HSEEP-Aligned Emergency Tabletop Exercise for U.S. LTC
HSEEP-Aligned Emergency Tabletop Exercise for U.S. LTC
A tabletop exercise is a discussion-based session where a team talks through a scenario, using it to test plans and clarify who does what, without deploying equipment or staff. Its goal is a usable list of gaps and fixes, not proof the equipment works. The next move after reading this: pick one to three observable objectives and get a sign-off from leadership before you book a room.
TL;DR:
- A tabletop exercise is a low-cost, discussion-based session to identify gaps and improve plans, best suited for validating policies rather than testing real response capabilities.
- Planning involves setting clear, observable objectives linked to recent risk assessments, creating detailed scenarios, and assigning evaluator roles to monitor specific decision points.
- Use federal templates and resources, like CISA’s packages and Ready.gov’s playbooks, to customize scenarios and ensure compliance with FEMA and DHS standards.
- Conduct the exercise with a skilled facilitator using structured modules and real-time evidence gathering to identify weaknesses, then formalize findings in a detailed after-action report.
- Maintain a tracking system for improvement actions, incorporating them into your facility’s official documentation and resource planning to ensure continuous readiness.
Table of Contents
- What Is an Emergency Tabletop Exercise, Exactly?
- How Do You Plan a Tabletop Exercise Step by Step?
- What Templates and Federal Resources Should You Reuse?
- How Do You Run a Tabletop Exercise on the Day?
- Turning Findings Into an After-Action Report and Improvement Plan
- What Should Long-Term Care and Healthcare Coalition Planners Know?
- Legal and Compliance Considerations for Tabletop Exercises
- Why Culture Matters More Than the Scenario
- Track Your AAR/IP Findings Without Losing Them in a Binder
- Templates Worth Bookmarking Before Your Next Exercise
- Sources
- FAQ
What Is an Emergency Tabletop Exercise, Exactly?
FEMA’s Homeland Security Exercise and Evaluation Program defines a tabletop exercise (TTX) as a discussion-based response to a scenario, built to generate dialogue and surface strengths and gaps rather than test physical response capability. That’s the line that separates it from a drill or a full-scale exercise: no equipment gets moved, no ambulances roll, no radios crackle with live traffic.
HSEEP places tabletops inside a bigger cycle. You assess risks and capabilities, set preparedness priorities, then design exercises that test those specific priorities, evaluate performance, and feed findings back into planning. A tabletop sits at the low-intensity, high-frequency end of that cycle. It’s cheaper to run than a functional exercise, easier to schedule, and forgiving of scheduling conflicts among senior staff.
Choose a tabletop when you need to validate a plan on paper, orient new staff to their roles, or work through a policy question before committing resources to a bigger drill. Choose a drill or functional exercise instead when you need to test actual response times, equipment deployment, or interagency coordination under something closer to real conditions.
How Do You Plan a Tabletop Exercise Step by Step?
Every solid tabletop traces back to a clear concept. Tie your objectives directly to a recent risk or capability assessment; a tabletop built around a vague goal like “improve preparedness” gives evaluators nothing to measure. Write objectives as observable decisions, such as “the on-call administrator correctly activates the shelter-in-place protocol within 15 minutes,” so evaluators can capture actual evidence.
Here’s a practical sequence for building the exercise:
- Confirm the concept and lock two or three observable objectives tied to your risk assessment.
- Assemble an exercise planning team (EPT): a lead planner, a facilitator, evaluators, and note-takers.
- Draft the scenario, including a base situation and two to four scenario updates that inject new complications.
- Set logistics: date, duration, venue or virtual platform, invite list, and materials.
- Run the exercise using an agenda that alternates plenary discussion with breakout tables.
- Close with a hotwash, collect evaluator notes and feedback forms, and start the AAR/IP draft.
Materials worth preparing in advance:
- A situation manual (SITMAN) outlining the scenario, objectives, and ground rules
- A facilitator slide deck to pace discussion and introduce updates
- Evaluator note-taking forms tied to each objective
- Participant feedback forms for the hotwash
Pro Tip: Assign one evaluator per objective, not per table. An evaluator watching for “did leadership activate the notification tree” will catch that gap even if it happens at a table they’re not sitting at.
Budget three to four weeks after the exercise to circulate a draft AAR/IP. Waiting longer lets memory fade and momentum die.
What Templates and Federal Resources Should You Reuse?
You don’t need to build a tabletop from scratch. CISA’s Tabletop Exercise Packages (CTEPs) give planners customizable situation manuals, facilitator and evaluator handbooks, slide decks, and AAR/IP templates across dozens of threat scenarios, from cyber incidents to active-shooter events. Aligning your exercise structure to HSEEP doctrine matters beyond convenience. It makes your evaluation defensible if a regulator, board member, or auditor ever asks how you arrived at your findings.
Specific resources worth bookmarking:
- CISA’s CTEP package documentation lists reusable materials: invitation letters, planner handbooks, participant feedback forms, and AAR/IP templates.
- ASPR TRACIE’s tabletop toolkits are built for healthcare coalitions and recommend defining assumptions and scenario modules before appointing a facilitator.
- Ready.gov’s business playbooks, including its hurricane playbook, model a modular scenario with an opening situation and three scenario updates.
Adapt these rather than adopt them wholesale. Swap in your facility’s actual notification chain, your actual building layout, your actual staffing model.
How Do You Run a Tabletop Exercise on the Day?
A good facilitator does less talking than you’d expect. Their job is steering, not lecturing: introduce the scenario, inject updates on schedule, and redirect a senior leader who wants to relitigate last year’s budget instead of answering the question on the table. Facilitators need enough subject knowledge to spot a dodged question and enough authority in the room to interrupt a vice president politely.
Format depends on group size and objectives:
- Plenary discussion works for groups under 15 and for objectives requiring shared situational awareness.
- Multi-table breakout format works better for larger groups or when different departments need to work parallel problems before reporting back.
- Hybrid works when some participants join virtually; Ready.gov notes that many tabletops run in just a few hours, which makes hybrid scheduling realistic.
Pace the scenario in modules. An opening situation followed by two or three scripted updates, spaced 20 to 30 minutes apart, keeps discussion moving without letting any one thread run out the clock. Most sessions run two to four hours; scale down for a single-department exercise, scale up for a full facility-wide simulation.
Pro Tip: When a participant says “we’d probably just figure it out,” that’s the moment to dig in, not move on. Vague confidence is usually where your biggest gap is hiding.
Capture evidence in real time through evaluator notes tied to specific objectives, then close with a hotwash: a short, structured debrief where participants say what worked and what didn’t while it’s still fresh.
Turning Findings Into an After-Action Report and Improvement Plan
CISA and FEMA both recommend circulating a draft AAR/IP within three to four weeks of the exercise. Every finding in that report needs a trail: which evaluator captured it, at which table, tied to which objective.
The improvement plan is where a tabletop earns its keep. A finding that never becomes an assigned action is just a paragraph nobody reads again. Convert each gap into a SMART corrective action: specific, with a named owner, a due date, and a way to confirm it happened.
| Input | Where it comes from | Feeds into |
|---|---|---|
| Evaluator notes | Trained observers per objective | Draft findings |
| Participant feedback forms | Hotwash and post-exercise survey | Confirmation or contradiction of findings |
| Facilitator observations | Real-time judgment calls during play | Context for ambiguous findings |
| Improvement Plan | Leadership review of draft AAR | Assigned owners, deadlines, tracking |
Governance matters here. Leadership needs to review the draft, approve final corrective actions, and commit resources, not just sign off on a document. Feed the completed IP back into your next risk assessment so the cycle actually closes.
What Should Long-Term Care and Healthcare Coalition Planners Know?
A tabletop exercise that only includes the emergency management team misses the people who make plans actually work. In a long-term care setting, facilities, dietary, environmental services (EVS), scheduling, and IT staff hold dependencies that determine whether a shelter-in-place order or a winter storm plan survives contact with reality.
Practical adjustments for LTC planners:
- Invite an EVS or facilities lead to any exercise touching heat wave or winter storm scenarios, since building systems are usually the first point of failure.
- Include dining services in any scenario involving supply chain disruption or extended shelter-in-place, since meal continuity is a resident-care issue, not a side note.
- Convert findings into tracked tasks and compliance checklists rather than a static PDF nobody revisits, using a nursing home preparedness framework as a starting structure.
- Test your emergency contact directory as part of the scenario itself, since notification failures are one of the most common tabletop discoveries.
Legal and Compliance Considerations for Tabletop Exercises
Running a tabletop carries fewer legal risks than a live drill, since nobody deploys real equipment or takes real action. But that doesn’t mean compliance is irrelevant. Long-term care and skilled nursing facilities operate under CMS emergency preparedness requirements that call for annual training and testing of emergency plans, and a documented tabletop exercise is one of the accepted ways to satisfy that testing obligation in years a full-scale exercise isn’t required.
Documentation matters more than most planners expect. Keep records of who attended, what scenario was used, what objectives were tested, and what the AAR/IP concluded. If a state surveyor or accreditation body asks for proof of emergency preparedness testing, a well-documented tabletop with a completed improvement plan is the evidence that satisfies the request. A vague sign-in sheet with no findings attached is not.
Confidentiality is worth planning for too. Tabletop discussions sometimes surface uncomfortable truths, an outdated call tree, a vendor contract that lapsed, a staff member unclear on their role. Set ground rules up front that the exercise is a no-fault learning session, not a performance review, and be clear about who sees the final AAR/IP and in what form. Some organizations redact names from evaluator notes before wider circulation to keep participants candid in future exercises.
Finally, don’t let legal caution talk you out of writing down real findings. A report that sands down every gap to protect against liability produces nothing usable, and defeats the entire purpose of running the exercise.
Why Culture Matters More Than the Scenario
The best scenario in the world produces weak evidence if participants are guessing instead of leveling with each other. A no-fault, lab-like environment gets you honest answers about what your organization actually knows, not what it’s supposed to know. Run tabletops on a cadence tied to your real risk profile, at minimum yearly, more often for high-turnover roles, and make sure leadership funds the fixes the exercise turns up. An improvement plan nobody resources is just a longer way of admitting you didn’t take the findings seriously.
— Philip
Track Your AAR/IP Findings Without Losing Them in a Binder
Most facilities finish a tabletop exercise with a strong AAR and an improvement plan full of good intentions, then lose track of who owns what by month two. Corrective actions from an exercise, like retesting a notification tree or confirming a backup generator fuel contract, can be tracked as assigned tasks with due dates instead of lines in a document nobody opens again.
The Compliance Suite comes with seeded libraries for emergency prep alongside HIPAA, dietary, and QAPI categories, so improvement plan items can sit next to your other survey-ready documentation instead of a separate file. Facility teams also use My Work Tickets to route facilities and EVS fixes uncovered during the exercise straight to the right department. If you want to see how the pieces fit together for your facility, check pricing plans starting with the I Just Want That plan at $199 per month, or review the full feature set first.
Templates Worth Bookmarking Before Your Next Exercise
Save these before you start planning:
- HSEEP doctrine (PDF) for the full evaluation framework FEMA uses.
- CISA’s Tabletop Exercise Packages for ready-made situation manuals across many threat types.
- Ready and ASPR TRACIE’s toolkits for healthcare-specific scenarios.
Sources
- Homeland Security Exercise and Evaluation Program | FEMA
- Ready
- CISA Tabletop Exercise Packages
- CISA Tabletop Exercise Package Documentation
- ASPR TRACIE tabletop exercise toolkits
FAQ
What Are Some Examples of Tabletop Exercises?
Common examples include a winter storm knocking out power for multiple hours, a shelter-in-place drill triggered by a chemical spill nearby, a ransomware attack locking staff out of scheduling software, and a heat wave straining cooling systems in a nursing home. Each scenario tests a different set of decisions, communication, resource allocation, or notification, rather than physical response.
What Is a Disaster Recovery Tabletop Exercise?
A disaster recovery tabletop exercise focuses specifically on IT and data recovery: how fast systems come back online, who has authority to activate backup systems, and whether recovery time objectives are realistic. It uses the same discussion-based format as any other TTX, just scoped to technology failure scenarios.
What Are FEMA Tabletop Exercises?
FEMA defines tabletop exercises through its Homeland Security Exercise and Evaluation Program as discussion-based sessions that build understanding of plans and roles without deploying equipment or resources. FEMA’s doctrine also governs how evaluators score performance and how findings roll into an AAR/IP.
What Scenarios Work Best for Incident Response Tabletop Exercises?
Effective incident response scenarios include a phishing attack that compromises administrative credentials, a vendor data breach affecting resident or patient records, and a ransomware event that disables scheduling or documentation systems. The strongest scenarios connect directly to decision points your team would actually face, not abstract technical detail.
How Much Does MyLTCApps Cost for a Facility Tracking Emergency Preparedness Tasks?
MyLTCApps pricing starts at $199 per month for the I Just Want That plan, with Starter, Growth, and Premium packs available as facilities need more modules. Current pricing and plan details are available on the MyLTCApps pricing page.