An incident exercise across facilities and IT should test whether people can identify the right decision owner, share the information that owner needs and acknowledge the handoff. Start with a limited discussion scenario, explicit boundaries and a decision log. Leave with a named owner and review date for each gap in the plan.
Working through this in production? See how we run a coordinated security planning across facilities and IT.
The exercise below is a planning conversation. It involves no live system changes, physical interventions or simulated emergency calls. It does not test the effectiveness of site protection or replace a specialist-led operational exercise.
Define the decisions before writing the story
Choose a business process that depends on both a site and an information system. Examples include a contractor assignment, a visitor approval process or access to a shared workspace. Select the one your participants actually own; keep the scenario small enough to discuss unresolved responsibilities in detail.
Set three objectives: find the owner of a cross-department concern, identify who can approve a business decision and explain what acknowledgment completes the handoff. Write down what evidence would demonstrate each objective. “Everyone attended” establishes attendance, not decision readiness.
Our incident response planning guide for organizations without a security team helps establish the existing decision rights. The physical and cyber handoff responsibility map adds the facilities boundary to that discussion.
CISA’s Tabletop Exercise Packages provide customizable objectives, scenarios and discussion questions. Its CTEP Package Documents, revised February 2, 2023, include planner and facilitator materials, feedback forms and an after-action report template. These are useful starting resources; the agenda below is an original illustrative adaptation.
Invite roles with actual authority
Include the process owner, facilities representative, IT owner and someone with the authority to make the relevant business decision. Invite the landlord or contracted provider when the scope depends on its responsibilities and participation is agreed. A colleague should not answer on behalf of an absent provider whose contractual role is unresolved.
Assign a facilitator to present the scenario and an observer to record decisions and unanswered questions. Participants can use role names rather than personal details in shared notes. Use synthetic records: the discussion does not need customer data, real access histories or credential documents.
Planning artifact: a bounded discussion agenda
Hypothetical scenario: a contractor’s assignment has ended. The business-account owner reports that access was reviewed, but the facilities record has no acknowledgment from the site-permission owner. The usual coordinator is unavailable. No physical event or wrongdoing is assumed.
This sample agenda allocates 60 minutes for planning purposes, not as a CISA requirement or a promise of readiness.
| Discussion block | Time | Question to resolve |
|---|---|---|
| Scope and objectives | 10 minutes | Which decisions are we rehearsing? |
| Initial handoff | 15 minutes | Who receives the concern and acknowledges it? |
| Missing owner | 15 minutes | Who is the alternate and what remains unknown? |
| Business decision | 10 minutes | Who has authority and what information is needed? |
| Review | 10 minutes | Who owns each gap and when will it be checked? |
Introduce each fact as exercise material. Ask participants to describe the existing process and locate its written authority. If a record or provider commitment is missing, record the gap rather than inventing a procedure during the exercise.
For responsibilities spanning vendors, use the vendor security review checklist to connect contract evidence to cyber dependencies. A prospective physical provider can be evaluated with the separate partner evidence questions.
Keep a decision log that can be checked again
For each objective, record the decision requested, its owner and alternate, the information requested, the acknowledgment expected and the unresolved assumption. Distinguish what participants found in an approved document from what someone proposed in the room.
Turn each gap into an improvement item with an owner, a review date and completion evidence. For example, “confirm the landlord’s escalation role” is incomplete until the contract owner can point to the agreed responsibility and the plan references it. A future discussion should test the revised handoff, rather than merely confirm that a document was edited.
What this exercise can and cannot establish
A discussion can reveal unclear authority or missing agreements. It cannot demonstrate actual response capacity, equipment performance, legal compliance or physical safety. Those questions need appropriate specialists, separately agreed scope and the relevant approved procedures.
This is an AI-assisted educational synthesis checked against the linked sources. No specialist physical-safety review or firsthand exercise delivery is claimed. DSE’s physical-security offering is in development; physical-security delivery is not currently available through DSE’s website. This agenda does not establish a staffed response service.
Sources checked October 11, 2026: CISA’s current Tabletop Exercise Packages page, which displays no publication date, and CTEP Package Documents, with its February 2, 2023 revision date. The scenario, time allocation and decision log are illustrative planning aids, not official response instructions.