A drill you run twice a year

The only way to know the emergency plan works is to try it when nothing is at stake. A short drill, twice a year, finds the expired login, the template nobody can find and the approval chain that breaks when one person is on vacation.

This lesson gives you a one-hour tabletop drill you can run with three to six people.

What a tabletop drill is

A tabletop exercise is a discussion-based walk-through of a made-up emergency. The people who would respond sit together (or join a call), hear the scenario unfold and say and do what they would do.

FEMA's Homeland Security Exercise and Evaluation Program (HSEEP) sets out the principles many public agencies use for exercises. CISA publishes free Tabletop Exercise Packages with ready-made scenarios, mostly for cybersecurity and physical security.

Your drill is small: one scenario, one hour, focused on public information. Some steps are real (logging in, filling a template), and nothing reaches the public.

When to run it

Twice a year, before the seasons when your likely emergencies happen. For many communities that means late spring, before storm or wildfire season, and late fall, before winter. Put both dates on the calendar for the year now.

Who takes part

• the person who posts to the website, and their backup,
• the person who approves emergency messages, and their backup,
• whoever runs social media,
• your emergency manager or public information officer, if they can join.

In one of the two drills each year, the backups do the work while the main people watch.

The scenario: a storm closes roads

Read each part aloud, then give the group time to act.

Part 1, 6:40 a.m. Overnight rain has flooded Route 9 at the river crossing. Police have closed it. Two schools are on the far side. The phones at Town Hall will open at 8.

• Who is told first, and how?
• Post the first notice from your template as a draft. Time it.
• Write the alert bar line.

Part 2, 8:15 a.m. The county sends a phone alert about the closure. It links to your emergency page. Your web provider says the page is getting heavy traffic.

• Open the draft page on a phone over cellular data. How long does it take to load?
• What is the next update time you promised?

Part 3, 11 a.m. The person who posted the first notice has to leave. Route 9 will reopen at 4 p.m.

• Write the hand-off note.
• The backup logs in (for real) and drafts the second update with a "What changed" line.

Part 4, 4:20 p.m. Route 9 is open.

• Draft the closing message.
• Who tells social media and the alert service?

What to check during the drill

Keep a timer and a notes page. Record:

1. Did every login work, including the backups', with two-step sign-in?
2. How many minutes did the first notice take?
3. Could everyone find the templates from a phone?
4. Did the approval path work when the main approver was not available?
5. Did anyone not know what to do?

After the drill

Spend the last ten minutes on fixes. HSEEP records exercise results in an After-Action Report and Improvement Plan: strengths, areas for improvement and corrective actions. Yours can be one page. Each fix gets an owner and a date, and the first item on the next drill's agenda is checking that the fixes were made.

Delete the practice drafts, or label them clearly as drill material, so nobody can publish one by mistake.