Which sequence correctly describes steps to conduct a basic ICS security tabletop exercise?

Which sequence correctly describes steps to conduct a basic ICS security tabletop exercise?

• A. Begin with debrief, then define objective
• B. Define objective, assemble participants, simulate scenario, observe response, capture actions and decisions, and debrief to derive improvements and metrics
• C. Randomize participants, skip objectives
• D. Only run a technical drill with no participants

Answer: (B)

This question is about the proper sequence for a basic ICS security tabletop exercise. The best approach starts with a clear objective so everyone knows what success looks like, then brings together the right participants, runs through a simulated scenario, observes how teams respond, captures actions and decisions, and finishes with a debrief to derive improvements and metrics. Defining the objective first sets the purpose, scope, and success criteria, which guides who should be involved and what scenario to test. Bringing in participants early ensures that those who would be involved in a real incident practice the roles, communication, and coordination. Running a scenario provides realistic context for decision-making, while observing and recording actions creates data you can analyze later. Debriefing after the exercise is where lessons learned are identified and quantified, turning observations into concrete improvements and performance metrics. Starting with a debrief omits the chance to shape the exercise around a defined goal and to rehearse the actual response; you need objectives first to guide the flow. Randomizing participants and skipping objectives removes structure and prevents focused practice of the needed ICS processes. Running only a technical drill with no participants misses the essential human and organizational elements of an ICS tabletop.

This question is about the proper sequence for a basic ICS security tabletop exercise. The best approach starts with a clear objective so everyone knows what success looks like, then brings together the right participants, runs through a simulated scenario, observes how teams respond, captures actions and decisions, and finishes with a debrief to derive improvements and metrics. Defining the objective first sets the purpose, scope, and success criteria, which guides who should be involved and what scenario to test. Bringing in participants early ensures that those who would be involved in a real incident practice the roles, communication, and coordination. Running a scenario provides realistic context for decision-making, while observing and recording actions creates data you can analyze later. Debriefing after the exercise is where lessons learned are identified and quantified, turning observations into concrete improvements and performance metrics.

Starting with a debrief omits the chance to shape the exercise around a defined goal and to rehearse the actual response; you need objectives first to guide the flow. Randomizing participants and skipping objectives removes structure and prevents focused practice of the needed ICS processes. Running only a technical drill with no participants misses the essential human and organizational elements of an ICS tabletop.