The best tabletop exercise scenarios are the ones your leadership team could plausibly face in the next 12 months: a cyberattack, a severe weather event, a workplace incident, a public controversy. You walk the team through that event on paper, one development at a time, and watch where decisions stall, roles blur or messages contradict each other. Below are nine scenarios worth running, how to build each one, and how to turn an operational drill into a test of your crisis communications.
TL;DR
- A tabletop exercise is a discussion-based rehearsal. Your team talks through a simulated incident to test the plan, not to perform perfectly.
- Start from the risks your organization actually carries, then adapt the scenario text to your operations, your people and your region.
- Most scenario libraries test operations. Add media, social media and stakeholder injects to test what you say, who says it and how fast.
- Close every session with a hot wash and a written improvement plan with owners and dates.
- Run one scenario well before running five poorly. Repeat on a schedule.
Table of Contents
- What a tabletop exercise scenario really is
- Where to find ready-made scenarios
- Nine tabletop exercise scenarios worth running
- How to adapt a scenario to test crisis communications
- A quick illustration
- How to build and run the session
- Perspective: why we rehearse the conversation, not just the event
- When to bring in outside help
- FAQ
- Sources
What a tabletop exercise scenario really is
A tabletop exercise tests an existing plan, policy or procedure against a simulated incident. According to the EPA's tabletop exercise training module, participants discuss roles and responsibilities, identify strengths and shortfalls, and improve coordination and the flow of information. No one moves a truck or shuts down a server. People sit in a room and decide.
The scenario is the story that drives those decisions. It has a background (what happened and when), a series of updates released in stages, and discussion questions tied to each stage. The updates are often called injects. A good one forces a choice: a reporter calls before you have confirmed the facts, a regulator asks a question, a key executive is unreachable.
I tell clients the same thing at the start of every session. The goal is not to pass. CISA's own guidance says the point is for players to work as a team and find problem areas in peacetime, not to perform flawlessly. A tabletop that exposes nothing has taught nothing.
Where to find ready-made scenarios
You do not need to start from a blank page. CISA offers more than 100 customizable tabletop exercise packages covering natural disasters, pandemics, cybersecurity attacks and physical security incidents. Its exercise planning documents include an invitation letter, a briefing slide deck, a participant feedback form, an after-action report template and a Situation Manual that holds the scenario, background and suggested discussion questions.
That is a strong skeleton. What it cannot supply is your context: your brand, your regulators, your customers, your local news market. The EPA guidance says design teams should modify scenario text to reflect exercise objectives, business processes, standard operating procedures and regional factors. Treat any template as a first draft.
Nine tabletop exercise scenarios worth running
The first six come from the categories public agencies already publish. The last three are communication-first scenarios we build for clients, because those are the ones most plans leave untested.
1. Ransomware and data exposure
CISA lists ransomware among the most common cybersecurity tabletop scenarios, alongside insider threats, phishing and industrial control system compromise. A workable version: on a Friday afternoon, systems lock and a ransom note appears. By Saturday, someone claims the attackers have stolen customer records.
Injects to add: a call from a journalist who says she has seen the stolen files; a question from your insurer; an employee posting about the outage on social media. Ask who decides whether to pay, who tells customers, and what legal counsel must clear before anything goes out. If you are publicly traded, ask who determines materiality and how quickly your disclosure counsel can be in the room.
2. Insider theft of confidential information
A departing employee takes client files or trade secrets. The operational questions are about access and forensics. The leadership questions are harder. Do you notify affected clients before you know what was taken? Who speaks to the employee's new employer? What do you say to staff who heard rumors?
3. Active shooter or workplace violence
CISA's packages cover active shooter incidents, vehicle ramming, improvised explosive devices and unmanned aircraft systems. These are the hardest sessions to run and the most valuable. Keep the focus on decisions, not tactics: how are employees alerted, how are family members informed, who is the single voice to the press, and who looks after staff in the days after.
Physical security shapes how this scenario unfolds. If your team is weighing doors, badges and monitoring, a review of physical access control and fire escape routes is a sensible companion to the exercise, because a plan that assumes a locked door will not help if the exit is blocked.
4. Severe weather and building loss
CISA's weather scenarios cover earthquakes, flooding, hurricanes, tornadoes, wildfires and winter weather. For our Western clients, wildfire smoke, extreme heat, flash flooding and earthquakes are the realistic choices. The Ready.gov hurricane playbook shows a useful structure: the exercise moves through scenario updates that raise communication disruptions, workforce availability and infrastructure damage.
Build your own version around a single question: the building is unusable for two weeks, and phones and power are intermittent. How do you reach employees, and who tells customers?
5. Workplace injury or fatality
An employee is seriously hurt on site. Regulators are notified, a family is waiting for answers, and a coworker has posted a photo online. This scenario tests empathy as much as procedure. It is also where the gap between legal caution and human response shows up fastest.
6. Supply chain or threat-vector disruption
CISA's scenarios include supply chain disruptions and threat vectors such as border crossing closures. Use this for any company that depends on a single vendor, port or logistics partner. Ask what you tell customers when delivery dates slip and whether your contracts say what you promised.
7. A viral accusation against a senior leader
An anonymous post accuses an executive of misconduct. Within hours it has been shared thousands of times and a local reporter asks for comment by 5 p.m. You have not yet completed an internal review. This is a reputational crisis with no physical event at all, and it tests whether your plan covers anything beyond operations.
Discussion questions: Who decides whether to respond publicly before the facts are in? What can you say that is true, useful and does not prejudge the outcome? Who briefs the board, and when?
8. A product or service failure that harms customers
A recall, a billing error that hits thousands of accounts, a patient safety event, a data mix-up at a school. Customers are angry and early reports are incomplete. The test is the first 24 hours of communication: what you know, what you do not know, and when you will update.
9. Regulatory inquiry or litigation made public
A subpoena, a lawsuit or a government inquiry becomes public through a court filing. Your legal team wants silence. Your employees, donors, tenants or patients want answers. The exercise puts counsel and communications at the same table and makes them agree on a position before the pressure is real.
How to adapt a scenario to test crisis communications
Most published scenarios are written for emergency managers and IT teams. They tell you what happened, not what the public is saying about it. To turn any of the nine above into a crisis simulation exercise that tests communications, add three layers.
Media injects. Script the calls and emails a newsroom would send: a request for comment with a deadline, a follow-up with a new allegation, a photo that contradicts your statement. Ask the spokesperson to draft and speak a response in the room, not just discuss one.
Social media injects. A DHS report on incorporating social media into exercises describes feeding fictitious posts to a monitor during an exercise, and notes that social media can serve as the inciting incident. In a discussion-based session, a simple printed timeline of fake posts and comments does the job. It shows the team how quickly a story can outrun the facts.
Stakeholder injects. Employees, customers, donors, investors, regulators and neighbors each ask something different. Give each group a voice in the script. Then ask whether your message to one contradicts your message to another.
We also ask a fourth question that rarely appears in templates: what credible action will you take, not just say? A statement without a visible step behind it does not rebuild trust. Our piece on reputation risk mitigation goes deeper on that link between action and reputation.
A quick illustration
Here is how a ransomware scenario changes when communications is the target.
The operational version asks: how long until systems are restored? The communications version asks: it is 7 a.m. Saturday, a customer has posted a screenshot of your outage page, and a reporter has asked whether customer data was taken. What do you say at 8 a.m., and who has approved it?
In the first version, the IT lead does most of the talking. In the second, the CEO, counsel, communications lead and customer service head all have to agree on a few sentences. That is where plans quietly fail. Approval chains are slow, holding statements are missing, or no one knows who is allowed to speak.
How to build and run the session
Keep the design simple. Choose one scenario. Write three or four objectives, such as "confirm who authorizes public statements within the first hour." Build the story in stages, with each stage forcing a decision linked to an objective.
FEMA recommends building a planning team with relevant expertise across disciplines, such as human resources, facilities management and legal counsel, and the FEMA exercise starter kit suggests tailoring discussion questions to preparedness, response and recovery. Include communications at the planning stage, not only on exercise day.
Effective sessions also need an experienced facilitator. The EPA's guidance calls for someone who encourages in-depth discussion and slow-paced problem-solving. That person should not be the plan's author, who will defend it. Prepare spare material too: CISA's planner handbook recommends selecting about six additional questions for the facilitator to use if a module runs ahead of schedule.
Questions to ask at every stage
Who knows first, and how? Who decides? What do we know for certain, and what are we assuming? Who must be told before the public hears it? What would we regret saying? What would we regret not saying?
Close with a hot wash and an improvement plan
Immediately after the exercise, hold a short hot wash. The EPA module describes using it to check whether objectives were met, correct factual mistakes and identify improvements to procedures and coordination. Evaluation forms and an after-action report with an improvement plan then capture the observations and recommended fixes. Give each fix an owner and a date, and revisit them at the next session. An exercise without follow-through is a meeting.
Perspective: why we rehearse the conversation, not just the event
After more than 30 years of advising organizations, we have seen the same pattern. Teams that struggle in a real crisis seldom lack a plan. They lack practice making decisions together under pressure, with incomplete facts and a clock running.
Think of a crisis as a relay race. The baton is information, and it has to pass cleanly between legal, operations, leadership and communications. Most drops happen at the handoffs. A tabletop is the only way to find those handoffs before a reporter does.
We also encourage leaders to see the exercise as more than risk control. An organization that has rehearsed its response speaks with more clarity, acts with more credibility and recovers trust faster. That is how a crisis can become an opportunity for reputational growth, but only for those who prepared. My advice is to begin with the scenario you hope never happens, and let your team be uncomfortable in a conference room instead of in public.
— Mark
When to bring in outside help
You can run a basic session in-house. Outside facilitation helps when the scenario touches sensitive leadership dynamics, when you need an honest read on your spokespeople, or when you want realistic media pressure. Mark Brown Strategies offers crisis readiness assessments, tailored crisis communication plans and real-time crisis response, so the scenarios we run are tied to the plan you would actually use. We work with organizations in California, Nevada, Arizona and Utah, including law firms, healthcare organizations, casinos, real estate firms, nonprofits and companies entering the Las Vegas market.
FAQ
What are tabletop exercise scenarios?
They are simulated incidents used to test how a team would respond, discussed in a low-stress setting rather than acted out. Each scenario includes a background, staged updates and discussion questions that force decisions about roles, communication and coordination.
Can you give three sample scenarios for a tabletop exercise?
Three solid starting points are a ransomware attack with a media inquiry, a severe weather event that makes your building unusable, and an insider taking confidential information. Each can be run in about two hours and adapted to your own systems and region.
How often should we run a tabletop exercise?
At least once a year is a common baseline, and again after a major change such as a leadership transition, a merger, a new facility or a real incident. Rotate scenarios so that different risks and different people are tested.
Who should take part?
Include the decision makers who would actually act: executive leadership, legal counsel, communications, operations, IT, human resources and customer-facing leaders. Keep observers separate from players so people stay candid.
Sources
- EPA tabletop exercise training module
- CISA Tabletop Exercise Packages
- CISA CTEP fact sheet
- CISA Cybersecurity Tabletop Exercise Tips
- Ready.gov hurricane playbook
- DHS best practices for incorporating social media into exercises
- FEMA Preparedness in a Pandemic exercise starter kit
- CISA CTEP Exercise Planner Handbook