The Homeland Security Exercise and Evaluation Program (HSEEP) is FEMA’s standardized methodology for designing, conducting, and evaluating emergency exercises. It gives you a common language, a repeatable design process, and a built-in improvement loop — so every exercise you run makes your program measurably better than the last one did.
If you’ve ever sat through an exercise that felt like expensive theater — lots of activity, no learning, a report nobody read — HSEEP is the fix for that. It’s not glamorous. It’s a discipline. And it works.
On this page:
- What HSEEP Actually Is (and What It Isn’t)
- The 7 Types of HSEEP Exercises
- The HSEEP Exercise Cycle: Four Phases
- How Do You Write HSEEP Exercise Objectives?
- The Documents You’ll Actually Produce
- What Goes in an AAR/IP?
- Common HSEEP Mistakes (and How to Avoid Them)
- Frequently Asked Questions
What HSEEP Actually Is (and What It Isn’t)
HSEEP is a set of principles and a consistent process, not a script. It doesn’t tell you what scenario to run. It tells you how to build one that tests what you actually need to test, evaluates it honestly, and turns the findings into corrective actions that get tracked to completion.
Three things distinguish a HSEEP-compliant exercise from an ad-hoc one:
- Capability-based objectives. You’re not “practicing the plan.” You’re testing specific capabilities — say, emergency communications or operational coordination — against defined targets.
- A progressive structure. Exercises build on each other in complexity instead of jumping straight to the big one.
- A closed improvement loop. Every exercise produces an After-Action Report/Improvement Plan (AAR/IP), and every corrective action gets an owner and a deadline.
What HSEEP isn’t: a FEMA-only thing. State agencies, hospitals, universities, utilities, and private-sector continuity teams all use it. If your organization might ever exercise alongside government partners — or apply for preparedness grants — speaking HSEEP is close to mandatory.
The 7 Types of HSEEP Exercises
HSEEP divides exercises into two families: discussion-based (talk through it) and operations-based (do it). The seven types form a building-block progression — each one more complex, more resource-intensive, and more revealing than the last.
Discussion-based exercises
1. Seminar. A guided discussion to orient people to a plan, policy, or procedure. Low cost, low stress. Use it when: new plan, new leadership, new partners who need a common baseline. Output: shared understanding, not decisions.
2. Workshop. A working session to build something — a plan, a policy, a set of procedures. Where a seminar orients, a workshop produces. Use it when: you need a draft plan or need stakeholders to agree on one.
3. Tabletop exercise (TTX). A facilitated discussion around a scenario, usually with a senior decision-maker audience. No clocks running, no resources deployed — just people talking through “what would we do when…?” Use it when: you need to validate a plan’s logic or surface policy gaps before you spend money on operations-based work. This is the workhorse of the HSEEP world, and the one most continuity teams should run first.
4. Game. A competitive or structured simulation — often computer-supported — where teams make decisions against an adversary or a dynamic scenario. Use it when: you need to stress decision-making under uncertainty without deploying field resources.
Operations-based exercises
5. Drill. A single, specific operation or function, repeated until it’s right. Testing the notification cascade. Donning PPE. Setting up the EOC. Use it when: a discrete skill or procedure needs validation or practice. Drills are narrow on purpose.
6. Functional exercise (FE). Multiple functions tested in a simulated operational environment — the EOC is stood up, communications flow, decisions get made — but field units don’t deploy. Use it when: you need to test coordination and command without the cost of a full deployment.
7. Full-scale exercise (FSE). The real thing, minus real casualties. Field units deploy, the EOC activates, multiple agencies and jurisdictions play, often over multiple days. Use it when: only a full-scale test will validate what you need validated — and you’ve earned it by completing the building blocks beneath it.
The building-block approach in practice
The doctrine’s core insight: don’t run a full-scale exercise your organization isn’t ready for. Each block validates the foundation the next one stands on. Seminars build understanding, tabletops validate plans, drills sharpen skills, functional exercises test coordination — and only then does a full-scale exercise make sense.
Skipping blocks is the most common way exercises fail. A full-scale exercise run against an untested plan doesn’t validate anything; it just documents chaos at great expense.
The HSEEP Exercise Cycle: Four Phases
Every HSEEP exercise moves through the same four phases. Learn them once; they apply whether you’re running a two-hour tabletop or a three-day full-scale.
1. Design and Development
This is where exercises are won or lost, and it’s where most teams underinvest. Design and development includes:
- Defining scope — what’s in, what’s out, who’s playing, what geography and timeframe.
- Writing SMART objectives — the single most important design artifact (more below).
- Developing the scenario — a plausible, capability-testing narrative with a Master Scenario Events List (MSEL) that injects timed events to drive player action.
- Writing the documentation — the Situation Manual (SitMan) for discussion-based exercises, the Exercise Plan (ExPlan) for operations-based ones, plus controller/evaluator materials.
2. Conduct
Run the exercise. Controllers manage the scenario and injects; evaluators observe against the objectives; players play. The cardinal rule of conduct: controllers control the exercise, they don’t play it. If your controllers are making player decisions, your design was weak.
3. Evaluation
Evaluation is structured observation, not opinion. Evaluators use Exercise Evaluation Guides (EEGs) — standardized worksheets that map each objective to expected critical tasks and observation points. The output is data: what happened, measured against what was supposed to happen.
4. Improvement Planning
Findings become corrective actions in the After-Action Report/Improvement Plan (AAR/IP). Each corrective action gets an owner, a deadline, and a tracking mechanism. Then — and this is the part most programs skip — you actually track them to completion, and the next exercise validates that the fix worked.
That last sentence is the whole program. An exercise program that doesn’t close its improvement actions is just expensive theater with better paperwork.
How Do You Write HSEEP Exercise Objectives?
Objectives are the load-bearing wall of exercise design. Everything — scenario, injects, evaluation guides, the AAR — hangs off them. HSEEP requires SMART objectives:
- Specific — what capability, what function, what outcome.
- Measurable — observable, so an evaluator can say yes or no.
- Achievable — within the scope of this exercise and these players.
- Relevant — tied to a real capability gap, plan requirement, or prior corrective action.
- Time-bound — completable within the exercise.
Weak: “Test communications.” SMART: “Demonstrate the ability of the EOC communications unit to establish interoperable voice contact with all four county fire dispatch centers within 30 minutes of activation, per the Emergency Communications Plan.”
The practical test: hand your objective to someone who wasn’t in the design meetings. If they can’t tell you what “success” looks like, rewrite it.
How many objectives? Fewer than you think. A tabletop can handle three to five. A functional exercise, five to eight. Every objective you add multiplies your evaluation workload — each one needs EEG coverage, evaluator attention, and AAR analysis. Discipline here is what separates a focused exercise from a muddle.
The Documents You’ll Actually Produce
HSEEP has a reputation for paperwork, and it’s partly earned. But each document has a job. Here’s the minimum viable set:
| Document | Used for | What it does |
|---|---|---|
| Situation Manual (SitMan) | Discussion-based | Gives players the scenario background they’ll discuss |
| Exercise Plan (ExPlan) | Operations-based | The master document: scope, objectives, scenario, logistics, safety |
| Master Scenario Events List (MSEL) | Both | Timed injects that drive player action toward the objectives |
| Controller/Evaluator (C/E) Handbook | Both | Tells controllers what to inject when, and evaluators what to watch for |
| Exercise Evaluation Guides (EEGs) | Both | Structured observation worksheets per objective |
| After-Action Report / Improvement Plan (AAR/IP) | Both | Findings, analysis, and tracked corrective actions |
Start with the objectives, build the MSEL to serve them, and write everything else in service of those two. If a document doesn’t help a controller, an evaluator, or a player do their job, cut it.
What Goes in an AAR/IP?
The After-Action Report/Improvement Plan is where the exercise pays for itself — or doesn’t. A strong AAR/IP has four parts:
- Exercise overview — what was tested, who played, what the objectives were. One page.
- Analysis of capabilities — objective by objective, what was observed. Lead with strengths, then areas for improvement. Be specific: “the notification cascade reached 11 of 14 team members within the 30-minute target; three members’ contact data was outdated.”
- Corrective actions — each one tied to an observation, each with an owner and a deadline. Vague actions (“improve communications”) are where AARs go to die. Specific ones (“EOC manager updates the call-down roster and re-tests within 60 days”) get done.
- The improvement plan matrix — the tracking table: corrective action, responsible party, start date, due date, status. This is a living document, reviewed until every item closes.
Then schedule the follow-through. Put corrective-action reviews on a real calendar with real attendees. The exercise isn’t over when the AAR is published; it’s over when the last corrective action closes.
Common HSEEP Mistakes (and How to Avoid Them)
Designing the scenario before the objectives. The scenario is a tool for testing objectives, not the other way around. Write objectives first, always.
Too many objectives. See above. Every objective is an evaluation commitment. Three sharp objectives beat eight mushy ones.
Controllers who play. If controllers are solving the players’ problems, you’re not evaluating the players. Brief controllers hard on their lane.
Evaluating effort instead of capability. “Everyone worked really hard” is not a finding. Did the capability perform to the target? Yes or no, with evidence.
The AAR nobody tracks. Publishing the AAR/IP is the midpoint, not the finish. Assign owners, set dates, review monthly, and re-test the fix in the next exercise.
Skipping the building blocks. Running a full-scale exercise to “see where we stand” when you haven’t tabletop-tested the plan is how you spend six figures to learn what a $2,000 tabletop would have told you.
Frequently Asked Questions
Is HSEEP required, or just recommended? HSEEP itself is FEMA doctrine, not law. But many federal preparedness grants require HSEEP-consistent exercises, and most state and local emergency management agencies use it as their standard. If you ever exercise with government partners, expect HSEEP.
How long does it take to design an exercise? A tabletop: four to eight weeks of part-time design work for a first-timer, less with experience. A functional exercise: three to six months. A full-scale: six to twelve months, with a planning team. The design phase is always longer than people expect — budget for it.
Can a small organization use HSEEP, or is it only for big agencies? It’s built for everyone. A ten-person continuity team can run a HSEEP-consistent tabletop with a SitMan, three SMART objectives, and a short AAR/IP. Scale the documentation to the exercise, not the other way around.
What’s the difference between HSEEP and just “running a drill”? A drill tests one function. HSEEP is the program around it: objectives tied to capabilities, structured evaluation, and corrective actions tracked to closure. You can run a HSEEP drill — the methodology wraps around any exercise type.
Where do I find the official HSEEP doctrine? FEMA publishes the HSEEP doctrine and supporting templates (EEGs, AAR/IP formats) publicly. Start at fema.gov and search “HSEEP” — the doctrine document and the template library are the authoritative sources this guide is built on.