From: www.csoonline.

com
Tabletop Exercises: Three Sample Scenarios
Six tips and three scenarios to get you started on a tabletop exercise
by Sarah D. Scalet, CSO
December 01, 2006
A tabletop exercise is a great way to get business continuity plans off the written page without the interruption
of a full-scale drill. Rather than actually simulating a disaster, the crisis management group gathers for three
hours to talk through a simulated disaster.
It can be a full-scale production that involves local first responders and professional moderators. Or it can be a
simple affair conducted by in-house disaster planners. The idea is to have an escalating scenario that unfolds in
several segments. After each segment, small working groups discuss how they would respond, then report back
to each other before hearing from moderators about what happens next.
Tips for an Effective Tabletop
Decide how much gloom and doom you want. When planning a tabletop, J oe Flach, VP of Eagle
RockAlliance, asks, "Do you want this to be a physical event with assets damaged and destroyed, or do you just
want those things inaccessible? Do you want death and injuries, or just to test the ability to get work up and
going someplace else?"
Test how quickly you can pull together key players. At public utility PSE&G, Director of Corporate Security
Mike Paszynsky says the crisis management group doesn't always know when a tabletop will occur. Instead, the
company tests how quickly it could reach all those individuals. Specialized software pings team members' phone
numbers and communications devices, alerting them that the crisis management team is assembling.
Download CSOonline's Ultimate Guide to Business Continuity for even more BC/DR practicals [11 page
PDF free Insider registration is required]
Involve everyone. Make sure each person has a role. If one person answers all the questions, have others
enact how they would respond if that person were unavailable.
Acknowledge that first-timers may be nervous. "Some business managers don't want to show that they may
not know how to respond to a certain issue," says Rad J ones of Michigan State University. To make them more
comfortable, consider an hour-long orientation. Later, work your way up to a three-hour exercise, and then invite
local law enforcement and first responders to participate.
Encourage misinformation. During a crisis, Flach says, "you're always asked to make timely decisions based
on incomplete and inaccurate information." You can simulate the confusion this causes by giving the groups
handouts containing different information.
Take the lessons with you. A designated note-taker should keep track of what happens; always leave time for
lessons learned.
Scenario 1: A disgruntled employee starts a data center fire
Segment 1: A small fire begins just outside the data center, setting off the alarm system. By the time the fire
department arrives, the fire has been extinguished by the sprinkler system, but the building has been evacuated.
Print Close Window
Tabletop Exercises: Three Sample Scenarios http://www.csoonline.com/article/print/221132
1 of 3 9/17/2013 3:45 PM
Employees and people who work in nearby buildings want to know what has happened, as does the media.
Then, as people begin to go back inside, the receptionist takes a call from someone who indicates that the fire is
"only the beginning" because the company hasn't treated him right.
Segment 2: An employee discovers a box in the lobby with a handwritten warning that it contains anthrax.
Management decides to evacuate the building again. Calls come in from concerned family members, and local TV
crews arrive. Meanwhile, the sprinklers in the data center have caused the company's e-mail and Web servers to
stop working, which means the company's e-commerce site is down.
Segment 3: A woman calls the newspaper claiming to be the wife of an employee who's just been laid off and
who has left printouts about anthrax scattered in his home office. The newspaper calls the company with this
information. The health department is on scene. The company's call center (at another location) is swamped with
calls from customers who can't place orders at thewebsite.
Segment 4: The police apprehend a suspect. The health department determines that the box did not contain
anthrax and the building is safe. Some employees are afraid to come back to work.
Based on a suggestion by Rad J ones, academic specialist at Michigan State University's School ofCriminal
J ustice and former director of security and fire protection for Ford Motor.
Scenario 2: An explosion at a nearby chemical plant releases deadly toxins
Segment 1: An explosion occurs at a chemical plant two miles from headquarters. Local news media are
reporting that an undetermined number of the chemical company's employees have been injured or killed, and
officials are trying to determine to what extent deadly toxins have been released into the air. No one is sure what
caused the blast.
Segment 2: Area hospitals are crowded with people reporting breathing difficulties, and public health officials
are encouraging people all over the city to "shelter in place" as aprecaution. Headquarters is currently upwind of
the explosion. The company needs to decide what to tell its employees to do but isn't sure whether it has the
legal right to tell people not to leave. People are speculating that terrorists caused the explosion.
Segment 3: The company tells employees not to leave the building, but many do anyway, saying that they don't
trust what they're hearing and that they need to get home and take care of their families. The security guards at
the front door also want to know what to tell people on the street who want to take shelter in the company's lobby.
The cafeteria reports that it has already sold out of lunches.
Segment 4: The immediate danger passes, and authorities say the explosion was an accident. Several
employees have been hospitalized, and others are upset that the company cafeteria did not have more supplies
on hand.
Based on a suggestion by Mike Paszynsky, director of corporate security at PSE&G, aFortune 500 public utility
based in Newark, N.J .
Scenario 3: A pandemic flu hits
Segment 1: A pandemic flu starts sickening and killing people in Hong Kong,where the company does not have
any operations. The medical community fears that the disease will spread to other continents and says that
anyone who has been to Hong Kong in the past three weeks could be a carrier. As a precautionary measure, the
company considers asking employees who havetraveled to Hong Kong within the past three weeks not return to
work until they see a doctor. The company also considers having security at the front door ask every visitor
whether he or she has beento Hong Kong in the past three weeks.
Segment 2: A few people in the region are diagnosed with the disease, and the absentee rate at schools rises.
Employees start calling in sick, but it's not clear whether they are ill or afraid of going out in public. Enough
people are absent that the company struggles to keep systems up, take orders and pay bills.
Segment 3: The disease spreads, and absentee rates shoot up to almost 50 percent. Some employees are sick
or caring for sick family members. Employees are asking the company to provide for vaccinations and masks,
even though the medical community says thoseprecautions may not be effective. Critical functions are not getting
done. Managers consider letting crucial staff volunteer for a lockdownthose who volunteer would receive
vaccinations but then not be able to leave the building until the danger passes. They also consider rerouting work
to anotherlocation or calling in retired workers to help out.
Tabletop Exercises: Three Sample Scenarios http://www.csoonline.com/article/print/221132
2 of 3 9/17/2013 3:45 PM
Segment 4: The disease has peaked, but many employees are still leery of returning to work.
Based on a suggestion by J oe Flach, VP of Eagle Rock Alliance, a business continuity consulting firmin West
Orange, N.J .
CXO Media Inc.
Tabletop Exercises: Three Sample Scenarios http://www.csoonline.com/article/print/221132
3 of 3 9/17/2013 3:45 PM