Business continuity tabletop exercise slides should reveal a disruption in stages and give people a concrete question to discuss at each stage. Keep the participant slides brief, hold follow-up prompts in a separate facilitator guide, and record where the existing plan does—or does not—support the decisions people propose.
Start with an approved plan and a narrow exercise objective, not a dramatic disaster story. Once the scenario and discussion prompts are agreed, you can use Presenti to make an editable slide draft from the exercise script. The worked example below is a fictional, discussion-only session about an unavailable office and a growing customer-request queue. It does not ask anyone to interrupt a live service, contact customers, or enact an emergency procedure.
Choose one question the exercise will answer
The example team wants to find out: Can we identify who authorizes a change of working location, communicate the decision, and prioritize incoming requests when the usual coordinator is unavailable? That gives the discussion a focus. “See whether we are resilient” is too broad to guide either the participants or the observer.
The exercise designer has an organization-approved continuity plan, a current role list, and the contact and escalation arrangements referenced by that plan. The session includes the service lead, a deputy, facilities, IT support, and customer support. A facilitator runs the discussion; an observer captures decisions and unresolved points. Roles can be combined only when doing so will not prevent someone from listening or recording.
NIST SP 800-84, chapter 4 and appendix A, describes discussion-based tabletop exercises and distinguishes participant, facilitator, and evaluation materials. Its examples concern IT plans. The office scenario here is an original teaching example, not a NIST-prescribed business continuity plan or a claim of compliance.
Use three observable questions to keep this session on course: Did the group identify the authority in its plan? Did it describe how the decision reaches staff? Did it explain how incoming work is prioritized and handed over? The aim is to find a usable answer or a specific gap—not to award a general readiness score.
Prepare three different views of the session
The same material should not appear on every screen and handout.
- Participant deck: purpose, exercise boundaries, the initial situation, one update at a time, and short questions.
- Facilitator guide: all updates, suggested follow-up questions, timing, and the plan sections the discussion may need. Keep this separate from the participant export.
- Observer record: what people proposed, which plan provision they used, what remained unanswered, and what follow-up would resolve it.
Do not put a model response on the next participant slide and accidentally reveal it while presenting. The exercise is meant to expose how the team reasons from its plan. If the plan does not answer a question, record that gap instead of supplying a convenient invented rule.
This sample agenda takes 60 minutes: five for the opening, ten for the first situation, ten for the unavailable-contact update, fifteen for the queue update, fifteen for the debrief, and five to confirm follow-up. These are facilitation allocations, not a required exercise duration. The scenario’s clock can move ahead faster than the room’s clock; label the two clearly.
Round one: the office is unavailable
At the start, tell participants which plan version they are discussing and which roles they represent. Read the exercise boundaries aloud: discuss proposed actions, use no live customer data, and make no real operational changes. Agree how the facilitator will pause the session if an actual incident occurs.
Participant slide: situation at 09:00
Building management says the regional office cannot be used this morning. There is no confirmed reopening time. Staff are safe and outside the affected premises. Customer requests continue to enter the normal online queue. No loss of the request system has been reported.
Discuss: Who decides where work continues? What information does that person need? What should staff hear now?
The slide does not say “everyone works from home.” That is an option to discuss against the approved plan, available equipment, permitted access, and the work involved—not a solution the scenario should hand to the group.
Facilitator guide
If someone answers, “We would tell everyone to switch location,” ask: “Who is ‘we’ under the plan, and how would you reach staff who have not read the message?” If participants need a fact the scenario does not provide, separate a reasonable exercise assumption from a fact that would have to be obtained during a real event.
The observer should capture the proposed decision, the authority cited, and any unanswered dependency. “Team discussed remote working” is too vague to be useful afterward.
Round two: the usual contact does not answer
Participant slide: update at 09:20
The usual service coordinator has not responded through the approved contact route. Customer support has received two different messages about whether work should continue. The online request queue remains available.
Discuss: What is the escalation route? Who can resolve the conflicting instruction? What single message should staff receive next?
Keep this update short. It changes one dependency—availability of the usual coordinator—and introduces the consequence of inconsistent communication. Adding a cyberattack, transport failure, and supplier outage at the same moment would make it harder to see which part of the plan the team is examining.
Facilitator guide
If the group names a deputy, ask where that authority is recorded and what happens if the deputy also cannot be reached. Do not turn the discussion into a phone-number recall test. Participants should be able to identify the maintained source and the escalation path.
A possible fictional observation is: “The service lead and customer support both proposed issuing the next instruction. Neither could identify who resolves conflicting messages in the plan version used.” That is more precise than “communication was poor.” It identifies the decision that lacks a clear owner.
Round three: the queue forces a priority decision
Participant slide: update at 10:00
The queue now contains 18 requests: six with commitments due today and twelve with later commitments. The exercise assumes that two available staff can each handle three comparable requests per hour. Staff have not yet agreed which requests to take or how to hand over incomplete work.
Discuss: Which work should be assessed first? Who may change a customer commitment? How will the next team know what has already been done?
The arithmetic gives the discussion a constraint: two people at three requests each provide six completions per hour under the stated assumption. Eighteen comparable requests would take three hours with no further arrivals or interruptions. That is not a forecast. Differences in complexity, new arrivals, or reduced access could change it.
Ask participants to use their plan’s priority rules and actual commitments, not automatically treat arrival order as the right answer. The six due-today requests are a prompt to examine urgency; the example does not establish that every one can be completed safely or that later requests have no consequences.
Facilitator guide
Ask the group to describe one handover entry: request reference, current state, next action, responsible role, and any commitment that needs a decision. If someone proposes promising completion “within an hour,” ask which assumptions support it and who has the authority to make that promise.
For the teaching scenario, a useful response would separate immediate triage from a customer promise: “Review the six due-today requests first, identify dependencies, and ask the authorized role about any commitment we cannot meet. Record the assigned owner and current state before transferring work.” It is an example of a reasoned answer, not a replacement for the organization’s own rules.
Record observations that can change the plan
Give the observer space to distinguish what was said from what it might mean. A filled example makes the difference clear:
| Observed in the fictional discussion | Gap to resolve | Follow-up and evidence of completion |
|---|---|---|
| Two roles claimed responsibility for the staff update, and the plan reference did not settle it. | Decision authority for conflicting instructions is unclear. | Plan owner obtains the authorized decision and updates the role description; rerun the second update using that version. |
| The group used the six-per-hour assumption to promise a deadline before checking request complexity. | The proposed message omitted the conditions behind the estimate. | Customer support lead prepares an approved holding message and discusses it against a mixed-complexity queue. |
| The proposed handover named an owner but omitted the remaining action. | The receiving person could not tell what to do next. | Service lead revises the handover example; another participant explains the next action from the record alone. |
These are illustrative observations, not findings from an exercise already conducted. In a real session, write down contrary evidence too. If the group finds the correct escalation provision and uses it successfully, that matters; do not manufacture deficiencies to make the exercise appear valuable.
During the debrief, ask which decision was hardest, what supported it, and what needs clarification. Turn each agreed issue into an owner, an agreed review date, and a way to check the change. “Improve communications” is not a finished action. “Confirm the instruction owner and replay round two with the revised role record” is something the team can actually examine.
Build the deck without giving away the discussion
Use seven participant slides: purpose and boundaries; roles and the plan being discussed; the 09:00 situation; the 09:20 update; the 10:00 queue; debrief questions; and agreed follow-up. Keep each situation on its own slide so participants respond to what they know at that moment.
When preparing the text for an AI draft, supply the participant version only. State: “Preserve the three scenario times and all queue numbers. Show questions without answers. Do not invent contact details, recovery targets, response procedures, or additional failures.” Keep facilitator prompts and evaluation notes in their separate document. Review the resulting deck for accidental hints, added assumptions, or prematurely disclosed updates.
End with the changes the discussion has justified and the questions it has left open. A successful conversation can reveal a useful plan gap; it does not demonstrate that a system has been restored, a facility is available, or a real interruption has been resolved. Those outcomes require the appropriate authorized work beyond the slides.
