Glossary

What is HSEEP (Homeland Security Exercise and Evaluation Program)?

By Emily Yiu. Updated October 2026.

HSEEP, the Homeland Security Exercise and Evaluation Program, is the United States Federal Emergency Management Agency’s (FEMA) doctrine for building exercise programs and for designing, running, evaluating and following up on exercises. It’s US guidance, and much of the vocabulary used in tabletop exercises, including hotwash, inject and after-action report, comes from it.

What it means in practice

The current doctrine is the January 2020 revision, which replaced the 2013 version. It describes itself as flexible, scalable and adaptable, for use across the whole community and all mission areas. It rests on six principles: senior leader guidance, being informed by risk, capability-based and objective-driven design, a progressive planning approach, whole community integration and a common methodology.

It also gives a cycle of five phases: program management, exercise design and development, conduct, evaluation, and improvement planning. HSEEP sorts exercises into discussion-based types (seminars, workshops, tabletop exercises and games) and operations-based types (drills, functional exercises and full-scale exercises). Each phase has its documents: a situation manual and facilitator guide for discussion-based exercises, an exercise plan and master scenario events list for operations-based ones, evaluation guides, and an after-action report with an improvement plan.

HSEEP is American. A Canadian organization is not bound by it. Canadian emergency management bodies publish their own guidance. An archived 2012 course manual from the Alberta Emergency Management Agency, for example, uses some of the same vocabulary (hot-wash, MSEL, injects) without naming HSEEP. CISA’s tabletop planning handbook, by contrast, names HSEEP as its guidance.

For IT plans specifically, NIST SP 800-84 is a separate US guide to test, training and exercise programs.

Where it shows up in an incident

HSEEP covers exercises, not live response. Real-time command in an emergency comes from a different body of practice, the Incident Command System (see incident commander). What HSEEP governs is the work before and after: testing the plan, then turning findings into changes.

In a mid-size organization the owner is usually whoever holds the incident response plan, such as the CISO, the head of IT or the risk lead. Common mistakes:

  • Copying the full document set for a small exercise. Treat HSEEP as a menu.
  • Writing objectives that nobody can score, such as “test our readiness”.
  • Skipping improvement planning, the last phase and the one that turns an exercise into changes.
  • Running one exercise and calling it a program. HSEEP’s progressive approach is a series of exercises that build in complexity.

In a tabletop exercise

Two questions that borrow HSEEP’s method:

  • “Here is an objective: by the end of the first hour, an incident commander is named and the insurer’s breach line has been called. Could an evaluator mark that met or not met? Rewrite our objectives until each one passes that test.”
  • “Open the improvement plan from our last exercise. Which items have an owner and a due date, and who confirmed they were done?”

If the second question is uncomfortable, that is useful information. See the exercise evaluation guide for how objectives connect to what evaluators record.

Sources

Want to see how your team would handle this for real? Here is how a facilitated tabletop works.