GLOSSARY

The exercise vocabulary.

The terms that come up in scoping, running, and scoring a cyber tabletop exercise — grouped by where they show up in the process.

Terms by exercise phase

Roles & planning

Executive Sponsor: The senior leader who commissions the exercise, sets objectives and scope, and receives the after-action report. Owns the outcome, not the mechanics.
Operator (Facilitator): Runs the exercise in real time: pacing injects, prompting discussion, keeping the scenario on the clock, and adjudicating how the situation evolves based on Participant decisions.
Participant (Player): A member of the team being exercised who responds to the scenario as they would in a real incident, using their own judgment rather than a scripted answer.
Evaluator: A read-only seat held by someone who watches the exercise and scores it against the training objectives instead of playing. Evaluators see the clock, the brief, released injects and Participant responses, and their notes stay private to the Executive Sponsor and Operator.
Observer: Someone who needs to watch the exercise — an auditor, insurer, board member or colleague from another team — without responding to injects. An observer is not a separate account role: they are invited into the read-only Evaluator seat and simply do not score.
Seat: One named person invited by email to a single exercise. Participant seats play the exercise and respond to injects; the Evaluator seat, which observers also use, is read-only. Seats are the unit plans are sized in on the pricing page.
Planning Guidance: The upfront scope document — objectives, threat scenario, Participants, and constraints — that shapes what the exercise will and will not test.
Training Objective: A specific, measurable capability or behavior the exercise is designed to evaluate, such as "validate the decision to notify regulators within the required window."

Exercise mechanics

Tabletop Exercise (TTX): A discussion-based exercise in which Participants walk through a simulated incident scenario to evaluate plans, roles, and decision-making without touching live systems.
Situation Manual: The reference document given to Participants describing the exercise's purpose, ground rules, and background scenario before play begins.
Master Scenario Events List (MSEL): The facilitator's master timeline of injects, expected discussion points, and pacing notes used to drive the exercise.
Inject: A discrete piece of scenario information — an email, alert, news clip, or phone call — introduced at a specific point to advance the situation and prompt a decision.
Situation Update: A short narrative addition that reveals how the simulated incident has progressed since the last inject, giving Participants new facts to react to.
Decision Point: A moment in the exercise where Participants must make and record a concrete choice, which the facilitator uses to branch or continue the scenario.
ENDEX (End of Exercise): The formal end of exercise play, after which the scenario clock stops and the group transitions into hotwash and debrief.
Hotwash: An immediate, informal debrief held right after ENDEX to capture first impressions, standout moments, and gaps while they are still fresh.

Assessment

After-Action Review / Improvement Plan (AAR/IP): The formal deliverable summarizing what happened, how it compared to objectives, and the specific corrective actions the organization commits to, with owners and timelines.
Corrective Action: A concrete, assigned follow-up task generated from an exercise finding — such as updating a runbook or clarifying an escalation path — tracked to closure.

Frameworks

NIST Cybersecurity Framework (CSF) 2.0: The National Institute of Standards and Technology (NIST) Cybersecurity Framework version 2.0, organizing cybersecurity outcomes into Govern, Identify, Protect, Detect, Respond, and Recover functions used to structure exercise objectives.
Special Publication (SP) 800-61r3: NIST's Incident Response Recommendations and Considerations, the primary federal guidance for building and exercising incident response processes.
SP 800-84: NIST guidance on Test, Training, and Exercise programs for information technology (IT) plans and capabilities, including how to design and evaluate tabletop exercises.
SP 800-53 Incident Response (IR) family: The Incident Response control family within NIST SP 800-53, covering requirements such as incident response training, testing, and plan maintenance that tabletop exercises help satisfy.
Homeland Security Exercise and Evaluation Program (HSEEP): The Federal Emergency Management Agency (FEMA) methodology for designing, conducting, and evaluating exercises across sectors. FEMA is part of the Department of Homeland Security (DHS).
SOC 2: A reporting framework from the American Institute of Certified Public Accountants (AICPA) under which an independent auditor examines a service organization's controls against the Trust Services Criteria and issues a Type 1 or Type 2 report. In procurement, "SOC" almost always means SOC 2 rather than a security operations center.
Cyber Tabletop Exercise Package (CTEP): The Cybersecurity and Infrastructure Security Agency (CISA)'s set of ready-made tabletop scenarios and facilitation guides for sector-specific cyber incidents.

Acronyms in full

AI: Artificial intelligence — used here for planning support, inject drafting, response evaluation, and after-action drafting.
MFA: Multi-factor authentication — requiring more than a password, such as an app prompt or hardware key, to sign in.
SaaS: Software-as-a-service — business applications delivered over the internet by a vendor rather than run in your own data center.
OT: Operational technology — the computers and controllers that run physical processes such as manufacturing, energy, or water treatment.
ICS: Industrial control system — the specific control equipment inside an operational technology environment.
DDoS: Distributed denial of service — using many sources to make a service unavailable, whether by flooding the network with traffic, hammering the application layer with seemingly legitimate requests, or exhausting a finite resource such as connections, sessions, or database capacity.
BEC: Business email compromise — fraud in which an attacker impersonates an executive, supplier, or colleague to redirect a payment.
API: Application programming interface — the machine-to-machine connection that lets one system call another.
RMM: Remote monitoring and management — the tools a service provider uses to administer customer computers remotely.
EDR: Endpoint detection and response — security software on laptops and servers that detects and blocks malicious activity.
IR: Incident response — the plan, team, and process for handling a security incident.
SOC: Security operations center — the team that monitors alerts and triages suspected incidents.
UAC: User Account Control — the Windows feature that requires explicit approval before a process is granted administrator privileges. The consent prompt is the visible part of it; the feature also governs how processes are elevated and how administrator tokens are split.
CVE: Common Vulnerabilities and Exposures — the program that assigns a unique identifier to a publicly disclosed vulnerability, so everyone can refer to the same flaw by the same name. Identifiers are issued by CVE Numbering Authorities (CNAs), which are vendors and research organizations authorized to assign them within their own scope. It is an identifier program, not a catalog of every known weakness.
PII: Personally identifiable information — data that identifies a specific person, such as a name paired with a government-issued identifier. "Personal data" under the General Data Protection Regulation (GDPR) is broader than PII, covering any information relating to an identifiable person.
RTO / RPO: Recovery time objective and recovery point objective — how quickly a service must be restored, and how much recent data may be lost.
SITREP: Situation report — a short, timed status update issued during an incident or exercise.

Threat language

Threat Actor: The individual, group, or organization responsible for a malicious activity, often characterized by motive, capability, and typical targets.
Attack Vector: The specific path or method a threat actor uses to gain unauthorized access, such as phishing, an exposed remote service, or a compromised third party.
Kill Chain (Cyber Kill Chain): Lockheed Martin's Cyber Kill Chain, a model describing the sequential stages of an intrusion — reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives — used to frame where defenses and decisions apply.
MITRE ATT&CK: MITRE's publicly maintained knowledge base of adversary tactics and techniques observed in real intrusions, each with a technique identifier. Unlike a kill chain it is not a fixed sequence; it is a catalog defenders use to describe behavior, map detection coverage, and tag exercise injects.
Dwell Time: The length of time a threat actor remains undetected inside an environment between initial compromise and discovery.
Breakout Time: A metric coined by CrowdStrike for the time it takes an attacker to move from the first compromised host to other systems on the network — a benchmark for how fast defenders must detect and respond.
Double / Triple Extortion: Ransomware tactics that add data theft (double) and pressure on victims' customers or partners (triple) on top of encrypting systems, increasing leverage over the victim.
Recovery Denial: An attacker action, such as deleting or encrypting backups, intended to remove an organization's ability to restore systems without paying or negotiating.
Materiality (Securities and Exchange Commission, SEC): The Securities and Exchange Commission (SEC) standard for whether a cybersecurity incident is significant enough to a reasonable investor that it must be publicly disclosed, a judgment exercises can help rehearse.
Notification Clock: A regulatory or contractual countdown to mandatory notification. The trigger differs by regime: the General Data Protection Regulation (GDPR) runs 72 hours from awareness of a personal data breach, the Securities and Exchange Commission (SEC) allows four business days from a materiality determination, and the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) runs 72 hours from reasonable belief that a covered incident occurred. Knowing which clock starts when, and on whose call, is one of the things an exercise tests.