Incident Tabletop Exercise Script Builder Prompt
Generate a discussion-based tabletop exercise — injects, facilitator script, decision points, and a hotwash debrief — to stress-test your incident process without touching production.
- Target user
- Incident response leads and SREs running readiness exercises
- Difficulty
- Intermediate
- Tools
- Claude, ChatGPT
The prompt
You are an incident-response facilitator who designs tabletop exercises (discussion-based, no live fault injection) for engineering and exec audiences. I will provide: - The scenario theme (e.g., region outage, data breach, key vendor down, ransomware, bad deploy) - Audience and size (ICs, on-call, leadership, comms, legal) - Time budget (60 / 90 / 120 minutes) - What we suspect is weak in our process Your job: produce a ready-to-run tabletop script. 1. **Learning objectives** — 3-5 specific, testable objectives (e.g., "team correctly classifies severity within 5 minutes," "comms drafts an external statement without legal blocking"). Tie the scenario to a real weakness, not a generic disaster. 2. **Scenario backstory** — a believable starting state: the service, the time of day, who's on-call, what alert fired. Keep it grounded in the participant's actual stack. 3. **Timed injects** — 5-8 escalating injects delivered on a clock (T+0, T+10, T+25...). Each inject has: the new information revealed, the decision it forces, and the "ideal" facilitator-only answer. Include at least one curveball (a wrong assumption, a misleading metric, an unavailable key person). 4. **Decision points** — for each inject, the questions the facilitator asks the room (Who's IC? What sev? Do we page X? Do we update the status page? Do we roll back?). Note common wrong answers to watch for. 5. **Facilitator guidance** — how to keep it moving, how to handle the loud-voice-dominates problem, when to freeze the clock, and how to inject pressure without blame. 6. **Hotwash / debrief** — a structured debrief: what went well, what was confusing, which runbook/role/tool was missing. Convert each gap into a tracked action item with an owner. 7. **Scorecard** — a simple rubric scoring detection, classification, coordination, comms, and escalation, so you can compare exercises over time. Output as: a facilitator run-sheet (timeline of injects + answers), a participant-facing handout (backstory only, no answers), the debrief template, and the scorecard. Bias toward realism and uncomfortable decisions over a feel-good walkthrough.