Written and maintained by CASRAI Editorial Board
Last updated
A tabletop exercise (TTX) is a discussion-based exercise in which the people who hold roles in a plan meet and talk through a scenario to test whether the plan works. Nobody deploys equipment or touches live systems: a facilitator presents the scenario, asks questions, and the group works out who would do what. This guide is for security, IT, compliance and research-administration staff who need to run or sit in one. It explains what happens, who takes part, how it is staged, and what it produces.
What exactly is a tabletop exercise?
NIST’s glossary defines a tabletop exercise as a discussion-based exercise where personnel with roles and responsibilities in a particular IT plan meet in a classroom or breakout-group setting to validate the content of the plan by discussing their roles during an emergency and their responses to a particular emergency situation. A facilitator presents the scenario and asks questions of the participants (NIST CSRC glossary, read 2026-11-07, drawing on NIST SP 800-84).
The same publication calls tabletop exercises cost-effective tools for validating the content of IT plans such as contingency plans and incident response plans. It also notes the term is used loosely: some people use “tabletop” for every discussion-based exercise, others only for one specific type, so check what a given organisation means before agreeing a scope.
What does a tabletop exercise look like?
NIST SP 800-84 describes tabletop exercises as informal: a facilitator guides participants through a discussion designed to meet pre-defined objectives, one or more scenarios may be discussed, and the session typically lasts two to eight hours depending on the audience, topic and objectives. It is discussion only; it does not involve deploying equipment or other resources. In practice that means a meeting room or breakout tables, a scenario narrative, a participant guide, and a note-taker (NIST calls this role a data collector) recording what was decided and where the group got stuck.
What is a tabletop exercise example?
Illustrative composite, not a real organisation or event. The scenario type follows the cyber scenarios CISA lists in its Tabletop Exercise Packages, which include ransomware.
- Scenario. The facilitator announces that on a Monday morning several staff report they cannot open files, and a message demands payment to restore them.
- Discussion questions. Who is told first? Who decides whether to disconnect systems? Which plan applies, and where is the current copy? Who speaks to leadership, to funders or partners, and to regulators?
- Developments. The facilitator adds new information, such as the discovery that a shared research drive is also affected, and asks how the answers change.
- Findings. The group notes gaps, for example that two teams each assumed the other would contact leadership, and assigns follow-up actions.
The CISA packages are organised around three question areas: information sharing before an incident, incident response, and post-incident recovery. Use them as a prompt list when building your own questions.
Who takes part?
- Participants: the personnel who hold roles in the plan being tested.
- Facilitator: presents the scenario and guides the discussion toward the objectives.
- Data collector or evaluator: records observations; NIST SP 800-84 lists facilitator and data collector among the staff identified during design.
- Planners: CISA’s packages distinguish planners, facilitators/evaluators and participants.
How is one run? The five stages in NIST SP 800-84
- Evaluate need and schedule (section 4.1).
- Design (4.2): set objectives and identify staff, including facilitator and data collector.
- Develop materials (4.3).
- Conduct (4.4): in a classroom setting, with practical touches such as name tents.
- Evaluate (4.5): review what the exercise showed about the plan.
Appendix A of the publication supplies samples of a facilitator guide, a participant guide and an after action report. SP 800-84 dates from 2006; treat it as a foundational description of the method, not a current compliance requirement.
What does a tabletop exercise produce? The after action report
The output that makes the exercise worth the time is the after action report (AAR), which records what was observed and the follow-up actions. CISA’s packages include an After Action Report template alongside a participant invitation template, a slide deck and a post-exercise feedback form. CISA lists more than 100 packages, each with template objectives, scenarios and discussion questions (CISA, read 2026-11-07).
Tabletop exercise vs functional exercise vs simulation
| Question | Tabletop exercise | Functional exercise |
|---|---|---|
| What people do | Discuss their roles and responses in an informal setting | Perform their duties in a simulated operational environment (NIST SP 800-84) |
| Equipment or resources deployed | None; discussion only | A simulated operational environment is used |
“Simulation” is not a separate category in the sources used here. When a vendor or course uses the word, ask what is actually being practised: discussion of the plan, or performance of duties in a simulated environment.
Cybersecurity tabletop exercises
CISA’s packages cover ransomware, insider threats, phishing and industrial control system compromise, with sector versions for elections, local government, maritime ports, water and healthcare, plus physical scenarios (active shooter, vehicle ramming, improvised explosive device, unmanned aircraft) and cyber-physical convergence. NIST SP 800-84 points to NIST SP 800-61 for scenarios and questions on incident handling. For a framework such exercises are often mapped against, see NIST Cybersecurity Framework 2.0.
Related CASRAI guides
- Hazard vulnerability analysis and CMS emergency preparedness, where exercises count toward hospital requirements.
- Hospital incident command system, the role structure many exercises rehearse.
- Emergency action plan for a research laboratory, a plan a tabletop can test.
FAQ
How does a tabletop exercise work?
A facilitator presents a scenario to the people who hold roles in a plan and asks questions. The group discusses what they would do, notes are taken, and an after action report is produced.
How long does a tabletop exercise take?
NIST SP 800-84 says typically two to eight hours, depending on audience, topic and objectives.
Does a tabletop exercise involve real systems?
No. NIST describes it as discussion-based only, without deploying equipment or other resources.
Sources
- NIST CSRC Glossary, “tabletop exercise”: csrc.nist.gov/glossary/term/tabletop_exercise (read 2026-11-07).
- NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities (2006): nvlpubs.nist.gov (read 2026-11-07).
- CISA Tabletop Exercise Packages: cisa.gov (read 2026-11-07).
