Back to Blog
    tabletop-simulation-training
    emergency-response-scenarios
    incident-response-team-training
    risk-assessment-tabletop
    tabletop-drill-framework

    Incident Response Tabletop for Small Businesses: 6 Scenarios to Copy

    Dustin CollettOctober 16, 2026

    An incident response tabletop is a short, discussion-based simulation that tests your decisions and communication before a real attack forces the issue. Its core outcome is a list of gaps with named owners and due dates. You can run one quickly by pairing CISA's Tabletop Exercise Packages with NIST guidance, then closing the loop in an After Action Report.

    TL;DR:

    • Set one to three measurable objectives, such as alerting executives within a chosen window, deciding when to isolate systems, or naming the approver.
    • Start with routine phishing to build response habits, then test ransomware, vendor compromise, or industrial control systems as team experience grows.
    • Include Legal, communications, HR, business leaders, and a decision maker; technical teams alone can miss notification duties, downtime tradeoffs, and unclear authority.
    • CISA’s free package includes facilitator materials and an After Action Report template; NIST guidance supports exercise design, evaluation, and scoring.
    • Set the report deadline before the session, assign each corrective task one owner and due date, then review progress regularly with an executive sponsor.

    Table of Contents

    What is a tabletop exercise, and how do you set objectives?

    NIST SP 800-84 describes a tabletop as a discussion-based event where a facilitator presents a scenario and prompts conversation tied to plan objectives. Nobody touches a live system. That separates it from functional or full-scale exercises, which test real tools and people under realistic conditions.

    Write one to three objectives you can measure. Then pick evaluation criteria that map directly to them.

    • Notification: the incident lead alerts executives within a time you set in advance.
    • Decision speed: the team decides whether to isolate affected systems within a stated window.
    • Authority: participants can name who approves taking a system offline.

    A weakness found during the session counts as a win. It gets fixed before a real incident exposes it.

    Which scenarios should you run?

    Pick scenarios that match your real business risks. CISA's scenario library includes situation manuals for ransomware, insider threats, phishing, and industrial control systems.

    • Ransomware: tests containment, recovery decisions, and who talks to customers, insurers, and regulators. Our ransomware response guidance pairs well with this drill.
    • Phishing and credential theft: tests detection, escalation, and identity controls such as forced password resets.
    • Insider data exfiltration: tests access controls and how HR, legal, and IT investigate together.
    • Industrial control systems: tests safety decisions and production impact when operations are at stake.
    • Vendor compromise: tests how fast you reach third parties and whether your contracts require them to notify you.

    Start with a low-friction scenario like a routine phishing incident. It builds muscle memory before you attempt a more complex ransomware or ICS drill.

    Who should be in the room?

    Technical teams alone miss business process failures. CISA warns that a frequent pitfall is leaving out Legal, PR, and HR, and that bringing in non-technical leadership surfaces gaps IT cannot see.

    • Incident lead: runs the response and makes the calls.
    • Security and IT: explain what the tools can and cannot do.
    • Legal: advises on notification duties and evidence handling.
    • Communications or PR: drafts customer and press messages.
    • HR: handles insider and employee-related questions.
    • Business unit leaders: weigh downtime against risk.
    • Vendor liaison: speaks for outside providers.

    Make sure someone with real decision authority attends. Otherwise every answer becomes "we'd have to ask." Give executives questions about priorities and tradeoffs, and give operational staff questions about steps and handoffs.

    What goes into your planning checklist?

    CISA's package documents cover most of what you need: an invitation letter, facilitator and evaluator handbook, slide deck, participant feedback forms, and an After Action Report-Improvement Plan (AAR-IP) template.

    1. Hold a planning meeting and lock objectives, scope, and participants.
    2. Assign a facilitator and evaluators, then have them prepare from the handbook.
    3. Send invitations with the date, goals, and any pre-reading.
    4. Run a dry run of the slides and injects with the facilitation team.
    5. Run the exercise, with a named note-taker for each table or breakout.
    6. Collect feedback forms the same day.
    7. Finish the AAR-IP by a deadline you set before the exercise.

    For virtual sessions, confirm breakout rooms and screen sharing work ahead of time. In person, seat decision makers where they can hear each other.

    Pro Tip: Set the AAR deadline in the invitation itself, so everyone knows the exercise ends with assigned work, not just a good discussion.

    How do you run the session?

    The facilitator drives toward your objectives, uses planned injects, and controls the clock.

    • Open with a short brief on objectives and ground rules.
    • Walk through phase one of the scenario and ask what each role does first.
    • Add injects such as a new alert, a press call, or a vendor outage, and pause at each decision checkpoint.
    • Wrap up by capturing evidence and confirming the action items aloud.

    Groups drift into technical troubleshooting. When that happens, ask "who decides, and by when?" and park the technical detail on a visible list. Record action items live in a shared document so nothing depends on memory. Our playbooks give teams ready steps to test against.

    How do you turn findings into tracked fixes?

    The After Action Report is where the exercise pays off. CISA notes that without a formal AAR process, the exercise becomes a social event rather than an operational improvement tool.

    • Record each finding with a short root cause note.
    • Assign one owner and one due date per remediation task.
    • Rank tasks by risk, so critical gaps come first.
    • Review progress at a set cadence with a named executive sponsor.
    • Feed open items into your IT and security roadmap. Our security assessment checklist helps with scoring and prioritizing.

    GAO found that organizations that fail to track corrective actions from exercises often repeat the same mistakes. Lessons only count when someone closes the fix.

    Which six scenarios can you copy today?

    Each one below states what it tests and gives starter questions.

    • Phishing click: tests detection and escalation. Who gets the first report? When do we reset the credentials?
    • Ransomware on a file server: tests containment. Who can authorize isolation? What do we tell customers?
    • Vendor compromise: tests third-party coordination. How do we reach the vendor after hours? What does our contract require them to tell us?
    • Insider exfiltration: tests access controls. Who is allowed to start an investigation? When does legal join?
    • ICS spoofing: tests safety decisions. Who can stop production? How do we confirm what the operators see is real?
    • Multi-site outage: tests continuity. Which site recovers first? Who owns the communication plan?

    Scale difficulty to your audience: give newer teams one inject, and experienced teams several stacked ones.

    Where do you get templates and guidance?

    Start with the CISA CTEP package documents for ready-made situation manuals and facilitator guides, all at no cost. For design and evaluation, use NIST SP 800-84 and NIST SP 800-61 Rev. 3, which ties incident response to the CSF 2.0 life cycle.

    Government templates assume a larger team than most small businesses have. Trim the participant list, merge roles where one person wears several hats, and shorten the session to match your size. If you want outside help on escalation workflows, this guide to escalation outsourcing is a useful reference.

    What do we see after the exercise ends?

    In our experience, the findings that surprise people are rarely technical. They are coordination gaps and unclear authority: nobody knows who can authorize taking a system offline. The fix list matters more than the session itself, so we insist on owners and dates before everyone leaves. A tabletop is one turn of an ongoing cycle of testing, fixing, and testing again, and the cycle only works when governance keeps it moving.

    , Dustin Collett

    How can Collett Systems help you run and follow through?

    We help you finish the work the exercise uncovers.

    • Our IT & Security Assessment shows where your gaps are before you design scenarios.
    • Our Managed IT Services give you fixed per-user support and 24/7 monitoring to carry out AAR remediation.
    • We help turn AAR items into tracked remediation plans with owners and dates.

    Request an IT & Security Assessment to discuss your IT and security needs.

    Collett Systems LLC

    FAQ

    What are the main steps of incident response?

    Most frameworks follow the same arc: prepare, detect and analyze, contain, eradicate and recover, then review lessons learned. NIST SP 800-61 Rev. 3 folds these into an incident response life cycle aligned with the CSF 2.0 functions. A tabletop exercises each step through discussion.

    Can you give examples of tabletop exercises?

    Common examples include a ransomware outbreak, a phishing campaign that steals credentials, an insider taking customer data, and a vendor compromise. CISA publishes situation manuals for ransomware, insider threats, and industrial control systems.

    What is a BCM tabletop exercise?

    A business continuity management tabletop uses the same discussion format but focuses on keeping operations running through a disruption such as an outage or site loss. It asks which functions recover first and who decides. It pairs well with a cyber tabletop because both expose coordination gaps.

    Who should lead the exercise?

    A facilitator who is not the incident lead should run it, so the lead can participate as a decision maker. The facilitator keeps discussion on objectives and time. CISA's facilitator and evaluator handbook gives a ready structure.

    Sources