Most teams do not need a new incident response plan to handle AI-related incidents. They need tabletop scenarios that ask questions a conventional cyber exercise can leave out: which AI system is involved and what operational role it plays, what system and vulnerability details responders need, which AI owners and outside providers must take part, and what can be shared with partners and when. The practical fix is to keep your existing baseline scenario and add AI-specific injects wherever they change a decision.
Why a conventional scenario can miss AI-related incidents
A standard tabletop usually centers on a familiar event, such as a ransomware outage or a phishing-driven credential theft. Those exercises test containment, escalation, and recovery well. They can, however, omit the context that AI-related incidents raise.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Building Your Security Foundation: Practical Enterprise Cybersecurity Steps for Setting Up Policies,... | $32.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
CISA’s Joint Cyber Defense Collaborative (JCDC) AI tabletop exercise was designed to capture information beyond conventional cybersecurity incidents, in order to help identify operational gaps, opportunities, and risks associated with AI. The exercise document is useful for that framing: it shows that the official work treats AI-related information as something to ask for explicitly. It does not show that AI incidents are more frequent or more damaging than other incidents, and you should not present it that way to your leadership.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The JCDC Artificial Intelligence Cyber Tabletop Exercise document is the most direct official model for this kind of scenario design.
What the official guidance says, and what it does not
On January 14, 2025, CISA released the JCDC AI Cybersecurity Collaboration Playbook. CISA describes it as voluntary guidance for government, industry, and international partners to share information about AI-related cybersecurity incidents and vulnerabilities. In its announcement, CISA states: “CISA urges JCDC partners to integrate the playbook into their incident response and information-sharing processes, make iterative improvements as needed, and provide feedback to CISA through [email protected].” (Source: CISA, “CISA Releases the JCDC AI Cybersecurity Collaboration Playbook and Fact Sheet,” January 14, 2025.)
Three limits follow from that wording:
- The playbook is voluntary. It does not create a universal legal obligation for your organization.
- CISA does not prescribe a single AI tabletop format. Treat the scenario and questions below as design recommendations drawn from CISA’s AI collaboration focus and its general exercise materials, not as a checklist CISA publishes.
- The playbook asks partners to fold it into existing processes. It does not ask you to start over.
For background, NIST’s AI Risk Management Framework page identifies its Generative AI Profile, released July 26, 2024. Use the profile as context for risk language. It is not a tabletop script.
Start from the plan and format you already use
You do not need to build an exercise from nothing. CISA’s CTEP package documents page, last revised February 2, 2023, provides planning and facilitator resources, participant feedback materials, and an after-action report template. Its scenario library covers ransomware, insider threats, phishing, and industrial control system compromise.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteThe NIST Incident Response: Preparation Resources page links to CISA playbooks and tabletop packages as well as NIST exercise guidance, so you can compare both sets of material before choosing a base.
Keep your current baseline scenario. Add AI-specific injects only where they change what the team decides.
Three AI-related scenario adaptations
The examples below are tailoring options. They are not an official taxonomy of AI incidents.
A conventional attack that disrupts an AI-enabled workflow
Run a standard ransomware or phishing event, but make it hit the system that an AI tool depends on. For example, an attacker encrypts the ticket queue that a summarization model reads from, and the vendor’s support portal is the only way to restore the integration. Ask who decides whether the model is switched off, what the vendor is told, and whether any prompts or outputs have to be preserved.
An AI system vulnerability that needs provider coordination
Present a vulnerability in a model or service that your organization does not control. For example, your provider reports that a component you use can be manipulated through crafted inputs. The team must decide whether to restrict the feature, what the provider needs from your logs, and whether the finding goes to any outside partner. This is where the provider role becomes concrete.
Suspicious AI-system behavior that is not yet a clear compromise
Give the team an AI system that starts returning unexpected data or behaving differently, with no confirmed intrusion. The useful question is not “is this malware” but “what would tell us whether this is a compromise, a fault, or misuse?” Test whether anyone can decide to pause the system while the cause is unknown.
Questions to add to every AI inject
For each inject, have the team work through the same five steps:
- Identify the affected AI system and its operational role, including which business process depends on its output.
- List the logs, model or service details, dependencies, and vulnerability information responders would need to make a decision. Note which of these they do not currently have.
- Name the internal owners and external providers who must join the response, and say when each one joins.
- Decide how incident information will be communicated internally and what, if anything, will be shared with outside partners.
- Record every response or recovery decision that needs executive approval, and the approver.
Comparing a conventional exercise with an AI-adapted one
Use these axes to judge your current exercise before and after the change.
| Axis | What to check in a conventional tabletop | What an AI-adapted tabletop should show |
|---|---|---|
| AI-system details | Whether the scenario names any AI system at all | A named system, its owner, its operational role, and its dependencies |
| Roles | Whether technical, legal, and communications roles are present | Those roles plus AI system owners, data owners, and external model or service providers |
| Information sharing | Whether any decision about outside sharing is exercised | Decisions on what to share with partners, with whom, and how quickly |
| Scenario relevance | Whether the event matches a generic threat | Whether the event matches a service your organization actually runs |
| Follow-up | Whether lessons are logged | Whether each finding is assigned to a named plan, communications, or recovery update with an owner |
Running the facilitated review
Close each exercise with a review focused on the gaps the AI injects exposed. Cover these points:
- What information was missing, and where it would have come from in a real event.
- Who had decision authority, and whether that person was in the room.
- Which teams or providers were absent and needed to be present.
- What external coordination was needed, and whether the channel for it exists.
- Which plan, communication, or recovery steps should change, with an owner and a date for each change.
CISA’s CTEP materials are meant for this final step. The package states: “In conjunction with selecting one of the above situation manuals, your exercise planning team will be able to fully develop your own tabletop exercise and update information sharing processes; emergency response protocols; and recovery plans, policies, and procedures.” (Source: CISA, “CTEP Package Documents,” revised February 2, 2023.)
Limits to keep in view
- The most recent dated official sources cited here are CISA’s January 14, 2025 playbook announcement and the CTEP page revised February 2, 2023. Check the CISA pages for later revisions before you adopt any wording.
- No official source cited here quantifies how often AI-related incidents occur or how costly they are. Build your business case on your own services and risk assessment.
- CISA’s free planning and scenario resources may be enough for some teams. Outside help with exercise design is an option, not a requirement.
If your current tabletop already tests information sharing, decision rights, and provider coordination, you may need only a few AI injects. If it does none of those things, the change is larger, but it still starts with the plan you have.
Current official references: CISA playbook announcement, CTEP package documents, NIST incident response preparation resources, and NIST AI Risk Management Framework.
Quick Recap
The Bottom Line
“”
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
