16 min read
Cybersecurity Tabletop Exercises: Scenarios, Template, and How to Run One
A cybersecurity tabletop exercise is a discussion-based walkthrough of a simulated cyber incident – no systems touched, just your team, a scenario,...
6 min read
Steve Wilson
:
Updated: Aug 14, 2026
In a workplace emergency, the order of actions is: assess the situation, alert everyone affected at once, act on your emergency plan, account for every person, and give a clear all-clear. This guide walks through each step, the preparation that makes them work under stress, and the messages to send at every stage.
Table of contents
1. What counts as a workplace emergency?
2. How to handle an emergency at work: the five steps
3. What are the 3 C’s of handling an emergency?
4. How to prepare before an emergency happens
5. Who does what: emergency roles in the workplace
6. How to communicate during an emergency
7. After the all-clear: review and record
A workplace emergency is an unplanned event that threatens your employees, visitors, premises, or operations and demands immediate action. The common workplace scenarios are:

Every scenario differs in detail, but the sequence that keeps people safe is the same five steps, in order:

The 3 C’s – Check, Call, Care – come from first-aid training, and they map directly onto the workplace sequence:
The 3 C’s keep an individual’s first minute structured. The five steps keep the whole organization’s response structured. You need both.
Handling an emergency well is mostly decided before it starts.
Six things to have in place:
Confusion about responsibility costs minutes. The split that works:
Communication is the step that turns a plan into coordinated action – and the one that fails most visibly when it relies on a single channel. Email is slow and often unread in the moment; a PA announcement misses remote and off-floor staff. The pattern that works is layered: an on-screen alert that appears over whatever employees are working on, a mobile push for anyone away from a desk, and corridor or signage screens for shared spaces.
Three messages carry the response:
Example start signal – fire evacuation
“FIRE ALARM – Floor 2, east wing. Evacuate now via stairwells A and B. Do not use elevators. Assembly point: parking lot C. Acknowledge this alert when you are out of the building.”
Nine more scenario messages – lockdown, chemical spill, severe weather and others – are in the free template pack.
For an employee-facing system this is the core use case: our guide to emergency communication software covers how to choose one, and the template pack gives you the wording for each of the three messages.
The response ends with the all-clear; the improvement starts after it. Hold a short debrief the same day while memory is fresh, then capture what happened in an after action report: what was expected, what actually happened, and who fixes what by when.
The communication part of that record is the easiest to get right, because it does not rely on recollection: if your alerting tool logs delivery and acknowledgment, you can see when the alert went out, who confirmed it, and who was reached late – and feed exactly that into the next revision of the plan and the next drill.
Handling a workplace emergency is five steps executed in order – assess, alert, act, account, all-clear – by people who knew their roles before the day arrived. The preparation list above decides whether those steps take seconds or minutes; the communication layer decides whether everyone hears them in time. Prepare the plan, practice it, and make sure the alert reaches every screen and pocket it needs to.
DeskAlerts delivers emergency alerts to employee screens and mobile devices in a can’t-miss format – with delivery and acknowledgment logged, so you know who has been reached and can prove it afterwards.
Assess before you act: take a few seconds to understand what is happening, where, and who is in danger – from a safe position. Then raise the alarm and send the alert that tells people what to do. Acting without assessing wastes the assessment; assessing without alerting wastes the seconds that matter most.
Five steps, in order: assess the situation from a safe position; alert everyone affected on every available channel with a clear instruction; act on the emergency plan (evacuate, shelter, or lock down); account for every person at the assembly point; and give an explicit all-clear before anyone returns.
Check, Call, Care – a first-aid sequence: check the scene for danger, call for help (emergency services and the internal alert), and care for those affected within the limits of your training. In a workplace it complements the organizational five steps rather than replacing them.
The compact version used in many procedures: assess, alert, act, account. The workplace version adds a fifth – the explicit all-clear – because uncontrolled re-entry is one of the most common ways people get hurt after the main event.
Fire or explosion, medical emergencies, severe weather, security threats such as an intruder or active shooter, hazardous material spills or gas leaks, major utility or IT failures, and nearby civil disturbances that affect employee safety. Each needs its own response procedure in the emergency action plan.
The employer is responsible for having a plan, a working alerting system, training, and equipment. During an event, a named emergency coordinator runs the response, floor wardens sweep and report their zones, first-aiders provide care, and every employee is responsible for knowing the exits and following the official instruction.
At least annually for the baseline evacuation drill, and more often for high-risk sites or scenario-specific responses – many organizations run one full drill plus one or two smaller exercises per year. The practical guide is our workplace emergency drills article, which covers frequency by drill type.
The emergency action plan defines what people do: procedures, routes, roles, and equipment. The emergency communication plan defines how everyone finds out: channels, message templates, senders, and the update cadence. They fail separately – a good plan nobody hears about protects nobody.
Send urgent notifications to PCs, phones, tablets, digital signage, and other corporate devices.
Display high-visibility alerts directly on employees' screens to help ensure critical messages are seen and acknowledged. Reach employees even when computers are locked, in screensaver mode, or idle.

16 min read
A cybersecurity tabletop exercise is a discussion-based walkthrough of a simulated cyber incident – no systems touched, just your team, a scenario,...
15 min read
An after action report is the document that decides whether your drill was practice or just interruption. It records what was supposed to happen,...
22 min read
Emergency drills at work let employees practice a defined response and show safety teams whether instructions reached the right people.
11 min read
Your organization needs to be prepared for a range of emergencies. If you aren’t scheduling fire drills as part of your emergency preparedness, you...
8 min read
If an active shooter is on the loose, you’ll have a little-to-no warning that they are about to attempt to kill and injure people.
7 min read
How Does DeskAlerts Support Crisis Communication? Organizations must be ready to respond to crises quickly and effectively to protect employees,...