/* _glossary-shared.css */ :root{ --ink:#0B0B0C; --muted:#6B7280; --bg:#FFFFFF; --panel:rgba(11,11,12,.04); --stroke:rgba(11,11,12,.10); --stroke2:rgba(11,11,12,.14); --max:1120px; --r:16px; --r2:24px; } *{box-sizing:border-box;} html,body{margin:0;padding:0;} body{ font-family:Poppins,system-ui,-apple-system,Segoe UI,Roboto,Arial,sans-serif; color:var(--ink); background:var(--bg); } .wrap{max-width:var(--max); margin:0 auto; padding:0 20px;} .ob-page-pad{padding:64px 0;} .ob-nav{ position:sticky; top:0; z-index:20; background:var(--ink); border-bottom:1px solid rgba(255,255,255,.08); } .ob-nav-inner{ max-width:var(--max); margin:0 auto; padding:14px 20px; display:flex; align-items:center; justify-content:space-between; gap:16px; } .ob-logo{display:flex; align-items:center; gap:10px; text-decoration:none; color:#fff;} .ob-logo img{height:22px; width:auto; opacity:.95;} .ob-nav-links{display:flex; align-items:center; gap:18px; flex-wrap:wrap;} .ob-nav-links a{color:rgba(255,255,255,.86); text-decoration:none; font-weight:500; font-size:14px;} .ob-nav-links a:hover{color:#fff;} .ob-nav-cta{ padding:10px 14px; border-radius:999px; background:#fff; color:var(--ink) !important; font-weight:700; } .ob-breadcrumb{ background:rgba(11,11,12,.03); border-bottom:1px solid rgba(11,11,12,.06); } .ob-breadcrumb .wrap{padding:12px 20px;} .ob-breadcrumb a{color:rgba(11,11,12,.75); text-decoration:none; font-weight:600; font-size:13px;} .ob-breadcrumb .sep{color:rgba(11,11,12,.35); padding:0 6px;} .ob-breadcrumb .current{color:rgba(11,11,12,.78); font-weight:700; font-size:13px;} .ob-hero-tag{ display:inline-flex; align-items:center; gap:8px; padding:8px 12px; border-radius:999px; background:rgba(11,11,12,.06); border:1px solid rgba(11,11,12,.10); color:rgba(11,11,12,.75); font-weight:700; font-size:12px; letter-spacing:.02em; } h1{font-size:52px; line-height:1.06; letter-spacing:-.03em; margin:14px 0 12px;} .ob-sub{font-size:18px; line-height:1.7; color:var(--muted); max-width:78ch; margin:0;} .ob-btn-row{display:flex; gap:12px; flex-wrap:wrap; margin-top:18px;} .ob-btn{ display:inline-flex; align-items:center; justify-content:center; padding:12px 18px; border-radius:999px; text-decoration:none; font-weight:700; border:1px solid transparent; transition:transform .06s ease, background .12s ease, border-color .12s ease; } .ob-btn:active{transform:translateY(1px);} .ob-btn-primary{background:var(--ink); color:#fff;} .ob-btn-primary:hover{background:rgba(11,11,12,.92);} .ob-btn-secondary{background:transparent; color:var(--ink); border-color:var(--stroke2);} .ob-btn-secondary:hover{background:rgba(11,11,12,.03);} .ob-section{padding:44px 0;} .ob-section-tint{ background:linear-gradient(180deg, rgba(11,11,12,.03), rgba(11,11,12,0)); border-top:1px solid rgba(11,11,12,.06); border-bottom:1px solid rgba(11,11,12,.06); } .ob-eyebrow{ font-size:12px; letter-spacing:.14em; text-transform:uppercase; color:var(--muted); font-weight:800; margin:0 0 10px; } .ob-title{font-size:32px; line-height:1.15; letter-spacing:-.02em; margin:0 0 12px;} .ob-body{font-size:16px; line-height:1.7; color:var(--muted); margin:0;} .ob-body p{margin:0 0 12px;} .ob-body p:last-child{margin-bottom:0;} .ob-grid{display:grid; gap:18px;} .ob-grid-3{grid-template-columns:repeat(3,1fr);} .ob-grid-2{grid-template-columns:repeat(2,1fr);} .ob-card{ border:1px solid var(--stroke); border-radius:var(--r); background:#fff; padding:18px; } a.ob-card{display:block; text-decoration:none; color:inherit;} a.ob-card:hover{border-color:rgba(11,11,12,.16); box-shadow:0 10px 30px rgba(11,11,12,.06); transform:translateY(-2px);} .ob-card h3{font-size:18px; margin:0 0 8px; line-height:1.35;} .ob-card .ob-card-sub{color:var(--muted); font-size:14px; line-height:1.6; margin:0 0 10px;} .ob-card .ob-card-link{font-weight:800; color:rgba(11,11,12,.82); font-size:14px;} .ob-definition{ border:1px solid rgba(11,11,12,.10); background:var(--panel); border-radius:var(--r2); padding:18px; } .ob-definition p{margin:0; color:rgba(11,11,12,.78); font-size:16px; line-height:1.75;} .ob-bullets{margin:10px 0 0; padding-left:18px; color:var(--muted); line-height:1.7;} .ob-bullets li{margin:6px 0;} .ob-callout{ border:1px solid rgba(11,11,12,.10); background:linear-gradient(180deg, rgba(11,11,12,.05), rgba(11,11,12,.02)); border-radius:var(--r2); padding:18px; } .ob-callout strong{color:var(--ink);} .ob-callout p{margin:0; color:rgba(11,11,12,.78); line-height:1.7;} .ob-faqs{display:grid; gap:10px; margin-top:12px;} details.ob-faq{ border:1px solid rgba(11,11,12,.10); border-radius:14px; padding:12px 14px; background:#fff; } details.ob-faq summary{ cursor:pointer; font-weight:800; color:rgba(11,11,12,.86); } details.ob-faq p{margin:10px 0 0; color:var(--muted); line-height:1.7;} .ob-related{display:flex; flex-wrap:wrap; gap:10px; margin-top:10px;} .ob-chip{ display:inline-flex; align-items:center; padding:9px 12px; border-radius:999px; border:1px solid rgba(11,11,12,.10); background:rgba(255,255,255,.92); font-weight:700; font-size:13px; color:rgba(11,11,12,.78); text-decoration:none; } .ob-chip:hover{background:rgba(11,11,12,.03);} .ob-cta{ margin-top:18px; border-radius:var(--r2); border:1px solid rgba(11,11,12,.10); background:linear-gradient(180deg, rgba(11,11,12,.06), rgba(11,11,12,.02)); padding:22px; } .ob-cta h2{margin:0 0 8px; font-size:26px; letter-spacing:-.02em;} .ob-cta p{margin:0; color:var(--muted); line-height:1.7;} .ob-cta .ob-btn-row{margin-top:14px;} .ob-footer{ margin-top:60px; background:var(--ink); color:rgba(255,255,255,.72); } .ob-footer-inner{ max-width:var(--max); margin:0 auto; padding:26px 20px; display:flex; flex-wrap:wrap; align-items:center; justify-content:space-between; gap:14px; } .ob-footer a{color:rgba(255,255,255,.78); text-decoration:none; font-weight:600; font-size:14px;} .ob-footer a:hover{color:#fff;} .ob-footer small{opacity:.7;} .ob-divider{height:1px; background:rgba(11,11,12,.08); border:0; margin:0;} /* Scroll reveal */ .ob-reveal{opacity:0; transform:translateY(14px); transition:opacity 650ms cubic-bezier(.2,.8,.2,1), transform 650ms cubic-bezier(.2,.8,.2,1);} .ob-reveal.is-visible{opacity:1; transform:none;} .ob-stagger > *{opacity:0; transform:translateY(14px); transition:opacity 650ms cubic-bezier(.2,.8,.2,1), transform 650ms cubic-bezier(.2,.8,.2,1);} .ob-stagger.is-visible > *{opacity:1; transform:none;} .ob-stagger.is-visible > *:nth-child(1){transition-delay:0ms;} .ob-stagger.is-visible > *:nth-child(2){transition-delay:80ms;} .ob-stagger.is-visible > *:nth-child(3){transition-delay:160ms;} .ob-stagger.is-visible > *:nth-child(4){transition-delay:240ms;} .ob-stagger.is-visible > *:nth-child(5){transition-delay:320ms;} .ob-stagger.is-visible > *:nth-child(6){transition-delay:400ms;} @media (prefers-reduced-motion: reduce){ .ob-reveal,.ob-stagger > *{opacity:1 !important; transform:none !important; transition:none !important;} } @media (max-width:980px){ h1{font-size:40px;} .ob-grid-3,.ob-grid-2{grid-template-columns:1fr;} .ob-page-pad{padding:52px 0;} }
What Is a Tabletop Exercise (TTX)? Definition & Guide | Opsbook
Home/ Glossary/ Tabletop Exercise
Glossary

What Is a Tabletop Exercise (TTX)?

A tabletop exercise (TTX) is a discussion-based simulation in which key stakeholders walk through a realistic incident scenario to test response plans, clarify roles, and identify gaps without real-world consequences. TTXs are one of the most widely used tools in business continuity and incident response planning.


Key Elements of a Tabletop Exercise

  • A defined scenario designed to reflect realistic operational or cyber threats
  • Assigned roles and responsibilities for every participant
  • Facilitated decision-making under pressure, uncertainty, and time constraints
  • An after-action report capturing what worked, what failed, and what must change
  • Follow-through in the form of updated plans, playbooks, and retesting

Why Tabletop Exercises Matter for CISOs and BC/DR Leaders

Annual audits can confirm that a plan exists. A tabletop exercise tests whether the people responsible for executing that plan actually know what to do.

For security and continuity leaders, TTXs expose the coordination gaps documents rarely show: unclear decision authority, stale contact trees, untested recovery assumptions, and communication failures between teams that only surface under stress.

That makes tabletop exercises one of the fastest ways to move from passive documentation to operational readiness.

Tabletop Exercises and Regulatory Requirements

Scenario-based resilience testing is increasingly expected across regulated industries. DORA expects documented resilience testing outcomes, NIS2 emphasizes validated incident response capability, and broader cyber governance expectations continue to shift from “do you have a plan?” to “have you tested it?”

That does not mean every organization must run a massive live simulation. For many teams, the practical baseline is a well-structured TTX with documented findings and tracked remediation.

See how TTX applies in practice: Financial Services · Public Sector

How Opsbook Helps with Tabletop Exercises

Opsbook automates the parts of tabletop exercises that usually create the most overhead: scenario creation, role mapping, structured injects, and after-action reporting.

That lets organizations move from one annual exercise to a repeatable program with monthly or quarterly practice—without relying on weeks of manual prep for every session.

Frequently Asked Questions

How long does a tabletop exercise take?

Most tabletop exercises run 2–4 hours, depending on scenario complexity and participant count. The bigger issue is usually prep time, which is why so many organizations only run them once or twice a year.

Who should participate in a tabletop exercise?

Anyone who would have a role in the real incident: security, IT, legal, comms, operations, leadership, and any functional teams that would make or approve decisions.

How often should organizations run tabletop exercises?

Two to four times per year is a practical baseline for most organizations. Higher-risk or more regulated environments often need a more frequent cadence.

What is the difference between a tabletop exercise and a full simulation?

A tabletop exercise is discussion-based. A full simulation activates real systems, procedures, or staff. TTXs are easier to run frequently; full simulations provide deeper validation but require more resources.

Related Terms

Ready to put tabletop exercises into practice?

Run measurable, repeatable exercises and turn every session into tracked improvements.