tabletop

DORA Art. 25 / NIS2 tabletop exercise generator — six curated scenarios

v1.0.0

NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install tabletop

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- tabletop

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

tabletop --help                # subcommand catalogue + flags
tabletop --full                # extended help across every subcommand
tabletop --about               # machine-readable attribution (JSON)
tabletop --version             # version string

What it does

tabletop is the consulting differentiator for the DORA Art. 25 / NIS2 Art. 21(2)(h) operational-resilience-testing requirement. Six baked-in scenarios (ransomware-01, insider-01, supply-chain-01, third-party-01, data-exfil-01, ddos-01) each with: a 4–5 inject T+HH:MM timeline, 3–4 decision points with multiple-choice options, 4–5 success criteria, and an explicit DORA / NIS2 / ISO/IEC 27001:2022 control mapping curated per scenario. Five subcommands: list / show / inject / generate (-F human|markdown|json|jfind) / report (jfind/v1 record with participants + ran_on timestamp). Markdown output is print-ready for in-person exercises. Pair with shellrec to record the exercise itself; pair with dossier to ship the after-action report; pair with complymap to satisfy the gap-assessment evidence requirement. Suite app: grc. Pure-static catalogue — no network, no state. 11 integration tests; zero warnings.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Compliance crosswalk

This table lists controls where tabletop's output may form part of the evidence set presented to an assessor. It does not claim tabletop alone satisfies any framework — every control still requires assessor judgment and typically evidence from other sources.

Schema: compliance-crosswalk/v1 · Machine-readable: tools/tabletop/compliance.json

DORA — Digital Operational Resilience Act (Reg. 2022/2554)

Ref	Name	How	Coverage
`Art. 25`	Testing of ICT tools and systems	generate subcommand emits IR exercise scenarios; report subcommand records exercise outcomes as evidence.	evidences

NIS2 — NIS2 Directive (Dir. 2022/2555)

Ref	Name	How	Coverage
`Art. 21 §2(f)`	Human resources security, awareness + training	Tabletop exercises satisfy the awareness / training sub-control.	supports

ISO27001 — ISO/IEC 27001:2022

Ref	Name	How	Coverage
`A.5.24`	Information security incident management planning and preparation	Exercise runs directly evidence the planning / preparation control.	evidences

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.

manifest.json — pinned SHA-256 + .sig URL + SBOM URL per platform
johlem-release.pub — Ed25519 public key used by signify -V (fingerprint: 4532510f…6748, pinned in jcli verify)
CHANGELOG.md — semver-tagged release notes
Security contact: security@johlem.net