Your First Tabletop: A 90-Minute Exercise for the Executive Team

The executive team agrees it should run a tabletop exercise. Then someone asks what that involves, the answer sounds like a project, and the idea quietly returns to the list for next quarter.

A first tabletop is not a project. It is ninety minutes, one realistic scenario, and the people who would actually be in the room during a crisis. No consultants required, no software, no war-gaming jargon.

The goal is not to simulate an attack. It is to discover, cheaply, how your team actually makes decisions when the information is incomplete and the clock is loud.

Key takeaways

• One scenario, one room, ninety minutes: that is the whole format.

• Choose a scenario from your own risk register, not from the news.

• A facilitator asks 'what do you do now?' and keeps the clock moving.

• Capture decisions and stalls, not a transcript.

• End with owners and dates for the top three gaps, or the exercise was theater.

Step 1: Pick a scenario that could plausibly happen to you

Start from your own risk register or your industry's common incidents: the ransomware note on a Monday, the vendor breach notice, the employee laptop with the customer file. Exotic scenarios test imagination; plausible ones test the company.

Write it in half a page: what happened, what is known, what is unknown. Leave the unknowns genuinely unknown - incomplete information is the exercise.

Step 2: Get the decision-makers in the room

Invite the people a real crisis pulls in: the executive sponsor, the technology lead, whoever handles communications, whoever talks to customers, and whoever controls spending. Six to ten people is ideal.

Their absence is itself a finding. If the person who approves emergency spend cannot attend, the exercise just discovered your first gap before it started.

Step 3: Run the clock in three moves

Break ninety minutes into three injects. First: the discovery - what do you do in the first hour, who gets called, what do you not touch. Second: escalation - it is worse than it looked, customers are asking, what do you say and who decides. Third: the day after - what do you fix, what do you tell the board, what changes.

The facilitator's only job is to ask 'what do you do now?' and refuse vague answers. 'We would investigate' gets the follow-up: who, using what, deciding what?

Step 4: Write down decisions and stalls, not minutes

Assign one person to capture two lists: decisions made (and by whom) and stalls - the moments where nobody knew who decides, where a number was, or what the plan said. This fictional example shows the format. It is an illustration, not a real record.

Moment	What happened	Gap recorded
First inject, minute 10	Debate over who can take the system offline	No pre-authorized isolation authority
Second inject, minute 45	Nobody had the insurer's notification requirements	Policy details not in the response plan
Third inject, minute 75	Two people thought they owned customer comms	Communications ownership unclear

Step 5: Close with owners, dates and a retest

End the session by assigning the top three gaps: an owner, a fix, and a date. Book the next exercise before everyone leaves - six months out is a good rhythm.

NIST's contingency guidance treats exercises as the mechanism that converts plans into capability. A tabletop without assigned fixes converts an afternoon into lunch.

The related discussion of cyber crisis preparedness is worth your time alongside this one.

Frequently asked questions

Do we need an outside facilitator?

Not for the first one. A respected insider who is not a decision-maker in the scenario works fine. Bring in outside help once the team has outgrown the basics and wants pressure it cannot apply to itself.

Should the board participate?

Not in the first executive tabletop. Give the board the gaps and the fixes afterward; invite a director to observe once the format is proven. Some boards later run their own short session on the board's role during a crisis.

What if the exercise shows the plan is wrong?

That is the best possible outcome for a first exercise. Every flaw found in a conference room is one that will not be found during the incident. Fix the plan and run it again.

A Defensible Next Step

Book ninety minutes with your executive team this quarter and run one scenario from your own risk register. The stalls you find are the incident plan you actually have. Book a Decision-Clarity Call if you want a facilitator's run-sheet.