The use of tabletop exercises for your security team will require time away from their jobs to do it well. But by putting them into unique, unfamiliar, and even seemingly unlikely situations, in the safety of the training environment, you can learn collectively and finetune the outcomes for use in a real situation.
In May 2015, two security consultants in California were helping a city plan its 4th of July celebration. The events for the long weekend included a 10-kilometer race, a parade through the city, and a fireworks show. To prepare for the complexities of all those activities taking place over 3 days in three separate locations—and with multiple stakeholders responsible—the consultants brought together the city’s law enforcement, fire, ambulance, and Public Works personnel, along with the Emergency Operations Coordinator. Each represented entity was asked to participate in a tabletop exercise, lasting several hours and involving each group.
The scenario the consultants chose involved a terrorist who stole a UPS van and used it to drive through the parade route, injuring and killing dozens of people. The city officials worked diligently through the tabletop scenario, deploying their resources, getting mutual medical aid, and successfully managing a difficult situation. During the debriefing portion of the exercise, some the participants said, a bit good-naturedly, that the scenario they had just done seemed a bit far-fetched. Could someone actually commandeer a cargo van and use it as a weapon of mass murder?
Two months later, on July 14, 2016, a terrorist behind the wheel of a 19-ton cargo truck deliberately drove into crowds of people celebrating Bastille Day on the Promenade des Anglais in Nice, France, killing 86 people and injuring 458 others. In the subsequent post-4th of July debrief with the city officials, after a successful holiday experience for all concerned, many of the team members commented how chillingly accurate the tabletop exercise had actually been. They were glad to have been able to practice with that particular rare but devastating possibility.
It’s critically important to give the participants in a complex tabletop exercise positive praise and careful feedback, not criticism. Even though they aren’t real, the stress the people feel as they work through their various assignments feels nearly as real as a live event would. The IT director of a large transportation agency watched as her team went through a simulated earthquake exercise, along with other members of the security department, risk management, safety, and facilities. At the end of the tabletop, the group was congratulating themselves on a thorough, successful job. The IT director said, “If this had been a real exercise, you’d have all failed it.” Not only was this criticism not true, it completely demoralized the entire team and thereby destroyed their morale for a future exercise. Tabletops have value, where real learning can take place, before, during, and especially after the exercise.