Running a security tabletop exercise for a small business
For small business owners, office managers and the IT providers who support them, who need to test whether their cyber incident plan works before a real incident does it for them. No prerequisite course, but you need a written incident response plan to test: an exercise checks a plan, it doesn't create one. 'Security for managers: leading your team through incidents' is useful background on what happens during the response itself; this course covers the exercise around it. You'll choose objectives and a scenario from your real risks, plan who takes part and in what role, write a scenario timeline with injects and discussion questions, facilitate the discussion and record what you see, then turn it into an after-action report and improvement plan with owners and dates. Guidance comes from NIST SP 800-84 and FEMA's HSEEP (US) and the UK NCSC's Exercise in a Box; free ready-made packages from CISA and the NCSC are pointed out along the way. Your own incident plan and IP contract decide who does what in a real incident.
- Level
- Intermediate
- Length
- About 110 minutes
- Contents
- 5 lessons · final exam
- Status
- Published · updated 10 Oct 2026
Skills you'll practise
- Choose exercise objectives and a scenario that fit the business's most serious cyber risks
- Plan the participants, exercise roles and ground rules for a tabletop exercise
- Write a scenario timeline with injects and discussion questions
- Facilitate the tabletop discussion and record observations without blame
- Write an after-action report and improvement plan with owners and due dates
Course outline
- 1.Choose exercise objectives and a scenario that fit the business's most serious cyber risksLesson · 18 min
- 2.Plan the participants, exercise roles and ground rules for a tabletop exerciseLesson · 16 min
- 3.Write a scenario timeline with injects and discussion questionsLesson · 20 min
- 4.Facilitate the tabletop discussion and record observations without blameLesson · 18 min
- 5.Write an after-action report and improvement plan with owners and due datesLesson · 18 min
- 6.Running a security tabletop exercise for a small business: knowledge checkKnowledge check · 16 questions
- 7.Running a security tabletop exercise for a small business: practical exerciseKnowledge check · 1 question
- 8.Final exam10 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- NIST SP 800-84: Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities (2006), publication page
- NIST SP 800-84 (PDF): Section 4, Tabletop Exercises
- FEMA: Homeland Security Exercise and Evaluation Program (HSEEP)
- FEMA: Homeland Security Exercise and Evaluation Program (HSEEP) doctrine, January 2020
- CISA: CISA Tabletop Exercise Packages (CTEPs)
- NCSC: Exercise in a Box (overview)
- NCSC: Exercise in a Box, Getting started
- NCSC: Exercise in a Box, Tabletop exercises
- NCSC: Effective steps to cyber exercise creation
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.