Are free tabletop templates good enough, or do you need a facilitated exercise?

The free packages are good. Use them. Governments in three countries publish complete tabletop kits with scenarios, facilitator guides and report templates, and a self-run exercise using one of them will find real problems in your response. The gap between that and a facilitated exercise is not quality and it is not scenario design. It is that a self-run exercise produces your own account of what happened, and a facilitated one produces an account from somebody who is not you. Whether that difference matters depends entirely on who is going to read it.

What is actually available for free?

More than most people realise, and the quality is high.

CISA’s Tabletop Exercise Packages. The library includes more than 100 sample situation manuals addressing a variety of critical infrastructure sectors, threat vectors, and scenarios (CISA, Tabletop Exercise Package fact sheet, 2021). Each package carries a planner handbook, a facilitator and evaluator handbook, an invitation letter template, a slide deck, a participant feedback form, a situation manual and an after-action report template. CISA states no eligibility restriction and no price, so a Canadian firm downloading one is doing something CISA neither invites nor forbids.

The UK National Cyber Security Centre’s Exercise in a Box. Described by NCSC as A free resource to help organisations rehearse their response to cyber attacks, with 20 exercises across twelve topics including ransomware, phishing and supply chain (UK National Cyber Security Centre, Exercise in a Box, 2026). NCSC says it is completely free and that you do not have to be an expert to use it, and names small and medium enterprises among its users. Of everything listed here it asks the least of a first-timer.

British Columbia’s Tabletop Exercise in a Box. BC describes it as A tool designed to simulate cyber threat scenarios and assess your organization’s readiness and resilience against cyberattacks, and the toolkit contains a facilitator’s guide, a participant’s guide and a sample exercise (Government of British Columbia, Tabletop Exercise in a Box, 2025). It sits in the province’s services-for-government area, so treat it as a public-sector resource that happens to be published openly.

And ours. We publish the three-hour agenda we run and the report skeleton that follows it. It is linked at the bottom of this page and it states on its first page what a self-run exercise does not produce.

What Canada does not have is its own kit. The Canadian Centre for Cyber Security recommends running an exercise and points readers at NIST and SANS, but publishes no scenario pack, no templates and no facilitator guide of its own.

What does each option actually give you?

	Self-run from a free kit	Self-run with a good internal facilitator	Facilitated by an outside party
Scenario quality	High. The public packages are professionally built	High	High, and built around your actual plan
Cost	Nothing but calendar time	Internal time	A fee
Findings	Real, and often uncomfortable	Real, and usually deeper	Real, and recorded by someone with no stake
Written report	If somebody writes it	If somebody writes it	Always, within 15 days
Who vouches for it	You	You	Someone outside your response
Good for	Getting better	Getting better, faster	Getting better, plus evidence

The row that decides it is the second from the bottom. Everything above it, a competent internal team can do, and in one respect can do better: they know which decisions were genuinely hard, and an outsider has to infer that.

Is there a rule requiring an outside facilitator?

No, and this is worth stating plainly because the opposite is widely implied.

We went looking specifically for a requirement that incident response testing be conducted or witnessed by an independent or third party. We checked regulations, published carrier applications and vendor security questionnaires. It does not exist. Every instrument we could verify asks whether testing happened. None of them asks who ran it.

New York’s financial services rule is the clearest illustration, because it names a party for one control and not the other. For penetration testing it requires a qualified internal or external party (NYDFS, 23 NYCRR 500.5(a)(1), 2023), permitting internal staff as long as they are qualified. For incident response plan testing it names no party at all, requiring only that the plan be tested with the staff and management critical to the response.

NIST’s exercise guidance points the same way. Its tabletop chapter assumes the facilitator is designated by the organisation’s own design team and expects them to be thoroughly familiar with the plan being exercised. That is an insider, by design.

So if somebody tells you a standard requires third-party facilitation, ask them which one. There is not one.

Then why pay for it?

Because the question on the form is not the only question, and because of what happens to a self-produced record when somebody reads it sceptically.

Your own notes of your own exercise are evidence of your account of the exercise. That is not nothing, and for an auditor it is frequently sufficient. For an underwriter deciding what to charge, or a claims reviewer a year later reading the file backwards, an account produced entirely inside the organisation being assessed carries less weight than the same account confirmed by somebody with no stake in it. Not because anyone assumes you are lying. Because a control assessed only by the people who operate it is the easiest one on any list to overstate, and everyone reading knows that.

There is also a practical difference that has nothing to do with evidence. An internal facilitator is a participant. They know the answer, they know who is defensive about what, and when the room goes quiet they tend to fill the silence. An outsider can let it sit.

That silence matters more than it sounds. A hard question buys a minute or two of nothing, then three or four voices go, warming the room up, and the fifth person says the thing that actually answers it. An internal facilitator who closes the gap at second thirty never gets to the fifth person, and the exercise quietly becomes a briefing.

What does the difficulty level depend on?

Not on what you pay, which surprises people.

Difficulty is set by the maturity of the team, not by the provider. A first-timer, or a technical or executive group that has not done this before, should get a contained ransomware or malware outbreak. Everyone else gets a crisis. Handing a hard scenario to a room that has never rehearsed produces a bad afternoon and a thin report, because they stall on the first decision and never reach the interesting part.

If you are self-running for the first time, pick the simplest scenario in the pack. The temptation is to pick the dramatic one, and it is the wrong call.

What we would actually suggest

Run one yourself first, this quarter, using any of the kits above. It costs an afternoon and it will surface things you did not know.

Then read the incident response question on your renewal application again, and ask what you would produce if somebody wanted to see evidence of what you just did. If the answer is a calendar invitation and your own notes, you know where the gap is. If nobody is ever going to ask, you have already got the value.