tabletop exercise (TTX)

What's the purpose of tabletop exercises?

The purpose of a tabletop exercise is to evaluate an organization's preparedness for a particular disaster and to inform required participants of their roles in the response. Whether it is destruction to facilities, loss of personnel or data loss from cyberattack, a tabletop exercise goes through every aspect of response and the follow up the organization will need to do.

Click on the above image
to download our free
tabletop exercise template.

While they use an accelerated timeline, tabletop exercises cover every aspect of the hypothetical scenario, from beginning to post-disaster efforts. They evaluate internal resources, any external agencies that may be called upon for assistance and identify which means of communication will be available at the time.

The outcome of a tabletop exercise can inform future disaster recovery (DR) planning and determine new guidelines the organization may need to implement. A TTX could identify gaps in knowledge from personnel, or security flaws that must be amended. Key personnel present during the exercise have the opportunity to not only become more comfortable with their own roles in disaster scenarios, but to see how the entire response will play out across the organization.

Following the exercise, participants and facilitators may compile an after-action report, detailing any key findings or questions highlighted during the exercise.

Tabletop exercise vs. other exercises

A tabletop exercise is one of seven types of exercises identified by the Homeland Security Exercise Evaluation Program for preparing for disasters. These exercise types fall into two categories: discussion-based or operations-based.

Tabletop exercises fall into the discussion-based list, along with seminars, workshops and games. While the other discussion-based exercises are similar to a TTX, a TTX is an interactive process used to assess plans, procedures and policies. Seminars and workshops may involve some interaction, but are primarily used to inform, and games are more informal than a TTX and do not replicate scenarios as closely.

Operations-based alternatives include drills, functional exercises and full-scale exercises. All are interactive, but unlike a TTX, these exercises typically include participants performing their duties, possibly on-site.

A drill is performed when one specific function or process can be tested, possibly in real-time. A functional exercise goes a step further, with multiple participants performing their duties in a simulated environment. A functional exercise coordinates communications between the organization and any agencies it may need to rely on in a disaster scenario.

A full-scale exercise imitates the response as closely to the real situation as possible, engaging with emergency services and possibly even local businesses. Full-scale exercises entail responding in real-time and on-location.

Pros and cons

Testing is one of the most important aspects of disaster recovery and data protection, and a tabletop exercise is a DR testing method that realistically prepares participants for disaster and also informs the organization of any flaws or weaknesses in their disaster preparedness plan. A TTX is ideally an active discussion, where all participants contribute. This makes it a reliable way to see how much personnel know about their roles, and gives them an opportunity to ask questions they might not otherwise think to ask.

Because they can take place in informal settings, such as a classroom or conference room, tabletop exercises are a cost-effective way to evaluate and test incident response. While it does take a time investment from the participants and facilitators, the exercises are not performed real-time and thus can be completed over the course of hours rather than days.

The major disadvantage to a tabletop exercise is that it cannot replicate every aspect of a hypothetical situation. Thorough planning is paramount, and those creating the narrative for the exercise must take into account all possible outcomes. Even then it is still a superficial review of the plan. Without experiencing these situations directly, some possibilities may be overlooked.

An organization may prepare for a loss of access to its primary data center, for example, but that scenario may not foresee a simultaneous loss of access to a cloud or offsite datacenter. While this may be improbable, it is not impossible. In the interest of saving time or prioritizing more common disasters, organizations may overlook scenarios that seem unlikely. That oversight could leave them unprepared.

A number of factors determine the types of scenarios an organization can plan for using a TTX. Common natural disasters vary by geography, as do geopolitical scenarios. The nature of the industry may also affect what disasters an organization needs to plan for.

Common scenarios may include:

• Earthquake
• Hurricane
• Flood
• Tornado
• Loss of power
• Fire
• Pandemic
• Cyberattack
• Office/building emergency

The type of emergency will determine the scope of the response, required personnel and inform the participants of their priorities and available resources. If it is a cyberattack, for example, the data protection team will have different action items than they would in the event of a natural disaster.