A tabletop exercise lets a team discuss a simulated incident before facing one publicly. The aim is to uncover gaps in decisions, communication, and access. Use clearly labeled fictional materials and keep the exercise inside an agreed environment so it cannot be mistaken for a real alert.
01
Choose one realistic scenario
Select a situation relevant to the organization, such as a misleading post about a service outage. Define the starting facts and what remains unknown. CISA’s exercise packages provide planning and evaluation materials; adapt the structure to your own team. Avoid inventing a sensational crisis that distracts from the processes you need to test.
- Name a facilitator and an observer.
- Invite operations, customer support, communications, and relevant advisers.
- Specify that no public posts, reports, or customer messages will be sent.
02
Introduce decisions in stages
Example: first a customer asks about the post, then a journalist requests a response, then operations confirms a limited disruption. At each stage ask who verifies the facts, who approves an update, and what customers need now. Let participants consult the actual contact list and access process rather than answering only in theory.
03
Turn findings into assigned changes
Record unclear ownership, missing information, and approval delays. Finish with a short improvement list containing an owner and due date for each change. Repeat the relevant part after fixes are complete. A useful exercise demonstrates whether the revised process works; it is not merely a meeting attendance record.
Frequently asked questions
Should we surprise staff with a fake public crisis?
Use a controlled exercise with agreed boundaries. Surprise publication or realistic messages sent outside the exercise can cause confusion and harm that defeats the purpose.
How do we judge success?
Evaluate decision quality, factual accuracy, coordination, and whether people can use the plan. Speed matters, but a fast unsupported statement is not a successful response.
Continue with your next step
Related guides on this topic
Sources and policies
Check the current policy before submitting a request.
You do not have to figure out the next step alone.
Share the URLs and explain your concern. We will review the context and explain which options are worth assessing.
Request a confidential reviewOr call (307) 429-2531Educational information, not legal advice. Outcomes depend on the facts and decisions made by third parties.