OpsDrill logo
Back to Guide Topic List

Table-Topping Exercises

Table-top exercises (TTX), also known as Tabletopping, is a cheap, fast, and easy way to practice incident management through hypothetical situations and discussing how to react.

It isn't as realistic as a Gameday or chaos testing, but it does provide a hypothetical situation which can surface missing runbooks and create new action items for operational improvements.

The term table-top refers to the few tools needed to conduct such as exercise. Prior to remote work, that was a conference room, a table, a slide deck, and people.

If we think of the table top game Dungeons & Dragons, it has a dungeon master (DM) who prepares a story and then talks players through various scenarios. This is a very similar exercise, but without rolling 20 sided dice to determine outcomes.

Table-top exercieces has been used in the military, government, and cyber security disciplines for a long time. Government organizations such as FEMA have used TTX to explore potential problems in supply chains, how multiple simultaneous disasters would play out, and many more flavors of disasters. These TTX provides an occasion to workshop potential mitigations that can be planned ahead of time and managed. They also help new risks to be identified.

Tabletopping can be adopted by any organization, today. This is in contrast to Gamedays or Chaos testing, which require significant planning, implementation effort, and cross team buy-in.

Preparation

One or more individuals should develop a hypothetical situation or situations which will be proposed to the group. The more detail that is pre-meditated, the better. However these details don't need to be revealed up front and the facilitator(s) are free to let the TTX evolve from the initial scenario organically, much like a DM in D&D.

Preparation can be as minimal as a meeting invite and a wiki page.

Participants - Whom to invite

The facilitator(s) should be senior people who have deep knowledge. If you have the anti-pattern of "bus factor", get that person or people to facilitate.

Next you want key subject matter experts (SMEs) for different parts of your system. That could include database, message queue, and various services.

Inviting a broader community, including lawyers, executives, and marketers can be surprisingly beneficial.

Some benefits of including different disciplines like lawyers, marketing leaders, etc are

  • Increases empathy
  • Improves creativity in terms of ways to mitigate incidents
  • Finds blind spots, vulnerabilities, and opportunities outside of engineering
  • Generates action items and projects proactively

By inviting executives, they can "see how the sausage is made" and develop a respect for how stressful incident management is. They can see first hand how many factors and complexities are often at play. It will help get buy-in for prioritizing operational improvement projects, instead of always prioritizing feature work over all else.

It can help align legal, marketing, and other stakeholders on the trade-offs involved in stopping customer bleeding with temporary fixes.

Back to Guide Topic List