Executive Tabletop Exercise Kit

Regulators stopped accepting a documented response plan some time ago. NYDFS 500.16(d) wants the plan tested, "including senior officers"; DORA Art. 11 and NIS2 Art. 20 say the same in their own words; and your insurer's application asks when your last exercise was. An untested plan and no plan are now treated as roughly the same thing.

These scenarios are built around executive decisions, not security events. That is the difference that makes a board exercise work. Each of the 64 injects names the decision it forces — who calls the bank, whether to disable the agent, pay or don't — and the question to put to the room. And "unknown at this time" is a legitimate state the group has to handle rather than a gap in the script, because that is the actual condition of hour one.

The eight scenarios, ninety minutes each: ransomware with a payment decision · supplier breach where the MSP is the vector · cloud identity provider compromise · the departing administrator · deepfake CFO funds-transfer fraud · OT outage with the plant dark · data extortion without encryption and the leak site · AI-agent misuse, the assistant that acted.

The last two did not exist in a 2023 scenario set and are now among the most likely.

01 Facilitator Guide (PDF) — why executive tabletops changed, what good looks like, choosing a scenario, two-week prep, room rules and dynamics, running the ninety minutes, scoring, the after-action report, the evidence statement, the annual programme, delivering it as a vCISO, the failure modes and an FAQ.

02 Scenario Packs (DOCX × 8) — objectives, the situation to read aloud, eight timed injects each with its forced decision and question, what good looks like, stall prompts for when the room goes quiet, the rubric and the hot-wash.

03 Inject Cards (PPTX + 80-page printable PDF) — one card per inject across all eight scenarios, plus situation and hot-wash slides. Load them into the tool or print them.

04 Decision Log & Scoring (XLSX) — pick the scenario and the injects and objectives pre-fill, so the scribe only types decisions and minutes-to-decide. The sheet produces a 0–12 objective rating and a mean time-to-decide that trends across exercises, which is what turns a series of events into a programme.

05 Participant Pre-Reads (DOCX) — two pages per scenario with no spoilers: situation, role responsibilities, what to think about beforehand.

06 After-Action Report Template (DOCX) — summary, scores, decision timeline, findings sorted by category (authority, information, plan, control, communication), actions, and a one-paragraph regulatory evidence statement citing NYDFS 500.16(d), DORA Art. 11, NIS2 Art. 20, ISO 27001 and SOC 2 CC7.3. That paragraph is the artefact a general counsel files after the session.

07 Board Readout (PPTX) — two slides: objectives and scores, then findings, changes and decisions.

08 Annual Exercise Calendar (XLSX) — a quarterly rotation with a Q4 full test including senior officers, plus a scenario × regime × kit matrix so each exercise evidences something specific.

scenarios.json — all eight scenarios with injects and rubric, structured to import straight into tabletopsec.com, the live-delivery layer: timed injects on screen, decision capture in the room, scores tracked across clients. The kit ships the content; the tool runs the room. Use either alone or both together.

Where this sits. The Tabletop Exercise Pack is the 13-tab IR exercise programme management system with 10 scenarios, a maturity scorecard and a gap tracker — built for a security team maturing its own IR practice. This kit is the executive session itself: ninety minutes, decision-forcing injects, a scored log and the evidence statement, for a room of executives rather than responders. Range R05 is the purple-team counterpart for technical teams.

Pairs with I've Been Breached — the command playbook the room should be reaching for during S1 — and with CIRCIA-01, SEC-01 and the NYDFS Part 500 Kit, whose clocks the injects start.

The scenarios are fiction. Exercise support, not legal advice.