Active Shooter Tabletop Exercise: Scenario, Injects, and Hot Wash

An active shooter tabletop exercise is a discussion-based session, usually one to four hours long, in which your team walks through a simulated attack at a conference table to test whether your emergency plans hold up when people talk through a realistic scenario step by step. Unlike a full-scale drill with simulated gunfire and evacuations, a tabletop exposes gaps in coordination, decision authority, and communication before lives depend on them. Planning one well takes six to eight weeks and turns on four things: sharp objectives, the right people in the room, a plausible scenario, and a disciplined process for converting what you find into fixes.

Where a Tabletop Fits

The federal Homeland Security Exercise and Evaluation Program (HSEEP) treats tabletops as the more advanced end of the discussion-based track, sitting between workshops and operations-based drills.¹ Most organizations should run a tabletop before attempting a full-scale drill. Jumping straight into a live active shooter drill without first discovering that your notification chain fails or that leadership disagrees on who calls the lockdown produces a chaotic exercise that teaches the wrong lessons. A tabletop lets you find those disconnects in a low-pressure room. A drill later validates whether people can execute what you’ve fixed.

Setting the Exercise Objectives

Vague goals like “test our active shooter readiness” produce unfocused conversations that wander for three hours. HSEEP calls for objectives that are specific, measurable, achievable, relevant, and time-bound.¹ Each should address who does what, under what conditions, and to what standard. Two to four is enough for a single session.

Strong objectives for an active shooter tabletop force a demonstrable decision or a specific timeline. Examples: verifying that your mass notification system reaches all occupied zones within two minutes of the first report; determining whether floor wardens know the lockdown procedure for their specific area; evaluating the handoff between internal security and arriving law enforcement. Weak objectives ask participants to “discuss” a topic. The objectives you pick should come from a vulnerability assessment of your actual site, not from a generic template.

The Planning Team and Participants

The planning team designs the exercise. It typically includes a lead facilitator, someone from security or emergency management, and a representative from each major department that would play a role during a real incident. This group drafts the scenario, writes the discussion questions, and decides which injects to introduce and when. Give it six to eight weeks of lead time.

Participant selection matters more than most organizations realize. A tabletop that only includes senior leadership and security staff misses the people who would actually be making split-second decisions on a classroom floor or an open office. Include representatives from every level with a distinct role during an emergency:

Executive leadership, who hold decision authority for lockdowns, building closures, and public statements.
Security or facilities staff, who handle physical access control, camera monitoring, and law enforcement liaison.
The communications team, responsible for internal alerts, family notifications, and media response.
Front-line supervisors or floor wardens, who move people to safety in their area.
Human resources, for threat assessment context, employee history, and post-incident support.

If you have a relationship with local law enforcement, invite a representative. DHS specifically recommends including law enforcement and first responders during training exercises, and their perspective on response timelines often reveals coordination gaps no internal team would spot on its own.²

Designing the Scenario

HSEEP guidance requires a scenario that is plausible, realistic, and challenging enough to let participants meet the objectives.¹ The narrative should place players in a setting they recognize, usually their own building on a normal business day, with a threat profile grounded in real-world data and initial conditions that force immediate decisions.

A common design choice is a former employee returning to the workplace, because it forces participants to confront both the physical threat and the organizational question of how the person gained access. Other scenarios involve an external attacker targeting a lobby or loading dock. The point is to target a vulnerability your organization actually has, not a Hollywood plot.

Building Injects

Injects are pieces of new information the facilitator introduces during the exercise to force participants to adapt. In a discussion-based exercise, they come at planned moments rather than on a rigid minute-by-minute timeline. Effective injects escalate pressure and introduce the complications your team would actually face:

A simultaneous fire alarm, which forces a decision about whether to evacuate (standard fire response) or shelter in place (active shooter response) when the situation is ambiguous.
Conflicting reports, where one caller places the shooter on the second floor and another on the third, and participants must act on incomplete information.
Law enforcement arrival, testing who meets officers and what information they need immediately.
A media inquiry fifteen minutes in, forcing the communications team to decide what to say before facts are confirmed.
A medical emergency requiring casualty care while the threat is still active.

Do not design injects that push players toward a predetermined right answer. The point is to observe how your team reasons through ambiguity. Three to five well-timed complications per hour is generally enough to sustain pressure without overwhelming the discussion. Injects that force choices under ambiguity are also where the individual response framework of Run, Hide, Fight gets tested in context: an evacuation route that passes near the reported threat, or an employee in a wheelchair who cannot reach the designated shelter room, exposes whether your plan holds up when the choices are not clean.³

Participant Materials

Distribute a participant guide to every player before the session. It should include the exercise scope and objectives, ground rules, the initial scenario narrative (but not the injects, which stay unknown to players), and the plans participants will be working from. Those plans typically include your emergency action plan, crisis communication protocol, and site maps showing exits, rally points, and shelter locations.

The emergency action plan is the document most tabletops end up stress-testing, whether that is the explicit goal or not. Federal OSHA regulations require covered employers to maintain a plan that includes, at minimum, procedures for reporting emergencies, evacuation routes and assignments, accounting for employees after evacuation, and designated contacts for anyone who needs more information about the plan.⁴ If yours was written with fires in mind and never updated for an active threat, the tabletop will expose that quickly.

Distributing materials in advance also frames the exercise as plan evaluation rather than a pop quiz. Participants who feel ambushed get defensive, and defensive people kill honest discussion. What you want is a no-fault room where “I don’t know what I’d do here” is the most valuable thing someone can say.

Roles During the Exercise

HSEEP identifies four core roles, and confusing them undermines the session.¹

The facilitator leads the discussion, keeps it focused on objectives, manages time, and introduces injects. This is a demanding role that needs someone who can probe vague answers without making players feel attacked.
Players are the participants being exercised. They discuss their roles and responsibilities in response to the scenario.
Evaluators are subject-matter experts who observe, take structured notes using evaluation guides, and document what worked and what broke down. They do not join the discussion.
Controllers in a tabletop carry a lighter load than in a drill. They may prompt player actions or clarify ground rules, but the facilitator does most of the work.

A common mistake is assigning the facilitator role to a senior executive who also wants to play. That person inevitably steers the conversation toward the answers they want to hear, and junior staff stop challenging assumptions. Bring in an external facilitator when you can, or assign the role to someone who does not have authority over the players in the room. CISA offers a free two-hour active shooter preparedness webinar that helps internal facilitators understand the framework before they lead a session.⁵

Running the Session

Open by stating the ground rules: no-fault environment, no wrong answers, the exercise tests plans and coordination rather than individual performance, and nothing said in the room will be used for discipline. Then present the initial scenario and give players a moment to absorb it before starting questions.

Structured questions are the engine of a tabletop. The facilitator poses questions tied to each objective and walks participants through the incident timeline. Early questions focus on detection and notification: “You hear what sounds like gunshots in the east wing. Who do you call first? What does that notification chain look like?” Later questions shift to coordination under pressure: “Law enforcement has arrived and is requesting a building layout and a headcount of unaccounted personnel. Who provides that, and where is that information right now?”

The facilitator’s most important skill is following up on vague answers. When someone says “we’d activate the emergency plan,” press: which plan, who activates it, how long does that take, and what happens if that person is in the affected zone? This is where the exercise earns its value. Comfortable generalities collapse into specific gaps when someone asks “how, exactly?”

Keep the pace deliberate but not leisurely. Spending forty-five minutes on the first five minutes of the timeline and then rushing law enforcement coordination and recovery is a common failure. Budget time against your objectives before the session starts, and be willing to cut a thread short if it is consuming time needed elsewhere.

Watching the Room

Active shooter scenarios ask people to imagine violence in the space where they spend their working lives. This is not abstract. Some participants may have personal experience with violence, and even a discussion-based exercise can produce strong emotional responses. Before the session, tell participants what the scenario involves and let anyone who needs to step out do so without judgment. Designate a staff member, ideally from HR or an employee assistance program, who can provide support during and after. If someone becomes visibly distressed, acknowledge it and offer a break. Keep the scenario realistic without gratuitously graphic details about injuries or victims. Schools running these exercises should be especially attentive to educators who may have direct experience with school violence.

The Hot Wash and After-Action Report

Immediately after the exercise ends, the facilitator leads a hot wash. HSEEP describes this as a meeting where players discuss strengths and areas for improvement while observations are fresh.¹ It is a rapid debrief, not a formal report. Ask three questions: what worked, what did not work, and what surprised you. Have players complete feedback forms during this period. Twenty or thirty minutes is enough while the experience is still vivid.

The evaluators’ notes and the hot wash observations feed the After-Action Report and Improvement Plan, which HSEEP describes as a document containing an exercise overview, analysis of capabilities against each objective, and a list of corrective actions.¹ Each observation should be categorized as a strength or an area for improvement and should include a direct statement of the issue, brief analysis, and impact. “Communication needs work” is useless. “The front desk had no direct line to the security office and relied on a cell phone that went unanswered for four simulated minutes” is what drives real change.

Turning Findings Into Fixes

The improvement plan is where organizations fumble. Identifying problems in a tabletop is relatively easy. Actually fixing them requires assigning a named owner to each corrective action, setting a concrete deadline, and tracking progress until completion.¹ HSEEP calls these SMART corrective actions: specific, measurable, achievable, relevant, and time-bound.

Corrective actions that commonly come out of active shooter tabletops include updating the mass notification system to cover zones that were missed, revising the emergency action plan to include active threat procedures alongside fire evacuation, training floor wardens on lockdown mechanics they did not know during the exercise, and establishing a pre-arranged meeting point for the law enforcement liaison. Each needs an owner and a completion date. An after-action report that sits in a drawer is worse than no exercise at all, because it creates a false sense that the problem has been handled.

Schedule a follow-up meeting thirty to sixty days after the exercise to review the status of corrective actions. HSEEP emphasizes that corrective actions should be tracked and reported on until completion, and that organizations should validate that previously implemented fixes are still working.¹ If the tabletop showed nobody knew the rally point, verify three months later that staff can identify the new one without looking it up.

Regulatory and Legal Context

No single federal regulation requires private employers to conduct active shooter tabletop exercises. The legal landscape pushes in that direction anyway. OSHA has no specific workplace violence standard, but the General Duty Clause requires employers to provide a workplace free from recognized hazards likely to cause death or serious physical harm. OSHA has stated that if an employer has experienced acts of workplace violence, or is aware of threats or indicators that the potential for violence exists, the employer is on notice and should implement a prevention program that includes training.⁶ A well-documented tabletop is one of the clearest ways to show your organization took that obligation seriously.

OSHA’s emergency action plan regulation separately requires employers to maintain plans covering emergency reporting procedures, evacuation routes, employee accountability methods, and an employee alarm system.⁴ Beyond OSHA, NFPA 3000 (Standard for an Active Shooter/Hostile Event Response Program) addresses planning, resource management, and incident management for active threat events.⁷ NFPA standards are not self-executing federal law, but many jurisdictions adopt them by reference, and they increasingly appear in negligence litigation as the benchmark for what a reasonable organization should have done.

A Note on Documentation

Some organizations avoid tabletops because they worry the after-action report will become evidence in a lawsuit. If you document a gap in your notification system and an incident occurs before you fix it, a plaintiff’s attorney will want that document. The concern is legitimate, but it is not a reason to skip the exercise. An organization that never tested its plans and has no documentation at all faces worse exposure than one that identified a gap and was working to close it.

Whether an after-action report is discoverable depends on the jurisdiction. Some courts protect documents created primarily in anticipation of litigation; others require that the sole purpose was litigation preparation. A routine exercise-program after-action report is generally a business record, not attorney work product. Talk to your legal counsel before the exercise about how to structure and distribute the report. Some organizations have counsel direct the exercise so the resulting documentation may fall under attorney-client privilege, though the strategy has limits and varies by jurisdiction.

1
FEMA. Homeland Security Exercise and Evaluation Program Doctrine
2
Department of Homeland Security. Active Shooter How to Respond
3
Ready.gov. Attacks in Crowded and Public Spaces
4
eCFR. 29 CFR 1910.38 – Emergency Action Plans
5
CISA. Active Shooter Preparedness Webinar Training
6
Occupational Safety and Health Administration. Workplace Violence – Enforcement
7
National Fire Protection Association. NFPA 3000 Standard Development