SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-tabletop-exercise

What is a tabletop exercise in incident response planning?

A discussion-based scenario walkthrough that does not deploy equipment or resources.

Start playing free

  1. A live failover of production systems
  2. An unannounced penetration test
  3. A discussion-based walkthrough of a scenario ✔

Why: In a tabletop, a facilitator presents a scenario and participants discuss roles, responsibilities, coordination and decisions. It is low cost and safe, and it exposes gaps in the plan before a real incident.

Huh, didn't know that: NIST says participants may meet in a classroom or in breakout groups.

The dad joke
Our tabletop exercise had the best attendance ever. The snacks were the real incident response.
Like this card?
Play the game

References

Answer: A discussion-based walkthrough of a scenario. In a tabletop, a facilitator presents a scenario and participants discuss roles, responsibilities, coordination and decisions. It is low cost and safe, and it exposes gaps in the plan before a real incident.

  1. NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-84.pdf
    A tabletop exercise is discussion-based only and does not involve deploying equipment or other resources.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyIn NIST's classic incident response life cycle (SP 800-61 Rev. 2), which phase follows Detection and Analysis?Security & PrivacyWhat is the purpose of a lessons learned meeting after a major security incident?Security & PrivacyWhich is an awareness activity that NIST SP 800-50 Rev. 1 says suits all users?

That's stuff everyone should know.