Cloud Outage Tabletop Exercise: A 60-Minute Executive Workshop
Rehearse a cloud outage by asking executives to choose which work continues, approve a temporary operating process, and define when normal service can resume. This suggested 60-minute workshop produces a decision log, a customer update, and recovery criteria.
How do you run a cloud outage tabletop exercise?
Give executives a fictional outage affecting one critical workflow, then require decisions about service priorities, workarounds, and customer communication. Introduce new information before recovery so participants must revise their choices.
For a Q4 offsite prepared on October 8, 2026, bring the current dependency map, continuity plan, and holiday delegation roster. Check whether the people and systems named in the plan will actually be available.
NIST SP 800-84 provides durable guidance for designing, conducting, and evaluating exercises involving IT disruptions. The scenario and timings below are an original workshop outline. [NIST exercise planning guide](https://csrc.nist.gov/pubs/sp/800/84/final).
Set up the outage and assign decision owners
Fictional scenario: at 10 a.m., your cloud-hosted order system becomes unavailable. Staff cannot confirm new orders or check live stock, a shipping cutoff is two hours away, and the provider has no confirmed restoration time.
Assume phone and email still work, a stock export from 9 a.m. is available, and no alternate order system has been tested. The outage cause is unknown; participants must separate confirmed facts from assumptions.
- Executive sponsor: approves service priorities and exceptions.
- Operations lead: defines what staff can safely process manually.
- IT lead: explains dependencies, evidence gaps, and recovery checks.
- Customer lead: drafts messages and records commitments.
- Finance lead: challenges assumptions about losses and duplicate transactions.
- Facilitator and recorder: release scenario updates and capture decisions, owners, and review times.
Compare three operating choices
Require the team to choose an approach for new orders and explain what would trigger a change. Each option leaves a different problem to manage.
| Choice | Potential benefit | Constraint to resolve |
|---|---|---|
| Pause order acceptance | Avoids accepting orders against uncertain stock | Who approves the pause, and how will customers hear about it? |
| Record requests without confirming fulfillment | Keeps a queue for later review | How will staff label requests as unconfirmed and prevent duplicates? |
| Accept limited orders using the stock export | May preserve some sales during the outage | What stock buffer, approval limit, and reconciliation process make this acceptable? |
Run the 60-minute workshop
Use these suggested timings. At each decision, record the chosen action, supporting evidence, owner, and next review time; treat missing information as an explicit constraint.
- Minutes 0–10: read the scenario, assign roles, and identify the workflow most affected by the shipping cutoff.
- Minutes 10–20: choose an operating approach and draft a customer update stating the known impact and next update time.
- Minutes 20–30: reveal that the stock export excludes several recent orders. Decide whether to tighten limits, pause confirmations, or continue with an approved exception.
- Minutes 30–40: reveal that the provider reports recovery, but two staff members still cannot submit orders. Define the evidence required before declaring your own service restored.
- Minutes 40–50: reveal that some manually recorded requests also appear in the recovered system. Assign reconciliation ownership and decide when normal processing can resume.
- Minutes 50–60: review the decision log and assign the most consequential fixes.
Debrief the handoff back to normal operations
Check whether the team named an outage decision owner, set limits on manual work, and kept customer promises consistent with available evidence. Ask which decision changed when the stock export became unreliable.
Write explicit recovery criteria: the order workflow passes an agreed check, manual requests are reconciled, and an accountable owner authorizes normal processing. A provider status update alone does not demonstrate that your workflow is ready.
Leave with one action record per gap: change, owner, due date, and verification method. For example, operations could rehearse reconciling a small fictional order queue before the next holiday coverage period.
Frequently asked questions
Does a cloud outage tabletop require technical staff?
Include someone who understands the affected workflow and its dependencies. Executives own business priorities and exceptions; the technical representative helps them avoid assuming that an untested workaround or recovery route will work.
Does this tabletop prove that cloud failover works?
No. It exercises decisions, authority, and coordination. Demonstrating failover or restoration requires a separate technical test with defined success criteria and observed results.
Run this as a real exercise
Team Exercises helps facilitators turn business training topics into AI-powered simulations with team links, decision rounds, analytics, and debrief-ready outcomes.
Start a free scenario