War-game a crisis tabletop before roles, scripts, and escalation paths quietly fail the first time the clock is real.
Crisis tabletops fail when the exercise is a reading of the binder, when roles exist on paper and vanish under time pressure, when legal and comms disagree on what can be said, and when customer language still assumes facts you do not have. A clean runbook is not evidence that the company can absorb a bad Monday.
Freeze one scenario
Write the incident type, the severity ladder you will defend, the decision rights you will honor, and the first seventy-two hours outcomes that still must hold if facts keep changing. Then write the owner for each seat and the kill criteria if the tabletop finds a missing role. If you cannot name the owner or the kill criteria, the exercise is decoration.
Freeze the scenario brief, contact tree, status-page rules, counsel notes, and the customer language you would use. Attach residual risk you will accept. Split any secondary policy rewrite into a separate decision. One scenario under fire at a time.
Hostile seats
- Ops seat: handoffs that stall, on-call gaps, and tools that do not exist mid-incident.
- Legal seat: statements that invent facts, admit too much, or leave counsel out.
- Comms seat: drafts that conflict with status-page language or customer emails.
- Customer seat: fairness claims, SLA credits, and trust damage from silence.
- Skeptic seat: the claim that looks cleanest and has the least evidence.
Ask each seat for material objections, missing exhibits, and the smallest change that keeps the intent without the theater. Optional finance seat if credits, insurance, or disclosure clocks sit inside the scenario.
Private pass
Run that package in Pingpong. Sequential review helps because an early pass can defend the readiness story while later passes try to kill soft roles and dual-counted spare capacity. Keep a change log of scripts cut, sequenced, or clarified. If survival requires silence about a single hero responder or a heroic recovery time, stop. Rewrite the tabletop or delay the "ready" label.
Publish the activation calendar inside the package: when the next live drill runs, when managers are briefed, and when status-page owners lock the language. A crisis tabletop without dated owners is a rumor with a binder. Ask ops and comms seats to break that calendar before anyone schedules the next "tabletop complete" note.
Related: review a crisis comms plan, stress-test a security incident response, stress-test a status page update, war-game a customer escalation, and AI for high-stakes decisions. Mechanics: how it works.