Cybersecurity Tabletop Exercise Checklist
Everything worth doing before, during, and after your exercise, organized so you can actually use it.
Two weeks before
- Pick a scenario and difficulty level appropriate to your team's experience.
- Identify participants and confirm they can attend — this is harder to reschedule than it looks.
- Decide who facilitates and who takes notes. These should not be the same person.
- If any real role (e.g. outside counsel, cyber insurer, a specific vendor) won't be present, decide who plays that role.
2-3 business days before
- Send participants the exercise duration, format, and a short reminder that this is a no-blame learning exercise.
- Distribute the participant role list so people know what they're responsible for.
- Book a room or video call with no interruptions for the full duration, plus 15 minutes buffer.
- Print or share the current incident response plan, if one exists — you'll want it in the room.
Day of, before you start
- Confirm the facilitator and note-taker roles one more time.
- Set expectations out loud: this is a learning exercise, not a performance review, and it's okay to say "I don't know."
- Set up a shared document or whiteboard for the live decision log.
- If you have observers, brief them on what to watch for (communication, clarity of authority, use of existing plans).
During the exercise
- Read the initial briefing exactly as written — don't pre-explain what's about to happen.
- Introduce each inject at a natural pace; don't rush just to get through all of them.
- Log every real decision: time, what was decided, who decided, and why.
- Push for an actual decision when the group is stuck — you can revisit ambiguity in the debrief.
- Watch the clock, but don't let timing anxiety cut off a genuinely useful discussion.
Right after (don't skip this)
- While it's fresh, ask: what worked, what didn't, what surprised us?
- Have observers share specific, factual notes — not general impressions.
- Identify at least one concrete fix with a named owner and a target date.
Within a week after
- Turn the decision log and debrief notes into a short after-action report.
- Load identified fixes into a remediation tracker with owners and dates.
- Schedule a follow-up check on those action items — this is the step most teams skip, and it's the one that actually matters.
Want this done for you, tailored to your organization?
Build Your Exercise