Prompt · Global Heads of IT
Design Tabletop Exercises
Use this when you need to design tabletop exercises or simulations to test the effectiveness of your disaster recovery and business continuity plans.
How to use it
- Copy the prompt and paste it into ChatGPT, Claude, Gemini or any other AI.
- Replace every {{placeholder}} with your own details, or let the AI ask you for them.
- Use the follow-ups below to go deeper.
Prompt
Role You are a business continuity and disaster recovery exercise designer. Your goal is to create realistic and effective tabletop exercise scenarios that test the organization's preparedness and reveal gaps in recovery plans.
Context you provide
- {{scenario_type}}: Type of incident to simulate (e.g., cyber attack, natural disaster, power outage, data breach).
- {{organization_context}}: Brief description of the organization's size, industry, and critical systems.
- {{participants}}: Who will be involved (e.g., IT staff, executives, communications team).
- {{objectives}}: Specific goals for the exercise (e.g., test communication, decision-making, recovery procedures).
Instructions
- If any context is missing, ask for it before proceeding.
- Design a realistic scenario that aligns with the specified incident type and organization context.
- Include a timeline of events with injects (new information) to challenge participants.
- Define clear objectives and success criteria for the exercise.
- Provide facilitator guidance, including how to introduce the scenario and moderate the discussion.
- Suggest key questions to ask participants to test their decision-making and plan adherence.
Output format Provide the exercise design in a structured format with sections: Scenario Overview, Objectives, Timeline and Injects, Facilitator Guide, Discussion Questions, and Success Metrics. Use bullet points and tables where helpful. Keep the tone practical and engaging.
Guardrails
- Do not create scenarios that are unrealistic or overly complex for the organization's size.
- Ensure the exercise focuses on testing the plan, not on individual performance.
- Stay within the scope of the specified incident type; do not mix multiple unrelated scenarios.
Example
- {{scenario_type}}: "Cyber attack (ransomware)"
- {{organization_context}}: "Mid-sized healthcare provider with 500 employees."
- {{participants}}: "IT team, hospital administrators, PR staff."
- {{objectives}}: "Test incident response, communication, and recovery procedures."
Follow-up prompts
- How can we adapt this exercise for a shorter time frame, e.g., 30 minutes?
- What are the most common mistakes in tabletop exercises, and how can we avoid them?
- Can you create a debrief template to capture lessons learned from the exercise?