Tabletop Exercise Design and Scoring

Design a tabletop exercise with a four-stage scenario, timed injects, discussion questions and a scoring sheet for your team.

Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

Design a tabletop exercise. Scenario type, such as a ransomware notice or a lost laptop: [SCENARIO_TYPE]. Participants: [PARTICIPANTS]. Time: [TIME]. Systems involved: [SYSTEMS].

Write a scenario in four stages with injects at timed intervals, questions for each stage, and expected actions. Provide a scoring sheet with criteria: detection, decision speed, communication, use of the plan, and recovery priorities, each scored 1 to 5 with notes.

Return the exercise pack, a facilitator guide, an after-action template with owners and dates, and ground rules: no blame, invented details only, no real systems touched.

Add a worked scenario excerpt. Stage one, 09:10: a staff member reports that files on a shared drive have strange names and cannot be opened. Questions: Who do you tell? What do you do with the affected computer? Expected: report to the incident lead, disconnect the computer from the network but do not switch it off, record the time. Stage two, 10:30: a note appears demanding payment. Questions: Who decides what to tell staff? Do you contact insurers or the authorities? Expected: follow the notification plan after advice. Stage three, 14:00: backups are found to be up to date but untested. Questions: How long to restore the main files? Which systems come back first? Scoring example: detection 3, decision speed 2, communication 2, use of the plan 1, recovery priorities 3, total 11 out of 25, which is 44 percent; list the two main learning points. Add a facilitator guide with timings of 90 minutes, rules that no real systems are touched and a debrief with the questions: what surprised you, what did the plan not cover, what would you change? Provide an action log with owner placeholders and dates and a plan to repeat the exercise in six months with a different scenario.

Add a short list of roles for the exercise itself: a facilitator who reads the injects, a scribe who records decisions with times, and an observer who notes where the plan was not followed. Add the rule that the exercise is paused if any participant becomes distressed.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

Invented scenario: strange file names found on a shared drive at 09:10.
Stage 1 question: who do you tell, and what do you do with the computer? Expected: tell the lead, disconnect from the network without shutting down.
Scores out of 5: detection 3, decision speed 2, communication 2, use of the plan 1, recovery priorities 3. Total = 3 + 2 + 2 + 1 + 3 = 11 out of 25 = 44 percent.
Learning points: nobody knew where the plan was stored; no one owned customer messages.
Actions: print and store the plan offline; name a communications lead. Repeat in six months.

• audit