Incident Response Tabletop

An incident is anything that stops an organization from working or exposes its information, such as a cyberattack, a ransom note on a screen, a power outage, or a lost laptop. Incident response is what people do when one happens, ideally from a plan written ahead of time. A tabletop is a practice run where the people who would respond sit around a table or join a video call, hear a made-up incident unfold step by step, and talk through what they would do. No real computers are touched.

People find the gaps in their plans while the stakes are pretend, instead of during a real attack. A missing phone number, a backup nobody has tested, or nobody knowing who is allowed to make a decision all show up here. The team learns who does what before it matters. U.S. government guidance, linked at the bottom of this page, recommends practicing plans with exercises like this.

Shared screen or device

One person is the Scenario Leader: they open that page, share that browser tab or window, set up the seats, read each event aloud, and press the buttons. They also play in seat 1, like everyone else. Every player, the leader included, opens the Scenario Player page on their own device (the leader on a second device such as a phone) and types the session code and their seat number. That page holds a sealed card they must not open early, and an attendance receipt. Each player also sits in a role at the made-up organization, such as the owner or the person who handles the computers.

Each turn

The scenario moves forward in story time rather than by the clock in the room. Each event is headed with when it happens in the story, such as a day and a part of the day, and the group takes as long as it needs. Each event says what just happened and what has to be decided. The group talks it over and picks one of the listed actions or types its own, except at the one big decision where both choices cost something, which offers only its two listed options, and then the Scenario Leader rolls the dice to see how it goes.

Dice

Every decision rolls 2 dice with 12 sides each, and the total has to be higher than 12 for the action to work. A written plan the organization already had, or a player whose role is skilled for that kind of problem, adds a bonus to the roll, and the full rules sit behind a button on the decision screen.

Chance card

After every third decision, a random event the organization did not plan for comes up, like a chance card in a board game. It may help, hurt, or barely matter, and the group talks about it before moving on.

Labor

Partway through, the site picks one player at random who has suddenly gone into labor and is on the way to the hospital. From then on that player can only listen, nobody may ask them anything, and the skill their role brought to the table is gone. It shows what happens when the one person who knows something is not there.

Debrief

This review shows the timeline of what the group did, the facts that were held back during play, what a good answer would have looked like, and questions for a written follow-up. The leader can download the record of the game.

Attendance receipt

On the Scenario Player page, each student types a private key, a secret code their instructor gave them, and the page turns it into a short receipt code to hand in. The key itself never leaves their device and is not saved. Groups outside a class can skip it.

These links go to free public guidance on incident response and practice exercises from U.S. government agencies, standards bodies, and well-known security training organizations, and they open outside this site.

• NIST Special Publication 800-84, Guide to Test, Training, and Exercise ProgramsThe federal standards agency's 2006 guide to planning, running, and learning from practice exercises for IT plans describes tabletop exercises as people talking through their roles while a facilitator presents a made-up incident.
• Cybersecurity and Infrastructure Security Agency, Tabletop Exercise PackagesThe agency offers more than 100 free, ready-made tabletop exercise packages that an organization can run on its own, each with scenarios and discussion questions, covering threats such as ransomware and phishing.
• NIST Special Publication 800-61 Revision 3, Incident Response Recommendations and ConsiderationsThe federal standards agency published this guidance on incident response in April 2025. Incident response means how an organization handles a security problem, and the guidance says practice exercises help prepare staff and outside partners for real incidents.
• SANS Institute, What is Incident Response in CybersecurityThis is a plain language explanation of incident response, how you handle a computer security problem, and its six steps, from preparation, where training and practice runs belong, through to the lessons learned afterward.
• Center for Internet Security, Control 17, Incident Response ManagementThis is one of the Center for Internet Security's 18 prioritized security controls, meaning the protections it ranks by importance. The control calls for incident response exercises for key people at least once a year, to test communication, decisions, and the steps of the work.
• Cybersecurity and Infrastructure Security Agency, #StopRansomware GuideA U.S. government guide to preventing and responding to ransomware, meaning files locked for payment, tells organizations to write an incident response plan, exercise it regularly, and shape future exercises from what each incident teaches.
• Federal Emergency Management Agency, Homeland Security Exercise and Evaluation ProgramIt is the U.S. government's standard method for planning, running, and evaluating exercises of every kind, not only cybersecurity or tabletops in particular, including writing down what went well and what to fix afterward.
• Black Hills Information Security, How to Lead Effective TabletopsThis short how-to on leading a tabletop exercise names the benefits as finding gaps in plans, building teamwork, and sharper decisions, and suggests rolling dice to decide whether an action works, as this site does.