Sample tabletop exercise
Healthcare Cyber Disruption
Continuity of care during a technology outage.
A facilitated discussion that brings operational and technical teams together to explore decisions, validate plans, and identify practical improvements.
Download the one-page overviewPDF · 1 page · Sample exercise overview
Preview the overview - Duration
- Flexible
- Format
- Facilitated tabletop
- Design
- HSEEP-aligned
The starting point
Care continues.
Access does not.
A shared technology service becomes unavailable, disrupting access to selected records, scheduling, and registration workflows. Reports of suspicious activity emerge, but the cause and extent are still uncertain.
Participants work through how to maintain essential services, coordinate support, share reliable information, and make recovery decisions as the situation evolves.
Who joins the discussion
Healthcare leadership, clinical operations, IT and cybersecurity, preparedness, communications, and relevant response partners. Adaptable for one organization or multiple facilities and partners.
What teams practice
Four connected decisions.
Activate & coordinate
Clarify response leadership, activation decisions, and partner notifications.
Sustain care
Prioritize essential services and work through approved downtime procedures.
Share reliable information
Separate facts from assumptions and coordinate internal and public updates.
Plan a safe return
Agree on restoration checks, approval roles, reconciliation, and handoffs.
How the exercise unfolds
From first signs to the next shift.
Initial disruption
Who leads, what is affected, and how will the team communicate?
Continuity pressure
How will services continue as delays grow and partners need information?
Recovery decisions
What must be verified before systems and workflows return to use?
Timing is tailored to your objectives, audience, and discussion depth. Modules can be shortened, expanded, or split across sessions, with time reserved for orientation, learning, evaluation, and a closing debrief with participant feedback. Breaks and delivery format are planned around your team: in person, remote, or hybrid. Discussion only; no changes to live systems.
Put the learning to work
Observations become next steps.
Facilitator and evaluator observations, together with participant feedback, inform an After-Action Report and Improvement Plan (AAR/IP): strengths, gaps, and prioritized actions with owners and target dates.
Objectives, participants, and evaluation criteria are tailored before delivery using the Homeland Security Exercise and Evaluation Program (HSEEP) framework.
Make it relevant to your team.
Start with your plans, operating environment, and the decisions you want to practice.
Start an exercise inquiry Explore all examples