An attendance list and group photo.
Governance / 11
Crisis and tabletop exercise
Turn authority, communication and recovery into a measurable rehearsal.
This work is currently open on this device. Sign in to save it and continue on another device.
Sign inAn exercise reveals where the plan fails rather than trapping participants. Fictional injects test decisions and coordination without causing a real outage. A tabletop does not replace an actual restore test. CISA exercise packages can inform design but must be adapted to business impact and organizational authority.
Map the process
0 / 4 steps reviewed.Step 1 / 4
Choose measurable behavior
Replace “are we ready” with finding authority, switching communications or setting recovery priorities. Assign observers and stop authority. Write success criteria before injects.
Expected evidence
Objective and observation plan
One control, three perspectives
Do backup communications work?
Test access using exercise channels.
Participation and access resultEvaluate evidence
Claim: The crisis plan works.
What evidence would you request before closing this claim?
Decision desk
Email and the identity provider are down; management approval is pending.
First step?
Worked example
This record is fictional. Do not treat sample results as evidence for your own work.
| Inject / time | Expected decision | Observed | Gap | Owner | Validation |
|---|---|---|---|---|---|
| EX-01 / 09:00 | Activate alternate channel | On-call cannot access | Missing access | Continuity owner | Retest with a short inject |
Closure checklist
0 / 4Checks on this screen last for this session only; they do not create closure evidence or compliance approval. Keep organizational records in the downloaded workpaper.
Take it to work
Files in the selected language. The workbook includes blank records, a worked example and a checklist.
Keep learning
Explore related Academy coursesSources and edition
Checked: 2026-10-21 · Edition 2026.10