Incident Tabletop Exercises for Critical Infrastructure in Ukraine

Tabletop exercises—structured discussions in which organizational leaders and technical responders work through a simulated incident scenario without live technical execution—are a cornerstone of incident response preparedness testing. Unlike live-fire cyber exercises, tabletops focus on decision-making processes, inter-organizational communication, and governance procedures rather than technical defensive skills. For Ukraine's critical infrastructure operators, tabletop exercises facilitated by CISA and other partners have been essential tools for identifying institutional coordination failures that technical capabilities alone cannot address.

CISA Facilitation in Ukraine

The US Cybersecurity and Infrastructure Security Agency has been one of the primary international partners facilitating tabletop exercise programs for Ukrainian critical infrastructure sectors. CISA brought its considerable experience running critical infrastructure exercises in the United States and adapted methodologies to the Ukrainian context—accounting for active hostilities, simultaneous physical and cyber attack scenarios, and the compressed decision timelines characteristic of wartime operations.

CISA-facilitated tabletops in Ukraine have addressed several distinctive scenarios including: coordinated cyber attacks coinciding with missile strikes on power infrastructure; ransomware attacks on hospital systems during mass casualty events; and cascading failures across interconnected energy, water, and financial systems. These scenarios are not hypothetical for Ukrainian participants—they reflect documented attack attempts or realized incidents that require systematic response improvements.

Energy Sector Scenarios

Energy sector tabletops represent the highest-priority exercise domain given that Ukraine's power grid has been under systematic physical and cyber attack. Scenarios have tested operator responses to simultaneous cyber attacks on energy management systems coinciding with physical substation damage, requiring coordination between grid operators, Ukrenergo national grid management, emergency generators for critical facilities, and international energy partners providing support through European grid connections.

A key finding from energy sector tabletops has been the ambiguity problem: when a power substation goes offline, real-time determination of whether the cause is cyber attack, kinetic damage, or equipment failure requires different response procedures with different specialist involvement. Tabletops have driven development of multi-hypothesis initial response protocols that initiate parallel response tracks for each possible cause simultaneously, rather than sequentially investigating causes before responding.

Multi-Ministry Coordination Testing

Critical infrastructure incidents cannot be managed by a single ministry or agency alone—they require coordinated action across the energy operator, cybersecurity agency, national grid operator, military command, police, and potentially multiple government ministries. Tabletop exercises specifically designed to involve participants from multiple ministries have repeatedly identified coordination failures: unclear authority for particular decision types, communication bottlenecks during crisis periods, and pre-existing inter-agency conflicts that slow information sharing.

Tabletop Exercise Program Characteristics

Healthcare and Emergency Services Scenarios

Hospital and emergency services operators have participated in tabletop exercises addressing ransomware attacks during mass casualty influxes—scenarios that became tragically relevant following Russian missile strikes on civilian targets. These exercises have driven procedural changes including pre-planned paper-based fallback procedures for all critical hospital systems, designated roles for cyber incident coordination that do not conflict with direct patient care responsibilities, and relationships with neighboring hospital systems for patient transfer coordination during IT outages.

After-Action Integration and Improvement Tracking

The value of tabletop exercises depends heavily on the quality of after-action processes that translate identified weaknesses into implemented improvements. Ukraine's SSSCIP has developed a standardized after-action reporting format used across critical infrastructure tabletop programs, creating a consistent registry of identified gaps, assigned owners for each remediation action, and follow-up verification timelines. This systematic approach contrasts with earlier ad-hoc exercise programs where identified weaknesses were documented in reports that were not systematically tracked to closure.

International facilitating organizations including CISA and the EU Agency for Cybersecurity receive anonymized versions of after-action reports, enabling them to calibrate subsequent capacity-building investments to address the most systematic and recurring gaps identified across the exercise program.

FAQ

What is the difference between a tabletop exercise and a live-fire exercise?

A tabletop exercise is a structured discussion where participants talk through how they would respond to a scenario, without activating technical systems or deploying teams. A live-fire exercise deploys actual technical infrastructure, attack tools, and defense teams in a simulated environment. Tabletops test decision-making and coordination; live-fire tests technical skills and tool capabilities.

Who should participate in critical infrastructure tabletop exercises?

Effective tabletops require the actual decision-makers who would be responsible in a real incident—not just technical staff. This includes executives and senior officials with authority to direct spending, activate emergency procedures, communicate with government, and make decisions about system shutdown. Technical staff participation is also important for scenario realism, but executive participation drives governance improvements.

How often should critical infrastructure tabletop exercises be conducted?

Best practice recommends at least one tabletop per year for critical infrastructure operators, with higher-risk sectors or operators with recent real incidents conducting multiple exercises. Ukraine's active threat environment has justified more frequent exercises in some sectors. CISA guidance recommends exercises at sufficient frequency to incorporate lessons from real incidents and technology changes.

What is the most common finding in Ukrainian critical infrastructure tabletops?

Consistently across sectors, the most common finding is unclear decision authority—situations where multiple organizations or individuals believe they should be making a particular decision, leading to delay or conflict, or situations where no one believes they have authority to act, causing inaction. Clarifying decision authority in advance through agreed coordination frameworks and legal authorities is a primary tabletop outcome.

Are exercise scenarios based on real Ukrainian incident case studies?

Yes. CISA and other facilitators use real Ukrainian incident case studies (suitably anonymized or in cases already public) as the basis for exercise scenarios. This grounding in actual attacks means Ukrainian participants are not practicing responses to hypothetical threats but rather systematically working through the response to incidents that have actually occurred in their sector.

Sources

1. CISA — "Tabletop Exercise Packages (TEPs) for Critical Infrastructure," cisa.gov
2. ENISA — "National Cyber Exercise Methodologies," enisa.europa.eu 2023
3. SSSCIP Ukraine — "Critical Infrastructure Cyber Exercise Program," 2023
4. Carnegie Endowment for International Peace — "Ukraine Critical Infrastructure Resilience After 2022," 2023
5. Biden Presidential Policy Directive 41 — "US Cyber Incident Coordination" (framework used in exercise design)