# Crisis and tabletop exercise

Turn authority, communication and recovery into a measurable rehearsal.

SecNet.Work | 2026.10 | 2026-10-21

An exercise reveals where the plan fails rather than trapping participants. Fictional injects test decisions and coordination without causing a real outage. A tabletop does not replace an actual restore test. CISA exercise packages can inform design but must be adapted to business impact and organizational authority.

## Work boundary
Controlled tabletop only; do not send exercise messages to real customers, regulators or media.

## Process

### 1. Choose measurable behavior
Replace “are we ready” with finding authority, switching communications or setting recovery priorities. Assign observers and stop authority. Write success criteria before injects.

Expected evidence: Objective and observation plan

### 2. Deliver the inject
Present a synthetic timeline and business impact. Separate participant knowledge from facilitator knowledge. Adapt the next inject to decisions without executing real technical response.

Expected evidence: Timed inject and decision record

### 3. Observe decisions and communication
Record who decided with which information. Expose ambiguous authority, wrong recipients and silent stakeholders. Evaluate rationale as well as response time.

Expected evidence: Decision, information and recipient trail

### 4. Retest the learning
Assign an owner, date and validation method to every gap. Test plan changes with a short new inject. Attendance is not control-effectiveness evidence; track actions until verified.

Expected evidence: Action and repeat-exercise result

## One control, three perspectives

### Operator
Do backup communications work?
Test access using exercise channels.
Evidence: Participation and access result

### Auditor
Is decision authority clear?
Observe information and authority behind the first decision.
Evidence: Observer record

### Leader
Which service recovers first?
Set recovery order using business impact.
Evidence: Priority and dependency decision

## Evaluate evidence

**Claim:** The crisis plan works.

**Weak support:** An attendance list and group photo.

**Stronger support:** Objective-linked observations, decision records, open actions and a rehearsal after plan changes exist.

**Rationale:** Attendance does not measure execution capability. Observe decisions and verify improvement.

## Decision desk
Email and the identity provider are down; management approval is pending.
Start: start

### start
First step?

- **Activate defined alternate authority and communications** (good)
  You test the route beyond email. Check that participants can actually use it.
  Next: verify

- **Wait for approval through the failed email system** (risk)
  The plan remains dependent on the failed channel. Defined authority and an alternate route are needed.
  Next: repair

- **Close without a rationale** (incomplete)
  Deferring an open issue is not closure evidence. Record the uncertainty, owner and next verification step.
  Next: revise

### verify
An alternate channel exists but the on-call manager cannot access it.

- **Correct access and backup authority, then rehearse** (good)
  You measure usability rather than the channel’s name. Link the new rehearsal observation to closure.
  Next: planned

- **Accept the claim without testing** (risk)
  The initial claim and observed result differ. Support closure with a repeatable check in the same scope, rather than a promise or ticket status.
  Next: revise

### repair
An exercise message is about to reach a real customer.

- **Stop sending, fix the boundary and record it** (good)
  Recheck exercise labels and recipient boundaries. Do not conduct real external communications.
  Next: planned

- **Delete the earlier record and close** (risk)
  Deleting the earlier decision undermines learning and accountability. Link the new action to the prior record and keep the rationale and residual risk visible.
  Next: revise

### supported
This decision is supported by the evidence in the example. Verify closure conditions in your own scope.

### revise
The decision lacks support. Record the rationale and required evidence, then reassess.

### planned
A remediation path is defined. Keep the matter open until implementation and verification are complete.

## Worked example
Entirely fictional.
- Inject / time: EX-01 / 09:00
- Expected decision: Activate alternate channel
- Observed: On-call cannot access
- Gap: Missing access
- Owner: Continuity owner
- Validation: Retest with a short inject

## Closure checklist
- [ ] Objectives and boundaries approved.
- [ ] No messages to real recipients.
- [ ] Observation includes decision rationale.
- [ ] Improvements retested.

## Official sources
- [CISA — Tabletop Exercise Packages](https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages)
- [NIST SP 800-61 Rev. 3 — Final, April 2025](https://csrc.nist.gov/pubs/sp/800/61/r3/final)

https://secnet.work/learn/toolkits/crisis-exercise