Most tabletops are theater: a slide deck, some nodding, a finding nobody tracks. This playbook is built for the other kind — scenarios with uncomfortable injects, decision points that force real answers, and findings that become owned actions.
"The backup restore is also encrypted." "The vendor's status page still says operational." "A reporter just emailed the CEO directly." Real exercises turn on moments like these — the inject that invalidates the comfortable plan and forces a decision. Every scenario here is built from them, with the facilitator told exactly when to fire each one and what a good answer sounds like.
Planning timeline, objectives, rules of engagement — no-fault, assume the injects are true, decisions over discussion.
A script skeleton from open to close: inject cadence, probing questions, time-boxing, and how the scribe captures findings that survive the meeting.
Narrative setup, timed injects, expected decision points, and scenario-specific evaluation criteria — ready to run as written.
One page per role: responsibilities, the first 15 minutes, and the anti-patterns that sink incident command.
Findings table — observation, root cause, owner, due date — plus strengths and timeline reconstruction. Findings become tracked issues, not memories.
One page for leadership: what we tested, what held, what broke, what we're fixing, and the ask.
The thinking: Incident Command Is the Backbone of Resilience and The SRE Pivot for Resilience.
A 32-page Word document (.docx) plus a PDF reference version. Print the role cards, project the injects, edit everything.
Tabletops as documented here produce the exercise evidence expected by ISO 22301, DORA's resilience-testing expectations, and FFIEC BCM exam work programs — objectives, participants, injects, findings, and tracked remediations. Scope your own regulatory obligations to confirm what applies.
Yes — internally or in client engagements, including facilitating exercises for clients. You can't resell the playbook itself as a template.
If you'd rather have the exercise designed and run for you, get in touch — facilitation engagements are available.
Five scenarios, uncomfortable injects, and findings that turn into fixes.