What is the incident tabletop exercise form template?
A tabletop exercise walks a team through a simulated incident, such as ransomware, a data breach or a compromised supplier, to test the plan and the people before a real one. The discussion is usually valuable; the problem is that it often isn't written down, and the same gaps show up next year.
This form records an exercise in four parts: the scenario, type, plan tested and objectives; who took part and which functions were represented; what the team decided at detection and escalation, containment, recovery and communication; and what went well, the gaps found, improvement actions with owners, whether the plan needs updating and a readiness rating.
Each record is saved as a PDF in your FileIt vault with the scenario materials, giving you evidence of regular exercises and a clear list of actions to follow up before the next one.
- Best for
- Security, IT and risk teams running incident response exercises
- Filled in by
- The exercise facilitator or note-taker
- Time to complete
- About 20 minutes after the exercise
- Includes
- Scenario types, functions represented, decisions by stage, gap checklist, improvement actions, readiness scale and materials upload
Who uses a incident tabletop exercise form?
- An annual ransomware tabletop with leadership
- Testing a new incident response plan or playbook
- Exercises with legal, communications and an external response partner
- Evidence of exercises for an insurer, customer or certification audit
- Small organisations running their first cyber exercise
- Comparing readiness across repeated exercises
Questions on this incident tabletop exercise form
27 questions over 4 pages · includes signature, file upload, conditional questions, multiple pages, ratings.
1 Exercise & scenario
- Facilitator*
- Exercise date*
- Duration (minutes)
- Format* In person · Remote · Hybrid
- Plan or playbook tested
- Scenario title*
- Scenario type* Ransomware · Phishing or business email compromise · Data breach · Insider threat · Denial of service · Cloud misconfiguration · Third-party or supply chain compromise · Lost or stolen device · Other
- Scenario summary*
- Exercise objectives*
2 Participants
- Participants*
- Functions represented* IT operations · Security · Executive leadership · Legal · Communications or PR · HR · Finance · Business operations · Privacy or data protection · External incident response partner · Insurer
- Observers or note-takers
3 Decisions by stage
- Detection and escalation*
- Containment*
- Eradication and recovery
- Communication
- Key decisions and who made them
4 Gaps & actions
- What went well
- Gaps found*
- Areas that need work Contact lists out of date · Roles and responsibilities unclear · Plan missing steps · Logging or detection tooling · Backups or recovery · Decision authority · Regulatory or contractual notification · External communication · Third-party or vendor contacts
- Improvement actions*
- Does the plan or playbook need updating?*
- What needs to change in the plan or playbook?* asked only when it applies
- How ready is the team for a real incident like this?*
- Next exercise
- Scenario slides, injects or notes
- Facilitator's signature*
The incident tabletop exercise form, page by page
1 Exercise & scenario
The facilitator, exercise date, duration, format and the plan or playbook tested come first. The scenario title and type are required, with types ranging from ransomware and email compromise to cloud misconfiguration and supply chain compromise. A scenario summary with the injects used, and the exercise objectives, are required.
2 Participants
Participants are listed by name and role. A required checklist records which functions were represented, from IT and security to legal, communications, HR, finance, privacy, an external response partner and the insurer. Observers or note-takers can be named.
3 Decisions by stage
Detection and escalation and containment are required, recording what the team decided and what slowed them down. Eradication and recovery, communication with staff, customers, regulators and others, and key decisions with who made them complete the timeline.
4 Gaps & actions
What went well and the required gaps found are followed by a checklist of areas that need work, such as contact lists, roles, plan steps, tooling, backups, decision authority and notifications. Improvement actions with owners and dates are required, along with whether the plan needs updating (a yes asks what needs to change) and a 1 to 5 readiness rating. The next exercise date, scenario materials and the facilitator's signature finish the record.
Make the template yours
- Add your organisation's incident severity levels to the scenario page
- Add a timeline field for each inject if you run longer exercises
- Make the materials upload required so slides are kept with the record
- Send notifications to the CISO or risk owner
- File records into a vault folder for audit evidence
Tips for a better incident tabletop exercise form
- Set clear objectives before the exercise and check them afterwards
- Include people who would make the real decisions, not just IT
- Record decisions and hesitations, not just the 'right' answers
- Give every improvement action one owner and a date
- Start the next exercise by reviewing the last one's actions
Every response becomes a PDF in your vault
Each exercise is saved as a PDF in your FileIt vault with the scenario materials attached, ready to share with leadership or provide as evidence that exercises are taking place.
Export the Responses table to CSV to compare readiness ratings and recurring gaps over time.
- Start from this template. It opens in the FileIt Forms designer — change any question, add pages, set the rules for when questions appear.
- Share it. Turn on a public link, or send it to people by email, each with their own link. They don’t need a FileIt account.
- Get the answers as PDFs. Each response is saved as a PDF in the vault folder you choose, with uploaded files attached — and listed in a Responses table you can export to CSV.
Incident tabletop exercise form: frequently asked questions
Is this incident tabletop exercise template free?
Yes. It's included in the FileIt Forms app on every account, including the free plan, and every question can be edited, removed or added to in the form designer.
Does the template include scenarios?
No. It records an exercise you've designed. The scenario type list helps categorise exercises, and you can upload your scenario slides or injects.
Can it be used for non-security exercises?
Yes. Choose Other as the scenario type and adapt the stage questions, for example for a business continuity or outage exercise.
Who should fill it in?
Usually the facilitator or a dedicated note-taker, soon after the exercise while the discussion is fresh.
Is this enough to meet audit or regulatory requirements for exercises?
It provides a structured record, but requirements vary. Check what your auditor, insurer or regulator expects to see.
Do participants need a FileIt account to fill it in?
No. Anyone with the form's link can submit it without creating an account. You can also email personal links to specific people.