How to run a tabletop incident drill in 60 minutes
A tabletop drill should feel like a real incident, not a group workshop. Keep it short and outcome‑focused.
Prep (10 minutes the day before)
- Pick a realistic failure with a clear impact signal.
- Assign roles: incident lead, comms lead, scribe.
- Choose one truth dashboard you’ll use to measure impact.
If you can’t name the impact signal, the scenario is too vague.
The 60-minute agenda
- 0-5: scenario brief and role assignment.
- 5-20: first checks and impact confirmation.
- 20-35: safe mitigations and verification.
- 35-45: comms cadence and escalation decision.
- 45-60: debrief and follow-up owners.
Debrief prompts
- What slowed us down in the first 10 minutes?
- Which runbook step was missing or ambiguous?
- What verification step did we skip?
- What ownership gap showed up?
End the debrief with owners and due dates. Notes without owners don’t change behavior.
Common failure modes
- No single impact signal, so the team argues instead of acting.
- Mitigation steps with no verification or rollback criteria.
- Debrief ends with notes but no owners.
Run the drill quarterly and make one concrete runbook update each time.