Loading...
CISA / HSEEP
CISA Tabletop Exercise Guide
Follow CISA's proven HSEEP methodology for critical infrastructure protection and cyber resilience. Complete guide to exercise types, planning, and evaluation.
15 min read
Critical Infrastructure & Government
Why CISA Guidance Matters
The Cybersecurity and Infrastructure Security Agency (CISA) is the nation's risk advisor for 16 critical infrastructure sectors. CISA provides free exercise guidance, templates, and support to help organizations strengthen cyber resilience. Following CISA methodology ensures interoperability across sectors and alignment with federal expectations for critical infrastructure protection.
16
Critical infrastructure sectors
5
Exercise types in HSEEP
8
Planning steps
CISA Exercise Program Overview
CISA's Homeland Security Exercise and Evaluation Program (HSEEP) defines a progressive series of exercises designed to build and validate capabilities over time:
The CISA Exercise Progression
Five exercise types from discussion-based to operations-based
1
Orientation Seminar
Discussion-BasedIntroduce and overview new or updated plans, policies, or procedures
Characteristics:
- Primarily informational
- Low-stress environment
- Typically 2-3 hours
- Good for awareness building
WHEN TO USE:
After deploying new IR plan or procedures
PARTICIPANTS:
All stakeholders including non-technical staff
2
Workshop
Discussion-BasedBuild consensus and develop plans through working groups
Characteristics:
- Interactive and collaborative
- Produces tangible output (updated plans)
- Typically half-day to full-day
- Focused on problem-solving
WHEN TO USE:
When developing new procedures or updating existing ones
PARTICIPANTS:
Subject matter experts and planners
3
Tabletop Exercise (TTX)
Discussion-BasedEvaluate plans, policies, procedures through simulated incident
Characteristics:
- Scenario-driven discussion
- Tests decision-making
- 2-4 hours typically
- Identifies gaps in procedures
WHEN TO USE:
Regular validation of IR capabilities (quarterly)
PARTICIPANTS:
Decision-makers and key personnel
4
Drill
Operations-BasedTest and validate specific capabilities in isolation
Characteristics:
- Focused on single function
- Hands-on execution
- Examples: backup restoration, communication trees
- Measurable pass/fail criteria
WHEN TO USE:
Component testing of technical capabilities
PARTICIPANTS:
Technical staff executing the specific capability
5
Full-Scale Exercise
Operations-BasedValidate all capabilities in realistic, complex scenario
Characteristics:
- Comprehensive and resource-intensive
- Simulates real-world conditions
- Tests coordination across organizations
- Multi-day events
WHEN TO USE:
Annual comprehensive readiness validation
PARTICIPANTS:
All stakeholders, often multi-organizational
CISA Tabletop Exercise Planning Process
8-step HSEEP planning methodology
1
Establish Exercise Planning Team
Foundation8-12 weeks before exerciseIdentify planning team members, assign roles, schedule planning meetings
Key Deliverables:
Planning team rosterMeeting scheduleRoles and responsibilities
2
Define Scope and Objectives
Foundation8-12 weeks before exerciseDetermine what capabilities will be tested and what success looks like
Key Deliverables:
SMART objectivesScope statementCore capabilities list
3
Develop Scenario
Design6-8 weeks before exerciseCreate realistic scenario that drives toward exercise objectives
Key Deliverables:
Master scenario events list (MSEL)Scenario narrativeInjects
4
Develop Exercise Documentation
Design4-6 weeks before exerciseCreate exercise plan, situation manual, evaluation guides
Key Deliverables:
Exercise planSitManEvaluation guidesController/evaluator handbook
5
Coordinate Logistics
Preparation2-4 weeks before exerciseArrange facilities, materials, technology, participant notifications
Key Deliverables:
Participant invitationsFacility arrangementsTechnology setup
6
Conduct Exercise
ExecutionExercise dayExecute the tabletop exercise according to plan
Key Deliverables:
Exercise executionController notesObserver notes
7
Evaluate Performance
EvaluationDuring and immediately afterAssess performance against objectives, identify strengths and gaps
Key Deliverables:
Evaluation notesHot wash notesParticipant feedback
8
Develop After-Action Report
Improvement2-4 weeks after exerciseDocument findings, recommendations, improvement plan
Key Deliverables:
After-Action Report (AAR)Improvement Plan (IP)Corrective actions
Critical Infrastructure Focus
CISA recognizes 16 critical infrastructure sectors. Tabletop exercises should consider sector-specific threats and cross-sector dependencies:
⚡
Energy
Grid disruption, SCADA/ICS attacks, NERC CIP compliance
🏥
Healthcare
Patient data breaches, medical device security, HIPAA compliance
🏦
Financial Services
Payment system disruption, fraud, PCI DSS compliance
✈️
Transportation
Operational technology attacks, GPS spoofing, TSA requirements
💧
Water/Wastewater
SCADA attacks, treatment disruption, EPA compliance
📡
Communications
Network outages, data interception, FCC requirements
🏛️
Government
Classified data, citizen data breaches, FISMA compliance
🏭
Manufacturing
OT/IT convergence, IP theft, supply chain attacks
Cross-Sector Dependencies
CISA emphasizes testing cross-sector coordination. Example scenario: "Ransomware attack on healthcare organization also disrupts communications (VoIP) and energy (backup generators offline). How do you coordinate response across sectors and with CISA?"
CISA Evaluation Methodology
CISA provides standardized evaluation guides that assess performance against core capabilities:
Planning
- • Are plans current and accessible?
- • Do participants know their roles?
- • Are procedures clear and actionable?
Operational Coordination
- • Is communication timely and effective?
- • Are decision-making authorities clear?
- • Is coordination with external entities effective?
Intelligence & Information Sharing
- • Is information shared appropriately?
- • Are reporting procedures followed?
- • Is threat intelligence integrated?
Operational Communications
- • Are backup communications available?
- • Can teams communicate during outages?
- • Are communication protocols followed?
Public Information & Warning
- • Are messages timely and accurate?
- • Is coordination with PIO effective?
- • Are stakeholders appropriately informed?
Cybersecurity
- • Are cyber threats detected quickly?
- • Are response actions appropriate?
- • Is recovery timely and complete?
CISA Resources and Support
Free tools and assistance available from CISA
Exercise Starter Kits
Pre-built scenarios, templates, and planning guides for common threat scenarios
How to Access:
Download from cisa.gov/exercise-starter-kits
Includes:
Scenario templatesMSEL templatesSitMan templatesAAR templates
CISA Exercise Support
Free facilitation support and subject matter experts for exercises
How to Access:
Request via cisa.gov/request-exercise-support
Includes:
Exercise planning assistanceFacilitatorsEvaluatorsPost-exercise support
Cyber Exercise Playbook
Detailed guidance on planning and conducting cyber exercises
How to Access:
Download from cisa.gov/cyber-exercise-playbook
Includes:
Best practicesSample scenariosFacilitation tipsEvaluation guides
After-Action Report Templates
Standardized formats for documenting exercise results
How to Access:
Available at hseep.dhs.gov
Includes:
AAR formatImprovement plan formatCorrective action tracking
Reporting to CISA
Critical infrastructure organizations should consider sharing exercise findings with CISA to contribute to national resilience:
When Required
- • If exercise reveals reportable incident
- • If funded by CISA grants
- • If CISA support was provided
When Encouraged
- • Significant capability gaps identified
- • Cross-sector coordination tested
- • Novel attack vectors simulated
When Optional
- • Internal exercises
- • Routine testing
- • Vendor-led exercises
CISA-Aligned Tabletop Exercises
Breakpoint scenarios follow CISA HSEEP methodology and include sector-specific scenarios for all 16 critical infrastructure sectors. Generate CISA-compliant After-Action Reports automatically.
Related Articles
Creating Effective Tabletop Exercise Scenarios
The Goldilocks Principle for scenario design, 5-layer model, and inject techniques
Read more →
How to Test Your Incident Response Plan
The IR Testing Pyramid, 5 testing methods, and annual testing calendar
Read more →
NIST Incident Response Framework Guide
4 NIST phases and key incident response metrics (MTTD, MTTA, MTTC, MTTR)
Read more →