# What is a Tabletop Exercise?

> A tabletop exercise is a discussion-based simulation where participants walk through a hypothetical incident to test plans, roles, and decision-making — without touching live systems.

- Canonical URL: https://yellowcube.eu/glossary/tabletop-exercise/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Facilitators present a scenario — ransomware, data breach, provider outage, regulatory notification — and inject developments over time. Participants describe what they would do, revealing gaps in playbooks, authority, communication paths, and external dependencies before a real event exposes them.

### Key points

- **Decision-forcing scenarios:** Choose scenarios that force real trade-offs — payment, disclosure, shutdown, regulator contact — and record who decided what and why.
- **Real decision-makers:** Executives, legal, communications, IT, and affected business owners, not only the security team.
- **Important limitation:** A tabletop tests plans and understanding, not technical controls. Agreement in a conference room does not prove the same actions work under real time pressure and incomplete information.

### Related terms

[Cyber range](<https://yellowcube.eu/glossary/cyber-range/>) · [Security playbook](<https://yellowcube.eu/glossary/security-playbook/>) · [Security runbook](<https://yellowcube.eu/glossary/security-runbook/>) · [Incident response (IR)](<https://yellowcube.eu/glossary/incident-response/>) · [Business continuity](<https://yellowcube.eu/glossary/business-continuity/>)

### Sources

[CISA, Cyber Incident Tabletop Exercises](https://www.cisa.gov/resources-tools/services/cyber-incident-tabletop-exercises) · [NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations](https://csrc.nist.gov/pubs/sp/800/61/r3/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.