CISA tabletop exercise packages, explained

CISA’s Tabletop Exercise Packages (CTEPs) are free, ready-made kits from the US Cybersecurity and Infrastructure Security Agency for running a discussion-based exercise on a scenario like ransomware. They are written for critical infrastructure owners and public safety partners, and they suit any team running a first exercise that is willing to do its own planning and write-up.

What CTEPs are

CISA says more than 100 packages exist, each customizable, and describes them as free planning tools. Each walks a group through an invented incident by discussion alone. Nobody touches a system.

CISA is candid about the limit. Its welcome letter says the exercises are “not a test of detailed response procedures” and that they focus on coordination and finding issues. A CTEP shows you who would decide what, and who hasn’t been told yet. It won’t show you whether your backups restore.

Access has shifted. A 2020 fact sheet described a restricted portal; a 2021 one says the products are on CISA’s website. If you can’t find one, email the contact listed on CISA’s page.

What’s in a package

The welcome letter lists nine documents: the letter, a fact sheet, planner and facilitator-evaluator handbooks, an invitation template, a slide deck, two feedback forms, and an after-action report and improvement plan template. The scenario lives in a separate situation manual. The set follows FEMA’s exercise method, HSEEP.

The ransomware manual for maritime ports shows the shape: two modules of about an hour each, one on initial actions, one on response and recovery. The sample schedule fills a morning and ends with a hot wash, the short group debrief straight after.

Which package fits which organization

CISA groups its cyber scenarios as ransomware, insider threat, phishing and industrial control system compromise, with sector versions for elections, local government, maritime ports, water and healthcare. The list changes, so check the page.

For a company of 50 to 300 people, ransomware is the usual first pick. Its decisions, such as whether to take systems offline and when to tell customers, are familiar to any leadership team. Insider threat suits a group where HR and legal need to be in the room, and industrial control scenarios suit manufacturers. Use a sector version only if you are in that sector. Whichever you pick, keep it simple: NIST SP 800-84 calls the belief that scenarios must be very detailed a common misconception.

How to run one well

Who to invite

NIST SP 800-84 says all personnel with responsibilities under the plan should take part. In practice, that is whoever would make or approve the calls: an executive, the IT or security lead, legal or privacy, communications, HR, operations, and whoever phones the insurer. BC’s toolkit suggests senior leaders, IT staff and incident response team members.

Roles and time

CISA’s situation manual uses four roles: players, observers, facilitators and note-takers. Name your note-taker before the day, and don’t make them a player.

NIST says tabletops typically run two to eight hours. CISA’s sample agenda fills a morning, Nacha’s kit suggests two to three hours, and BC’s 90 to 120 minutes. NIST suggests planning at least a month ahead.

Recording decisions

For each decision, write down what was decided, who made it, what they knew and what they didn’t. CISA’s facilitator and evaluator handbook covers capturing strengths, areas for improvement and recommendations. NIST says the after-action report draws on the hot wash and on criteria set beforehand. Give every fix an owner and a date, and keep the room no-fault: CISA’s manual says decisions made in the exercise are not precedent setting.

Our exercise evaluation guide shows how to score responses, and how to test an incident response plan covers the rest. No plan yet? Start with an incident response plan template.

Other free kits worth knowing

The Center for Internet Security’s Six Tabletop Exercises white paper dates from 2018. Each scenario can run in as little as 15 minutes, and it is aimed at a security team, not executives.
The UK National Cyber Security Centre’s Exercise in a Box is free and online. It has 20 exercises across 12 topics, from short micro exercises to full tabletops, and names small and medium-sized enterprises among its users. It is the gentlest start for a first-timer.
The Australian Cyber Security Centre’s Exercise in a Box is also free. Its discussion exercises run 30 to 120 minutes and include a scribe sheet and a report template.
The BC government’s Tabletop Exercise in a Box is a downloadable toolkit with a facilitator’s guide, a participant’s guide and a sample ransomware exercise. No price is listed.
FEMA’s HSEEP is a method for designing, running and evaluating exercises, not a cyber scenario kit.
Nacha’s kit for small and medium-sized businesses (October 2023) has a leader’s guide, an evolving ransomware scenario and participant workbooks. No price is listed.

What a free package won’t give you

None of this is a flaw in CISA’s packages. They were built to help you run your own exercise. The gaps come from what a self-run exercise can produce.

The first is an independent facilitator. Whoever leads an in-house session is part of the organization, with their own relationships and blind spots. Our longer comparison goes into this.

The second is an after-action report from outside the team. The package gives you a template, and someone on your team fills it in, about their own colleagues.

The third is a letter an insurer or auditor will accept, and it needs care. In our review of regulations, published carrier applications and vendor questionnaires, none required an outside facilitator. They ask whether the plan was tested, not who ran it. Still, a dated report and signed statement from someone with no stake in the result is easier for a stranger to rely on than your own notes, and no CISA package produces one. Ask your broker what your carrier accepts.

The fourth is Canadian context. CISA’s packages are written for US critical infrastructure and for coordination with US federal, state, local, tribal and territorial governments. A Canadian team has to add its own questions:

PIPEDA: a breach of security safeguards that creates a real risk of significant harm must be reported to the Office of the Privacy Commissioner, and affected individuals told as soon as feasible. Keep a record of every breach for 24 months.
Quebec Law 25: if a confidentiality incident presents a risk of serious injury, notify the Commission d’accès à l’information and the affected persons promptly. Keep a register of incidents.
OSFI: federally regulated financial institutions notify OSFI in writing within 24 hours, or sooner if possible, then send updates and report on their post-incident review.

In the US, your state breach laws, sector rules and contract notice terms play the same role, and the packages leave those to you too.

All your options compared

Option	Cost type	Effort for you	Who facilitates	Evidence you end up with
Free kit or template, run by your team	Free or paid	High	Someone on your team	Your own notes and report
Your MSP or vCISO	Paid, sometimes bundled	Medium	Their consultant, who may also support your systems	A report from someone who knows your setup but may not be independent
Specialist facilitator	Paid	Low to medium	An outside facilitator	An independent after-action report, often with an attestation letter
Large consultancy	Paid	Low to medium, longer lead time	An outside team	A formal report, usually inside a bigger scope
Insurer’s or IR firm’s service	Paid, or included in a policy or retainer	Low	The insurer’s panel or the IR firm	Depends on the provider, so ask

Choose by who will read the result. If it is your own leadership team, a free kit can be enough. If it is a broker, auditor or customer, ask what they want to see first. A sensible pattern is a free kit one year and an outsider the next.

Where to go next

Try the free four-minute browser exercise before you plan a full session. MyTabletops runs facilitated exercises, so we are one of the options in the table.

CISA tabletop exercise packages: a plain-English guide