# Run a tabletop exercise for a cyber incident

Builds a realistic tabletop scenario with timed injects, discussion questions, and a scoring sheet for your response team.

- Topic: Projects & Operations
- Framework: Few-Shot
- Level: Standard
- Tags: Plan, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/run-a-tabletop-exercise-for-a-cyber-incident

## Prompt

```text
Design a tabletop exercise to test our incident response.

**Scenario type:** [e.g. "ransomware", "vendor breach exposing our customer data", "CEO email compromise and wire fraud", "cloud outage"]
**Participants:** [roles - IT, security, legal, comms, executives, finance]
**Length:** [e.g. 90 minutes]
**What we want to test:** [e.g. "decision to shut down systems", "who talks to customers", "backup restore assumptions"]
**Our current plan or playbook:** [summary, or "we don't have one yet"]

Create:
1. Objectives: 3-4 things we want to learn, in measurable terms.
2. Ground rules: no-fault, decisions in real time, assume the playbook is all we have.
3. The scenario in 4-6 timed injects, each escalating: what participants learn, the time elapsed in the story, and a curveball (e.g. key person unreachable, backups also encrypted, a journalist calls).
4. For each inject: 3-5 discussion questions aimed at specific roles, and the decisions we expect them to make.
5. A facilitator guide: timing, how to keep it moving, what to do if a group gets stuck.
6. An observer scoring sheet: decision made, time taken, who owned it, gaps found.
7. A hot-wash agenda and an after-action report template with action items, owners, and deadlines.

Keep the scenario realistic for our size and environment; avoid movie-style attacks. Do not include real organization or person names in the scenario.
```

## What to fill in

- roles - IT, security, legal, comms, executives, finance
- e.g. 90 minutes
- summary, or "we don't have one yet"

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.