 Decision rights and governance | The team finds which finance check failed and decides the change needed at once, and treats the clerk's report as made in good faith (IM-01). |
O6 Handle the reputational side | OC-04 Communication | The communications lead prepares the media holding statement, approved within [[60]] minutes of the first press call. Nobody else speaks outside (IM-09). |
Re-test (EX-11). In March, SC-01 objective O6, “speak with one voice”, was rated Partly met. Its action EA-05, “pre-approve the customer notice and the media holding statement, with blanks for the facts”, was done on 12 Jun 2026. Not tested in August: no customer service was affected. Re-tested in two parts: the customer notice (CT-04) at EX-2026-02 on 6 Oct 2026, and the media holding statement (CT-09) at EX-2026-03 on 22 Oct 2026. Closed only when both are Met. So SC-05 objective O6, in the same category (OC-04 Communication), is the part of the re-test for the media holding statement (CT-09). Every part falls within 6 months of the action being done, by 12 Dec 2026. (EXAMPLE)
Deputies (EX-07). EA-06, “bring every deputy named in the plan into an exercise”, is open and was due on 27 Sep 2026. The two deputies are invited to EX-2026-03 on 22 Oct. When they take part, the exercise lead marks it done. (EXAMPLE)
The timing card
Start 09:30, finish 12:30. Scenario time begins on Day 4, the Monday after the Friday payment. (EXAMPLE)
Clock | Part | Scenario time | Inject | Tests |
|---|---|---|---|---|
09:30 | Pre-brief | — | Objectives, ground rules, roles | — |
09:45 | Phase 1 | Day 4, 08:30 | I1 (Development) Monday 08:30. The chief executive, back from travel, asks Finance about a €[[310,000]] payment made on Friday at 17:05 on "their" instruction. They sent no such email. | O1 Recall the money fast |
10:00 | Phase 1 | Day 4, 08:50 | I2 (Development) The incident manager joins the call. | O2 Declare and escalate |
10:15 | Phase 1 | Day 4, 09:30 | I3 (Complication) The bank says most of the money has already moved to a second bank abroad. It will try, but cannot promise. | O4 Make the reports |
10:25 | Break | — | Check timing and the objectives still untested | — |
10:35 | Phase 2 | Day 4, 10:30 | I4 (Development) IT finds the email came from our real mailbox: the chief executive's account had a sign-in from abroad on Thursday, and a rule hiding replies. | O3 Keep the evidence |
10:50 | Phase 2 | Day 4, 12:00 | I5 (Pressure) The insurer asks whether the call-back check in its policy conditions was followed. It was not: the clerk thought the chief executive's email was enough. | O5 Fix the control, blame nobody |
11:05 | Phase 2 | Day 4, 15:00 | I6 (Pressure) The board chair asks who is to blame, and whether the clerk should be dismissed. | O5 Fix the control, blame nobody |
11:20 | Phase 3 | Day 5, 09:00 | I7 (Outside contact) A trade journalist asks whether it is true that the company "lost hundreds of thousands to email fraud". | O6 Handle the reputational side |
11:35 | Phase 3 | Day 11, 10:00 | I8 (Development) The bank recovers €[[95,000]]. The rest is lost. | O5 Fix the control, blame nobody |
11:55 | Hot debrief | — | Round the table (10); Observers (10); Agree and close (10) | All |
12:25 | Close | — | Report due 5 Nov 2026 | — |
At the break (10:25) the observers expect 3 objectives to have been reached. Still to come: O3 keep the evidence; O5 fix the control, blame nobody; O6 handle the reputational side. If the session is behind, the facilitator protects the injects that test these, and above all O6, the re-test. (EXAMPLE)
After the day
What | Due | Rule |
|---|---|---|
Hot debrief | 22 Oct 2026, 11:55 | EX-08 |
Observers' written notes | 26 Oct 2026 | EX-08 |
Draft report to the sponsor | 2 Nov 2026 | — |
Report approved; actions in the tracker | 5 Nov 2026 | EX-09, EX-10 |
High actions due, if approved on 5 Nov 2026 | 5 Dec 2026 | EX-10 |
Medium actions due, if approved on 5 Nov 2026 | 3 Feb 2027 | EX-10 |
Low actions due, if approved on 5 Nov 2026 | 4 May 2027 | EX-10 |
The report falls due in the peak season (November and December). The exercise is held before it, and the exercise sponsor blocks an hour in the week of 5 Nov 2026 to approve the report. (EXAMPLE)
Guidance — delete before approval
How the March exercise (EX-2026-01) met the same hand-off: hot debrief the same day, observers' notes on 20 Mar 2026 (2 working days), report approved on 31 Mar 2026 (9 working days). (EXAMPLE)
The drill on 6 Oct 2026 (EX-2026-02) follows the same four stages on a smaller scale: 60 minutes, done for real, re-testing EA-03, “give the monitoring provider's out-of-hours analysts a direct route to the incident manager or their deputy”; and EA-05, where the executive incident lead approves the customer notice (CT-04) from its pre-approved text within [[60]] minutes of the incident manager asking (SC-01 O6's target). (EXAMPLE)
Outputs and records produced
Output | Produced at | Held in |
|---|---|---|
Scoping note with approved objectives and re-tests | P1 | [[Exercise programme folder]] |
Invitations and confirmed attendance, with deputies | P2 | [[Exercise programme folder]] |
Scenario pack: premise, injects, facilitator cards, spare injects, timing card | P3 | [[Restricted folder, facilitator and checker only]] |
Scenario checker's comments and the changes made | P4 | With the scenario pack |
Readiness checklist | P5 | Exercise Logistics & Participant Readiness Checklist |
Pre-read pack | P6 | [[Exercise programme folder]] |
Go or postpone decision | P7 | Scoping note |
Decision log, prompts marked | Stage 2 | [[Exercise programme folder]] |
Hot debrief notes and the flip chart | Stage 3 | [[Exercise programme folder]] |
Observers' notes | H1 | Exercise Observations & Improvement Tracker |
After-action report, approved | H2, H3 | Exercise After-Action Report Template |
Observations and actions | H3 | Exercise Observations & Improvement Tracker |
Timing targets
Activity | Target | Basis |
|---|---|---|
Scope, audience and objectives approved by the sponsor | 40 working days before | EX-04 |
Exercise and hot debrief | Exercise day | EX-08 |
Observers' written notes in | 2 working days after | EX-08 |
After-action report approved; actions entered in the tracker | 10 working days after | EX-09, EX-10 |
Every other planning step | As the Stage 1 table sets | This procedure |
Pre-brief | 15 minutes | Run of show |
Each phase | 40 minutes | Run of show |
Injects | No more than one every 10 to 15 minutes | Inject rules |
Hot debrief | 30 minutes, the same day, before participants leave | EX-08 |
Whole tabletop | 3 hours | Run of show |
High finding: action done | Within 30 days of the report's approval | EX-10 |
Medium finding: action done | Within 90 days of the report's approval | EX-10 |
Low finding: action done | Within 180 days of the report's approval | EX-10 |
Re-test of a Partly met or Not met objective | Within 6 months of its action being done | EX-11 |
Every role holder and deputy exercised | At least every [[24]] months | EX-07 |
Exercise: board, or its equivalent | At least every 24 months | EX-02 |
Exercise: executive management and the crisis team | At least every 12 months | EX-02 |
Exercise: incident response team | At least every 6 months | EX-02 |
Exercise: technical responders | At least every 6 months | EX-02 |
Exercise: critical suppliers with a part in the plan | At least every 12 months | EX-02 |
Escalation
When something in this procedure slips, it goes to the person below. Record each escalation in the scoping note or the tracker.
When | Goes to | What they decide |
|---|---|---|
The sponsor has not approved the objectives [[5]] working days after step P1 was due | Executive management | A new date, or a new sponsor |
A postponement would take an audience past its interval (EX-02) | Executive management | Accept the delay with a date, or find another slot |
No independent observer is confirmed at step P7 (EX-06) | Exercise sponsor | Postpone, or approve a named replacement |
Observers' notes are late (EX-08) | Exercise lead | Chase; the report is still due on time, from the decision log |
The report is not approved within the EX-09 limit | Executive management | Reported with the quarterly exercise measures (EX-12) |
A High finding that would break a legal clock or a decision right today | Exercise sponsor | Act the same day, before the report |
An action passes its due date | The action's owner, then the exercise sponsor | A recovery date, or withdrawal with a reason |
A category Not met at two exercises in a row for the same audience | Executive management | A finding in its own right (comparison rule) |
Evidence retained
Keep these for each exercise for [[3 years, or as long as your retention schedule sets]]. An auditor asking how the plan is tested (P09 IM-12) will ask for them.
Record | What it shows |
|---|---|
Scoping note with the sponsor's approval of the objectives | Shows the objectives came first (EX-04) |
Invitations and the attendance list, by role, with deputies marked | Shows each audience and each deputy was exercised (EX-02, EX-07) |
The scenario pack as used: premise, injects, facilitator cards, spare injects, version | Lets the next exercise avoid the same scenario (EX-05) and re-test the same decisions (EX-11) |
Scenario checker's comments | Shows the scenario was checked by someone who did not take part |
Decision log kept by the scribe, with prompts marked | The facts each rating rests on |
Observers' written notes | The observations behind every finding (EX-08) |
Hot debrief notes: round-the-table points and the likely findings read back | Shows the debrief was held the same day (EX-08) |
Approved after-action report | Every objective rated, actions agreed, sponsor's approval (EX-09) |
Tracker entries for every observation and action | Actions owned, dated and followed to closure (EX-10, EX-11) |
Guidance — delete before approval
The decision log and the observers' notes record roles, never names (ground rules). Keep the attendance list separately, with names, for EX-07.
Related documents
Document | Relationship |
|---|---|
Tabletop Exercise Design Methodology | The rules this procedure runs (EX-01 to EX-12), the audience table, objective categories, inject rules and the evaluation scale |
Tabletop Scenario — Ransomware Encryption of Core Systems Tabletop Scenario — Critical Supplier Outage Tabletop Scenario — Insider Data Exfiltration Tabletop Scenario — Cloud Tenant Account Takeover Tabletop Scenario — Executive Payment Fraud Tabletop Scenario — Personal Data Breach Against the Clock | Ready scenarios, injects and facilitator notes for step P3 |
Exercise Logistics & Participant Readiness Checklist | The room, people and materials checklist for steps P5 and P7 |
Exercise Observations & Improvement Tracker | Where observations and actions are held and followed to closure (H1, H3) |
Exercise After-Action Report Template | The report written and approved at H2 and H3 |
Incident Response Plan (P09) | The plan every exercise tests; its contact list and deputies feed step P2 |
Post-Incident Review Template (P09) | A live incident's review, which can serve as a re-test (EX-11) |
Adapting this template
Guidance — delete before approval
Small organisation: the exercise lead, the facilitator and the scribe may be one person, with an outside observer. Keep the approved objectives, the independent observer, the hot debrief and the report within 10 working days: they are what shows an auditor the plan was tested. A shorter tabletop with two phases, 140 minutes in all, is enough for a first exercise.
Regulated entity (NIS2, DORA): the NIS2 implementing regulation expects incident response procedures and crisis management plans to be tested at planned intervals and updated after significant incidents; keep the programme approval (EX-01) and the evidence list as the record. A DORA financial entity tests its ICT business continuity and response and recovery plans at least yearly, and its crisis communication plans; include a cyber-attack scenario, and feed findings into the plan reviews.
IT run by a service provider: invite the provider to every exercise that relies on it, and put taking part into the contract. Its staff may observe, but never as the only observer or as the independent one. When the exercise tests the provider's own service, its staff take part as participants instead. The objectives stay yours.
Remote or hybrid sessions: give injects on screen and in the chat at the same time, keep cameras on, and add a second scribe for the chat. Allow 10 more minutes in the run of show.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR).
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 5.24 — Information security incident management planning and preparation | The whole procedure: planning and testing the incident response |
ISO/IEC 27001:2022 | Annex A 5.27 — Learning from information security incidents | Stage 4: findings and actions from the exercise |
ISO/IEC 27001:2022 | Clause 7.2 — Competence | Step P2: every role holder and deputy exercised (EX-07) |
NIST CSF 2.0 | ID.IM-02 — “Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties” | Stages 3 and 4: improvements identified from exercises, with suppliers |
NIST CSF 2.0 | ID.IM-04 — “Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved” | Stage 4: the plan reviewed after the exercise (EX-12) |
NIST CSF 2.0 | PR.AT-02 — “Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind” | Participants practise their own roles |
NIST CSF 2.0 | GV.SC-08 — “Relevant suppliers and other third parties are included in incident planning, response, and recovery activities” | Step P2: suppliers invited to exercises that involve them |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(b) — the cybersecurity risk-management measures include “incident handling” | The procedure as a whole: incident handling rehearsed |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 3.5.5 — “The relevant entities shall test at planned intervals their incident response procedures.” | The planning timeline: incident response tested at planned intervals |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.3.4 — test, review and, where appropriate, update the crisis management plan on a regular basis or following significant incidents or significant changes to operations or risks | Stage 4: the crisis plan tested and updated from findings |
DORA — Regulation (EU) 2022/2554 | Article 11(6) — test the ICT business continuity plans and the ICT response and recovery plans “in relation to ICT systems supporting all functions at least yearly, as well as in the event of any substantive changes to ICT systems supporting critical or important functions”, and test the crisis communication plans (Article 14); financial entities other than microenterprises include in the testing plans “scenarios of cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups and redundant facilities”; the policy and plans are regularly reviewed taking into account test results and recommendations from audit checks or supervisory reviews | Adapting this template: yearly tests, cyber-attack scenarios, plans reviewed on results |
Definitions
Term | Meaning in this procedure |
|---|---|
After-action report | The written report of an exercise: what was tested, the result for each objective, what held, what failed and the improvement actions agreed. Approved by the sponsor. |
Decision log | The scribe's record of each decision in the exercise: exercise time, scenario time, the decision, who took it and any prompt. |
Drill | A short exercise of one part of the plan, done for real: calling the out-of-hours numbers, isolating a site, or restoring a system from backup. |
Exercise | A planned rehearsal of the incident response plan on a made-up incident: a discussion of a scenario, a test of one part (a restore, a call tree), or a full simulation. A live incident is not an exercise. |
Exercise clock | Minutes from the start of the session. The run of show and the timing card use it. |
Facilitator | The person who runs the exercise. Gives the injects, keeps time and keeps the discussion on the objectives. Takes no decisions in the scenario. |
Finding | An observation, or several, confirmed at the hot debrief or in the after-action report as a gap that needs a change. |
Hot debrief | A short, structured discussion held straight after the exercise, the same day, while memories are fresh. |
Improvement action | The change that closes a finding, with one owner, a due date and the document or control it changes. |
Inject | A new piece of the scenario given to participants at a set time: a fact, a message, a call or a problem. Each inject forces at least one decision. |
Objective | A decision the exercise sets out to test, written before the scenario, with who takes it and the rule it is judged against. |
Observation | Something an observer saw during the exercise, written as fact: what happened, when, and which objective it concerns. It can be a strength or a gap. |
Observer | A person who watches and records against the objectives, and takes no part in the discussion or the decisions. |
Participant | A person who plays their own real role in the scenario and takes the decisions that role would take. |
Pre-brief | The first 15 minutes of the session: objectives, ground rules, roles and how it runs. Never the injects. |
Prompt | A nudge from the facilitator towards a decision. Recorded, because a prompted decision is rated at most Partly met. |
Re-test | Testing the same decision again once its improvement action is done, to show the change works. |
Run of show | The fixed timetable of the session, 3 hours for a tabletop. |
Scenario checker | A subject expert who does not take part, e.g. the managed IT provider's lead. Checks the scenario for realism before the day. |
Scenario time | The time in the story, which can jump ahead (Day 2, 09:00) while the exercise clock runs on. |
Scribe | The person who records each decision, who took it and when, as the exercise runs. |
Sponsor | The executive who asks for the exercise, approves its objectives and approves the after-action report. |
Spare inject | An extra inject the facilitator holds for a phase, used only if the discussion stalls. At most one per phase. |
Stop phrase | Words agreed at the pre-brief that end the exercise at once, because a real incident or emergency needs someone. |
Tabletop | An exercise held as a discussion. Participants sit together, receive the scenario in stages and say what they would decide and do. Nothing is switched off or restored. |
Timing card | The facilitator's list of injects at their exercise minute, clock time and scenario time. |