How do you run a tabletop exercise that tests real capabilities?
The short answer
A good tabletop exercise starts from the capabilities you want to test, such as escalation, decision-making or a workaround, and picks a realistic loss scenario that stresses them. Known gaps get fixed before the exercise. On the day, the team activates, decides and communicates under pressure. Afterwards, every finding gets an owner and a date.
Start with the capabilities you want to test
Most exercises start with a scenario and a binder. The team works through the scenario, checks whether the plan covers it, and writes "plan validated" in the report. Nobody is better prepared afterwards.
The strongest multi-day tabletop exercises I have seen started somewhere else. Before choosing a scenario, we defined which capabilities we wanted to test. For example:
- Escalation from first signal to a crisis team decision
- Decision-making with incomplete information
- Customer and regulator communication in the first hours
- A specific workaround, such as processing priority orders without the main system
- The recovery sequence across IT, the business and a key vendor
Pick two or three. The scenario then gets designed to stress exactly those.
Fix the known gaps before the exercise
Scenarios expose missing capabilities fast. If you already know the escalation path is unclear or a workaround has never been tried, don't spend the exercise rediscovering it. Fix it first, or take it out of scope and say so.
The work happens before the exercise. The exercise then tests whether the fix holds under pressure. That distinction decides whether an exercise improves judgment and coordination or produces shelfware.
Pick a scenario from the five losses
Nearly every threat lands as a loss of a site, a system, a supplier, people or data. Choose a severe but plausible scenario that combines one or two of them and has clear customer impact.
One scenario I like for tech resilience teams: "Our core hosting environment is unavailable or compromised, and we don't know yet how long recovery will take. How do we keep serving customers?" It forces four questions into the room:
- What does this mean for our customers, and which commitments do we start missing as the hours go by?
- What does the business set in motion before IT can give a credible recovery time?
- What minimum does IT need to recover first while the business runs on workarounds?
- What would we change now, knowing this?
Put the decision layers in the room
An exercise with only IT tests IT. An exercise with only the business tests the business. Recovery fails between them, so bring both, plus legal, communications and the executives who would make the hard calls.
Run it as a walkthrough first. Practice how the team assembles, how information flows, how decisions are made and logged. Teams that have navigated uncertainty together behave differently when it matters.
Test how long you can hold
Most exercises end once the team has activated and made the first decisions. Real disruptions last days. Ask what happens on day two: who takes the next shift, how big the backlog has grown, whether the same people appear in three procedures at once.
Be clear about the limits of what you tested. One successful shift doesn't prove three days of sustainable operation.
Follow up until the gaps close
The exercise report is the start of the work. Give every finding an owner and a date within a week, update the dependency picture with what you learned, and test the fixes in the next exercise. Repeat until the response becomes reflex.
A practical way to begin
- Pick two or three capabilities to test, such as escalation, a workaround or the recovery sequence.
- Choose a loss scenario with clear customer impact that stresses them.
- Fix the gaps you already know about, or take them out of scope.
- Run a two- to three-hour walkthrough with IT, the business and the decision-makers.
- Within a week, give every finding an owner and a date, and update your dependency picture.
How we do this in resimate
resimate runs exercises on your own connected view instead of a generic script. The exercise builder and catalog start from loss scenarios and the capabilities you want to test, and the scenario plays out against your real services, dependencies and recovery sequences. Teams go live in 4 to 6 weeks, on the data they already have.