ITU Enter the exercise
ITU · Global Cybersecurity Capacity Building

Cybersecurity Capacity Development Tabletop Exercise

A facilitated, scenario-based simulation where national teams invest scarce budget and people to build cybersecurity capabilities, weather real-world crises, and cooperate across borders — turning strategy theory into hands-on decisions.

6
Capability domains
47+
Capability cards
5
Nations at the table
8
Rounds of play
What to expect
A serious game with real strategic stakes
Each team leads a nation with a limited budget and a small expert workforce. Together you decide where to invest first, how to sequence dependent capabilities, and how to respond when cyber crises strike the region — all under a live clock and guided by expert facilitators.
🎯

Lead a nation

Manage a national budget and workforce. Every decision is a trade-off between cost, effort and long-term resilience.

🧩

Build a capability tree

Play capability cards that unlock one another. Foundational investments open advanced options in later rounds.

Face live injects

Ransomware, supply-chain compromise and disinformation hit each round. Preparation decides how hard they land.

🤝

Cooperate across borders

Trade specialists, sign agreements and coordinate with neighbours — international ties reduce shared risk.

How it works
From briefing to debrief
The exercise runs in short, timed rounds. Facilitators keep the tempo, drop crises into the story and lead the reflection that turns each decision into a lesson.
1

Get your mandate

Receive your nation's profile, objectives, starting budget and workforce at your captain's table.

2

Plan your round

Choose which capability cards to build this turn, weighing prerequisites, cost and people against the threats ahead.

3

Weather the injects

Crises resolve based on the capabilities you built. Being ready turns a disaster into a manageable incident.

4

Debrief & learn

Break to compare strategies, then close with a facilitated debrief connecting play back to real national policy.

The six domains
Balanced cyber capacity, the way maturity models measure it
Capabilities span the domains used by international cybersecurity capacity assessments. A resilient nation invests across all six rather than over-indexing on one.
Strategy & governance
Plans, authorities and national direction
Laws & regulation
Legal frameworks and standards
Technical & operations
CSIRTs, detection and response
People & skills
Awareness, education and workforce
Ecosystem & partners
Public-private and market growth
International ties
Cooperation, norms and diplomacy
International Telecommunication Union · Cybersecurity Capacity Development Tabletop Exercise