ITU · Global Cybersecurity Capacity Building

Cybersecurity Capacity Development Tabletop Exercise

A facilitated, scenario-based simulation where teams invest scarce budget and people to build cybersecurity capabilities, weather real-world crises, and cooperate across borders — turning strategy theory into hands-on decisions.

Reset admin password

Choose a new password for the admin account. This link works once.

New password Confirm

Opening the table…

Joining as a viewer — no password needed.

Enter the exercise

Captains and facilitators receive their username and password from the exercise organiser.

Have a table code?

Captain guide · Facilitator guide

Sends a one-time reset link to the organisation recovery mailbox.

What to expect

A serious game with real strategic stakes

Each team has a limited budget and a small expert workforce. Together you decide where to invest first, how to sequence dependent capabilities, and how to respond when cyber crises strike the region — all under a live clock and guided by expert facilitators.

Lead a nation

Manage a national budget and workforce. Every decision is a trade-off between cost, effort and long-term resilience.

Build a capability tree

Play capability cards that unlock one another. Foundational investments open advanced options in later rounds.

Face live injects

Ransomware, supply-chain compromise and disinformation hit each round. Preparation decides how hard they land.

Cooperate across borders

Trade specialists, sign agreements and coordinate with neighbours — international ties reduce shared risk.

How it works

From briefing to debrief

The exercise runs in short, timed rounds. Facilitators keep the tempo, drop crises into the story and lead the reflection that turns each decision into a lesson.

Get your mandate

Receive your team's profile, objectives, starting budget and workforce at your captain's table.

Plan your round

Choose which capability cards to build this turn, weighing prerequisites, cost and people against the threats ahead.

Weather the injects

Crises resolve based on the capabilities you built. Being ready turns a disaster into a manageable incident.

Debrief & learn

Break to compare strategies, then close with a facilitated debrief connecting play back to real national policy.

The six domains

Balanced cyber capacity, the way maturity models measure it

Capabilities span the domains used by international cybersecurity capacity assessments. A resilient nation invests across all six rather than over-indexing on one.

Strategy & governance

Plans, authorities and national direction

Laws & regulation

Legal frameworks and standards

Technical & operations

CSIRTs, detection and response

People & skills

Awareness, education and workforce

Ecosystem & partners

Public-private and market growth

International ties

Cooperation, norms and diplomacy

What you'll take away

Learning outcomes

The exercise is designed for policymakers, regulators and technical leaders. Beyond the game, participants leave with sharper instincts for the decisions that shape national cyber resilience.

Strategic prioritisation

Practise sequencing investments under real budget and workforce constraints — and living with the consequences.

Resilience thinking

See first-hand how preparation before a crisis changes its impact — the core logic of incident readiness.

Cooperation & diplomacy

Experience why cross-border trust, information sharing and mutual aid make every nation safer.

A shared vocabulary

Leave aligned on the domains and trade-offs of national cybersecurity capacity building.

International Telecommunication Union · Cybersecurity Capacity Development Tabletop Exercise Sign in above with the credentials from your organiser.

■

Session terminated

The facilitator has ended this exercise. Your table is now closed.
Please await further instructions from the exercise team.

Welcome, captain of {{ teamName }}

The exercise hasn't started yet.
Your table will appear as soon as the lead facilitator starts Round 1.

● Waiting for admin…

You are {{ teamName }}

Your mission: {{ goalText }}

Table code

Read it out at the table — no password.

View link

Budget

Your team

People don't refill each round — assign them wisely

Round {{ roundFocus.round }}

This round

Tap a team to sit at their table — budgets stay secret in the real game

New capabilities available

Build your team's capabilities

Cards with a colored ring are ready to build now. Building one opens the next steps in that track from the following round.

Ready to build Built Not yet open

Mission progress{{ missionProgressLabel }}

Capability-specific objectives, weighted by core and stretch priority.

Nothing planned yet.
Tap a card with a colored ring to add it.

Talk & trade

Trade with a neighbour

Propose a deal — the other team must accept before anything moves. Transfers cannot be undone.

Offers for your team

Partner team

Your offer

People

Budget ($ thousands)

Price ($ thousands)

What happened so far

Master Dashboard

Break Debrief min

Round {{ staffRoundFocus.round }}

This exercise

Every play is recorded with its location so groups can be compared later.

City

Country

Today: {{ todayText }} · currently in round {{ roundNum }}

Enter both the host city and country before starting a new exercise.

Specialist transfer

Move a professional between teams. Sell at the market fee, or donate as a goodwill inject from the donor team.

Donor team (gives 1 person)

Recipient team (gains 1 person)

Negotiated fee — thousands of $ (default 100)

× $1,000 — set whatever the two captains agreed at the table

Team trade offers

Captains negotiate at the table, then send offers here. Instant sell/donate above is for facilitator injects only. Accepted trades cannot be undone.

Proposer team

People

Budget ($ thousands)

Price ($ thousands)

Pending offers

Pending

No pending trade offers.

Neighbour aid inbox

Captains ask for or offer help from Play. Fulfill requests with a grant, or accept offers to move resources between teams.

No pending aid requests or offers.

Inject calendar

Round {{ i.turn }}

Facilitator may activate

Not on the calendar — fire from the console when the table needs them.

Manual inject console

Activate or queue one inject for all teams or a selected mix of countries, agencies and organizations. Auto effects are calculated separately for each team's preparedness.

Inject

When

Preparedness

Impact

Targets

What will happen

Audience{{ facBulk.targetSummary }}

Timing{{ facBulk.timingLabel }}

Calculation{{ facBulk.effectLabel }}

Behavior{{ facBulk.behaviorLabel }}

{{ p.pct }}% preparedness · {{ p.detail }}

Budget{{ p.budgetBefore }} → {{ p.budgetAfter }}

People{{ p.peopleBefore }} → {{ p.peopleAfter }}

{{ p.outcomeTitle }}

Already-applied teams are skipped; the same inject cannot stack until the exercise is restarted.

Queued manual injects

Load a queue into the console to adjust recipients, then cancel the old queue and submit the replacement.

{{ q.title }} · Round {{ q.round }}

{{ q.targets }} · {{ q.effect }}

No manual injects are queued.

Budget

People

Built

Budget

People

Inject

{{ t.injectPreviewPct }}% · {{ t.injectPreviewDetail }}

· queued Round {{ t.injectQueuedRound }}

· already applied

Budget{{ t.injectBudgetBefore }} → {{ t.injectBudgetAfter }}

People{{ t.injectPeopleBefore }} → {{ t.injectPeopleAfter }}

{{ t.injectOutcomeTitle }}

Debrief pack — turn rationales

Captain rationales are archived when you advance the round. Use this during break, debrief, and at exercise end.

Gap: {{ o.gaps }}

This round (draft)

Round {{ e.round }}{{ e.builtNote }}

No rationale recorded yet.

No rationales yet — they appear here once captains write them and when rounds advance.

⚑

No scenario selected for this session

The exercise can't start until a scenario is chosen. Open Prepare → Scenarios, pick Use this scenario, then return to Run → Master Dashboard to start.

Waiting for the admin to select a scenario and start the exercise. This screen will be ready once they do.

Budget

Team

Progress

Team brief

General profile

Cyber threat landscape

Cybersecurity maturity

Starting position (pre-played)

At the start of the exercise your team already has {{ profStart }}.

Your objectives

What {{ teamName }} is expected to achieve by the end of the exercise — the debrief measures you against these.

{{ o.n }} {{ o.text }}{{ o.priority }} · {{ o.progressLabel }}

Mandate and operating position

Use this dossier to decide what your team can commit, what it needs from others, and where cooperation has limits.

Your capabilities

Everything your team has built so far, by track.

✓

Nothing built yet — head to the Play tab.

Capital / base: {{ mapTeamDetail.capital }}

Mission
{{ mapTeamDetail.mission }}

Maturity
{{ mapTeamDetail.maturity }}

Threat context
{{ mapTeamDetail.threat }}

Image type

Image name

Change image

Other Actors

Exercise profiles

Scenario context and team briefings from the active scenario — for facilitators and admin.

Team profiles

Other Actors

Capital / base: {{ mapTeamDetail.capital }}

Mission
{{ mapTeamDetail.mission }}

Maturity
{{ mapTeamDetail.maturity }}

Threat context
{{ mapTeamDetail.threat }}

Image type

Image name

Change image

Other Actors

Available amount

Resources

People carry over between rounds

Capabilities ({{ capTotal }} cards)

Built {{ capBuilt }}Ready {{ capReady }}In plan {{ capPlan }}Locked {{ capLocked }}

Where you stand, by track

A count of your capabilities in each of the six tracks.

Track	Built	Ready	In plan	Locked	Total
{{ r.label }}	{{ r.built }}	{{ r.ready }}	{{ r.plan }}	{{ r.locked }}	{{ r.total }}
All tracks	{{ capBuilt }}	{{ capReady }}	{{ capPlan }}	{{ capLocked }}	{{ capTotal }}

Your cards — have, can play & planned

Tap a card name for details. Add any ready card straight to this turn's plan.

Card	Track	Cost	Staff	Status	Action
	{{ c.track }}	{{ c.cost }}	{{ c.staff }}	{{ c.statusLabel }}

No cards in this view.

Standings — all teams

Team	Available $	People	Built	Ready	In plan	Locked	This turn
{{ r.tag }}{{ r.name }}{{ r.presenceLabel }}	{{ r.budget }}	{{ r.hr }}	{{ r.built }}	{{ r.ready }}	{{ r.plan }}	{{ r.locked }}	{{ r.status }}

Built = capabilities in place · Ready = prerequisites met, can be built now · In plan = staged for this round · Locked = prerequisites not yet built. Counts use the active V2 profile and scenario allowlist. Click Open to sit at any team's table.

Table cards

On screen: username, password, and table code for staff prep. Print: one self-contained sheet per team with the global scenario, that country or agency profile, the table code only, and the regional map. Observers open /app and enter the table code to watch. They cannot play.

Region

Team	Brief	Username	Password	Table code	Watch
{{ c.profileKind }} {{ c.teamName }}	{{ c.brief }}	{{ c.username }}	{{ c.password }}	{{ c.viewCode }}	Open /app and enter this code to watch. You cannot play.

Global scenario

Table code

Open /app and enter this code to watch. You cannot play.

Who are we · What must we protect · What can we not do alone · What do we need from others

No captain seats yet. Choose Use this scenario first, then return here to print cards.

Administration & statistics

⚑

No scenario selected for this session

Open the Scenarios tab, pick Use this scenario, then return here to start the exercise.

✓

Active scenario: {{ scenarioLabel }}

This scenario will be used when you start the exercise.

Exercise profiles

Scenario framing and per-team briefing material for facilitators.

User accounts

Accounts start without passwords. Captains log in with the country or organisation name at their table (Helvar, Valmera, …). Admin can set a static username on a row; that login stays across scenario changes until admin renames it. Auto country-name logins follow the table and keep the same password. Captain passwords use the easy workshop format username-###; the three digits are random. Once set, they stay across exercise end, restart, and scenario changes. Only Generate passwords or Set/Reset on that row changes them. Facilitators keep strong, static passwords across exercises and scenarios. A facilitator password changes only when admin explicitly uses Set or Reset on that facilitator row. The single administrator account is admin. New facilitators start with workshop floors (activate injects, session control, advance/restart, break/debrief, resources). Toggle Library, cards, passwords, Play captains, and the rest only when needed.

Current sign-ins and login/logout history for facilitators, captains, and admin. Only one active login per username — a second sign-in forces the first session out.

Current status

{{ s.username }} {{ s.role }} {{ s.status }} {{ s.location }} In since {{ s.loginAt }}

No one is signed in right now.

Activity log

No login events recorded yet.

Admin password & recovery

Change your admin password. Facilitators cannot change their own passwords — ask admin for a reset.

Current password

New password

Confirm new

Recovery email {{ recoveryEmailHint }}

Confirm with admin password

Forgot-password uses the recovery mailbox set above.

Debrief pack — turn rationales

Archived captain rationales for the current exercise (same pack as on Run → Master Dashboard).

This round (draft)

Round {{ e.round }}{{ e.builtNote }}

No rationale recorded yet.

No rationales yet for this exercise.

Past plays

Open an evidence-led after-action report for objective progress, capability gaps, inject exposure, decisions and facilitator recommendations. Progress supports the debrief; it is not a team ranking.

No plays recorded yet. Exercises that finish past round 1, or that you restart / terminate after round 1, appear here for comparison.

Messages

Negotiate with other captains here. Captains can also message facilitators or admin when they are online. Staff can reply to any captain. All messages are saved for this exercise session for later review.

No exercise session id yet. Staff: start the exercise to mint one (shared with all clients). Messaging and feedback attach to that id until restart.

Session id: {{ playSessionIdShort }}

Recipients

Staff appear for captains only while online.

No recipients available yet.

Thread with {{ msgPeerLabel }}

Inbox

{{ m.body }}

No messages in this view yet. Pick a recipient and send one.

Message

Exercise feedback

Your assessment

Submitted {{ evalSubmittedLabel }} — you can update and resubmit.

{{ q.prompt }} ({{ q.reqLabel }})

Suggestions to change or improve the TTX

Review responses

Average score

{{ evalResponseCountLabel }} · scale to 100%

{{ a.text }}

{{ x.prompt }}: {{ x.text }}

Suggestions

{{ t.suggestions }}

Individual submissions

{{ a.label }}: {{ a.value }}

Suggestions

{{ r.suggestions }}

No evaluation responses for this filter yet.

Questions

Admin can change the assessment prompts. Captains see and submit the live form; staff only review responses.

{{ p.idx }}. {{ p.prompt }} ({{ p.typeLabel }} · {{ p.reqLabel }})

Question {{ q.idx }}

Prompt

Type

Scale (2–10)

Loading scenarios…

Import JSON…

Start from a working structure

Create an editable four-round starter with team roles, round briefs and complete team dossiers. Nothing becomes active until you choose Use this scenario.

In use

{{ s.badgeLabel }} Updated {{ s.updated }}

{{ s.region }} · {{ s.modelLabel }}

Rounds

Teams

Start cards

Scenario basics

Scenario name

Region name

Subtitle

Description

Exercise structure

V2 deck profile

Captain inject detail

Full impact override

Scenario card allowlist

Headline cards

Caption (optional)

Scenario image

One visual for Profiles / Region / Scenario Overview. Choose what it shows — works for multi-country workshops (geography) and national-level workshops (entities/roles as teams). Uploads need the server.

What is this image?

Image name

Image

Rounds & timing

Number of rounds

No fixed cap — set as many rounds as the scenario needs (1–40).

Round length (min)

Transition (min)

Break length (min)

Debrief length (min)

Schedule — breaks & debriefs

Toggle a break or debrief to run after each round.

RoundBreak afterDebrief after

Round {{ r.n }}

Round {{ r.n }} purpose, deliverable & debrief

Round title

Objective

Required deliverable

Facilitator debrief question

Teams

No teams yet — add the first one.

Team details — {{ libEd.sel.name }}

Tag

Name

Team represents

Colour

Captain username

Captain password

Defaults to the country name in lowercase and name-###. You can change both before saving.

Team brief

Shown as Country or Agency profile on print.

Starting budget

Starting people

Map marker X (%)

Map marker Y (%)

Optional percentage coordinates place this team on the operational scenario map. Supply both values or leave both empty.

Round envelopes

Granted to this team when each round begins. Round 1 is added on session start (on top of starting budget/people). Default is 0 for both.

RoundFundsResources

Round {{ e.n }}

Mission

General briefing

Threat picture

Maturity

Mandate, dependencies and negotiation position

Mandate

Decision authorities

Assets and strengths

Dependencies

Vulnerabilities and constraints

Red lines

Negotiation position and goals

Objectives

Evaluation

Priority

Requirement groups — every group must pass

Build the rule visually. Each group represents one capability area. The objective passes only when every group below passes.

No capability groups yet. Add a group, choose whether one card or every card is needed, then select the cards.

Capability group {{ g.number }}

Group name

How this group passes

Cards in this group

Select at least one card. An empty group will be flagged before the scenario can be used.

Add a capability card

Starting deck · pre-game

{{ libEd.sel.deckCount }} selected

Cards each team already holds when Round 1 begins. Missing prerequisites are flagged in Checks.

{{ c.code }}×

Card prerequisites — this scenario

Override which cards must be built first, for this scenario only. Starts from the game-wide rules; changes here are saved with the scenario and don't affect other scenarios. {{ libEd.cardRulesLabel }}.

{{ c.code }} {{ c.name }} {{ c.depCount }} req

Prerequisites

{{ p.code }}×

No prerequisites — buildable from the start in this scenario.

Add a prerequisite

Required by

Select a card to view and override its prerequisites for this scenario.

Scheduled injects

Every inject in the library can be scheduled. Pick an event, choose its round, then target every team or any combination of countries, agencies and organizations.

Round {{ p.round }}{{ p.countLabel }}

No inject planned. This is allowed; confirm the round still has enough pressure or decision change.

No scheduled injects yet.

Legacy inline

Inject

Round

Round 1–{{ libEd.rounds }}

Targets · {{ r.targetSummary }}

Starting-position preview

{{ p.name }}{{ p.pct }}%

{{ p.money }} · {{ p.people }}

Preview uses each team’s starting cards. Capabilities built before this round can improve the live result.

Flexible / manual injects

Use this list for approved events without a fixed round. Every library inject is available here—even if its suggested default is Scheduled—and the facilitator decides when to activate it during play.

No flexible injects selected. Unscheduled events are not added automatically; choose the ones the facilitator may use at their discretion.

Checks

{{ libToast }}×

Injects

Injects Library

Code

Suggested use

A suggestion only. Every inject can be assigned either way in a scenario.

Tone

Impact policy

Title

Description

Calendar title

Calendar note

Prepared title

Unprepared title

Prepared description

Unprepared description

Prepared $ / people

Unprepared $ / people

Prepared if team has any of these cards

Leave empty to use scenario capability cards instead.

None selected — uses scenario capability cards.

Money effect

People effect

V2 preparedness rules

Structured JSON is retained exactly. Each requirement group uses an id, label, and anyOf or allOf card codes. Effects may define 25, 50, 75, and 100 percent levels.

Requirement groups

Effects by preparedness

Add / Create new inject

Define a new scheduled or flexible inject for the library — code, title, effects, and optional prepared / unprepared variants with required cards. Opens the same editor used for Edit.

Possible resource impact{{ r.effectSummary }}

Preparedness{{ r.preparednessLabel }}

No injects match your search.

Game-wide · affects all scenarios

Card dependencies

{{ cardMgr.deps.overrideLabel }}. Editing a card's prerequisites changes it for every scenario.

Card pool

{{ c.code }} {{ c.name }} {{ c.depCount }} req

Prerequisites

{{ p.code }}×

No prerequisites — this card is buildable from the start.

Add a prerequisite

Required by

Select a card to view and edit its prerequisites.

Deck · shared across scenarios

Cards

Card quality & overlap review

Review content completeness, artwork, mechanics and deliberately related capabilities. A related pair is not automatically a duplicate.

Quality ready{{ cardMgr.governance.readyCount }}/{{ cardMgr.governance.total }}

Artwork ready{{ cardMgr.governance.artReadyCount }}/{{ cardMgr.governance.total }}

Needs review{{ cardMgr.governance.needsReviewCount }}

Documented overlap pairs{{ cardMgr.governance.declaredCount }}

Possible duplicate names{{ cardMgr.governance.sameNameCount }}

Quality exceptions

All active cards currently have complete decision copy, at least two team deliverables, facilitator metadata, valid mechanics and artwork.

{{ issue.code }} — {{ issue.name }}

Related and possible duplicate cards

The six approved Full 77 overlap pairs are shown as distinct maturity or operating steps. Possible duplicate names created later are also surfaced here for review. Consolidate references before deleting either card.

What it is{{ pair.left.definition }}

What this builds{{ pair.left.effect }}

Money{{ pair.left.cost }}People{{ pair.left.effort }}

What it is{{ pair.right.definition }}

What this builds{{ pair.right.effect }}

Money{{ pair.right.cost }}People{{ pair.right.effort }}

Why they remain distinct: {{ pair.rationale }}

Card details

Code

Codes are stable identifiers used by scenarios and injects.

Group

Name

Tier

Cost (− spend / + gain)

Effort (people)

What it is

What this builds

Why it matters

Team deliverables

V2 metadata

Capability class

NCS Guide references

Cybersecurity Capacity Development Tabletop Exercise

Lead a nation

Build a capability tree

Face live injects

Cooperate across borders

Get your mandate

Plan your round

Weather the injects

Debrief & learn

Strategic prioritisation

Resilience thinking

Cooperation & diplomacy

A shared vocabulary

{{ injectNotice.eventTitle }}

{{ injectNotice.outcomeTitle }}

{{ facBulk.injectTitle }}

{{ r.title }}