The Analog Incident Compass Playmat: Designing a Floor-Sized Paper Map for Whole-Team Outage Walkthroughs

When you hear “tabletop exercise,” you probably picture people huddled around a conference table with binders, laptops, and coffee. Valuable, yes—but also easy to tune out, especially for people who don’t live in incident response every day.

Now imagine something different: a floor-sized, paper "incident compass" playmat—a physical map of your outage scenario that your entire team can literally stand on, move around, and explore together.

This is the idea behind the Analog Incident Compass: a large, visual, low-tech tool designed to make outage walkthroughs more immersive, collaborative, and memorable. It’s still a tabletop exercise in spirit, but the “table” is now the entire room.

In this post, we’ll look at why tabletop exercises matter, how an analog incident compass playmat works, and how to design one that fits into your broader preparedness and reliability program.

Why Tabletop Exercises Matter (And Why They Often Fall Flat)

Tabletop incident response exercises create a low-pressure, simulated environment where teams can practice handling cybersecurity or operational outages. Instead of waiting for real incidents to expose gaps, you safely rehearse:

Who responds first, and how they triage
How information is shared across teams
Which tools, dashboards, and runbooks people actually use
How leadership and external stakeholders are updated

Critically, the primary goal is learning, not a pass/fail exam of your formal plans and procedures. When done well, tabletop exercises:

Encourage open discussion instead of performance anxiety
Reveal misunderstandings and mismatched expectations
Highlight places where documentation is missing, outdated, or unused
Build familiarity among people who will work together under pressure

However, many tabletop sessions are:

Too abstract (“there’s an outage… what do you do?”)
Too document-centric (everyone reading aloud from PDFs)
Too passive (a few people talk; others spectate)

An analog incident compass playmat aims to fix this by making the exercise tangible, spatial, and shared.

From Tabletop to Floor Map: What Is an Analog Incident Compass?

An Analog Incident Compass is a large-format paper playmat—often printed on plotter paper or assembled from taped sheets—that you lay on the floor or a large table. It’s a visual map of your incident space, designed for whole-team participation.

Think of it as a hybrid between:

A crisis management board
A service topology diagram
A game board for your outage scenario

People stand around (or on) the map. They move sticky notes, tokens, or cards to represent:

Systems and services
Teams and roles
Decisions and actions
Information flow and communication channels

Instead of talking about the incident in abstract terms, you’re walking and pointing through it.

Designing the Incident Compass: Key Elements

You can customize an incident compass to your environment, but most effective designs include these components.

1. Core Zones on the Map

Organize the playmat into clearly labeled zones that mirror how your organization actually works during an incident. For example:

Detection & Signals – Monitoring, alerts, user reports, anomaly dashboards
Triage & Diagnosis – On-call responders, SRE/ops engineers, security analysts
Mitigation & Recovery – Runbooks, rollback paths, failover procedures
Communication & Stakeholders – Internal channels, leadership updates, customer comms
Post-Incident & Learning – Incident review, action items, follow-up testing

These zones give participants a shared mental model: as the scenario unfolds, they physically move notes and tokens across zones to show how the response evolves.

2. Scenario Tracks and Time Markers

To match time-bounded sessions (like a two-hour exercise), add a simple timeline arc to the map:

T0 – First alert or signal
+15 min – Escalation decisions
+30–60 min – Major mitigations
+90–120 min – Recovery and stabilization

You can advance along this timeline as a facilitator, explaining what new information arrives at each stage. Participants place their planned actions along the track, which makes trade-offs and delays highly visible.

3. Stakeholder and System Tokens

Use physical objects to represent the moving parts of your incident:

Team tokens: cards for SRE, security, networking, application teams, leadership, legal, PR, helpdesk, etc.
System tokens: icons for key services, databases, external dependencies, and critical user flows.

Place tokens in zones to answer questions like:

Who owns the current action?
Which systems are affected now vs. at risk later?
Where are communication bottlenecks?

This encourages cross-team communication because everyone can see, at a glance, who’s involved and who’s missing.

Using Scenario-Based Templates: ESK, T.E.S.T., and Friends

You don’t have to invent exercise structures from scratch. Scenario-based templates and guides like ESK or T.E.S.T. (and other public frameworks) help facilitators:

Define exercise objectives and scope
Standardize the sequence of injects (new events or information)
Align stakeholders on what “good” looks like

When paired with the incident compass, these templates become scripts for the game board:

ESK/T.E.S.T. gives you the storyline and decision points.
The playmat gives you the space to visualize those decisions.

You might, for example:

Choose a scenario: ransomware in a school district; DDoS on a public service; payment processing outage during a major event.
Use a template to outline phases: detection, containment, eradication, recovery, communication.
Translate those phases into the zones and timeline of your incident compass.

This pairing lets you run repeatable, comparable exercises while still feeling dynamic and engaging.

Running the Exercise: How the Playmat Changes the Dynamic

A floor-sized incident compass changes not just the visuals, but the behavior of participants.

1. Everyone Sees the Same Picture

Instead of each person staring at their own laptop, everyone views a single shared artifact. This:

Makes hidden assumptions obvious (“Wait, I thought networking handled that, not SRE”)
Reduces siloed side conversations
Helps non-technical stakeholders understand the flow of the outage

2. Encourages Open, Cooperative Discussion

People are standing, moving, pointing, and negotiating:

"If security is here, who is watching this system?"
"We can’t do that mitigation until this dependency is stable."
"Who tells the school superintendent / event organizers / executive team?"

This mirrors how real incidents unfold: fast exchanges, visible trade-offs, and cross-team coordination—not quiet note-taking and formal speeches.

3. Keeps the Session Focused and Time-Bounded

The facilitator moves the group along the time markers:

"We’re now at +30 minutes. You’ve tried X, and it failed. What next?"
"We’re at +90 minutes. Systems are partially restored, but customers are confused. What’s the communication plan?"

The physical timeline helps keep a two-hour exercise on track and ensures you touch every phase, from detection to recovery.

Capturing Outcomes: Reports and Lessons Learned

The visual nature of the incident compass makes post-exercise evaluation easier.

Before you tear down the playmat, take photos and transfer key information into a report template, such as:

What worked well: clear ownership, effective runbooks, good escalation paths
What failed or was missing: undocumented systems, unclear decision authority, brittle dependencies
Action items: documentation updates, runbook creation, monitoring improvements, training needs

Because participants spent the session externalizing their mental models onto the map, the debrief is less abstract:

"See this cluster of tokens? That’s where we had three teams waiting on one decision."
"Notice how no one stood in the ‘stakeholder communication’ zone for the first 60 minutes. That’s a gap."

The incident compass becomes both a teaching tool and a diagnostic instrument.

Fitting Into a Larger Preparedness and Reliability Program

Floor-sized exercises might sound extravagant, but they can be crucial in high-risk environments:

Critical infrastructure (power, water, transit)
Schools and universities
Hospitals and public health systems
Large-scale events (sports, concerts, festivals)

In these settings, the cost of confusion during a real outage is enormous. The incident compass is one piece of a broader evaluation and preparedness program that also includes:

Regular, smaller tabletop drills
Tooling and monitoring improvements
On-call and escalation practice
Blameless postmortems after real incidents

That last point is important. When you pair tabletop drills with blameless postmortems, you create a cycle:

Real incident occurs; you run a blameless review.
You discover gaps in communication, tooling, or understanding.
You design a new incident compass scenario around those weaknesses.
You run the exercise, improve, and update documentation.
Next real incident hits; you’re more prepared—and you review again.

Over time, this builds a culture of reliability, collaboration, and continuous improvement, not fear and finger-pointing.

How to Get Started

You don’t need a design team or a big budget to try an analog incident compass:

Sketch it on paper first. Draw zones and a timeline on a whiteboard or butcher paper.
Print a simple large map. Use a plotter or tape together A3/A4 sheets.
Use sticky notes and index cards. These become your team and system tokens.
Pilot with a small group. Run a 60–90 minute exercise and ask what helped or confused people.
Iterate. Refine zones, labels, and tokens until the map matches how your organization really responds.

The goal is not artistic perfection; it’s to create a shared, physical space where your outage story unfolds and everyone can see their part in it.

Conclusion

Tabletop exercises are already a powerful way to practice incident response in a low-pressure, simulated environment. A floor-sized analog incident compass playmat amplifies that power by making the exercise visual, embodied, and collective.

By combining scenario-based templates (like ESK and T.E.S.T.) with a physical map of your systems, teams, and timelines, you:

Encourage open, cross-team communication
Turn abstract outages into concrete, navigable stories
Make it easier to capture lessons learned and prioritize improvements
Strengthen the bridge between practice (tabletops) and reality (blameless postmortems)

In a world of increasingly complex systems and high-stakes outages, sometimes the most effective tool is refreshingly simple: a big piece of paper on the floor, a handful of markers and sticky notes, and a room full of people learning together.