How to run a ransomware tabletop exercise
A one-hour walkthrough that tests the decisions, not the technology: who is in charge, who calls whom, and how the business keeps working during an attack.
Most small businesses that think about ransomware think about backups, and rightly so. But when an attack happens, the first hours are taken up by decisions, not technology: who is in charge, who calls whom, whether to shut everything down, what to tell staff and customers, and how to keep working. A tabletop exercise is a way to make those decisions once, calmly, around a table, instead of for the first time in the middle of a crisis.
It needs no special software and no IT expertise in the room. One hour, four to six people and a written scenario are enough. This guide walks through how to run one for a small office.
What a tabletop exercise is, and isn't
A tabletop exercise is a discussion. Someone reads out a scenario in stages, and the group talks through what they would do at each stage. Nothing is switched off and no systems are touched. It is different from a test restore drill, which proves your backups technically work. The tabletop tests the people and the plan around them. You need both.
Who should be in the room
- The owner or whoever can make spending and business decisions.
- The office manager, or whoever knows how the day-to-day runs.
- Whoever looks after your IT, in house or from an outside provider.
- Someone from finance or bookkeeping, because payments and payroll are often the first worry.
- Optionally, someone who deals with customers, to think about what they will be told.
Pick one person to run the session and one to take notes. The facilitator's job is to keep the discussion moving and ask awkward questions, not to supply the answers.
A scenario you can use
Read each stage aloud, then give the group five to ten minutes on the questions before moving on.
Stage 1: Monday, 8:15 a.m.
The first person in finds that files on the shared drive have odd extensions and won't open. A text file in each folder says the data has been encrypted and stolen, and gives a contact address.
- Who is the first call, and do they have that person's mobile number written down somewhere that doesn't depend on the office network?
- Who has the authority to say "disconnect everything"? Does anyone know how?
- What do the people arriving at 8:30 do?
Stage 2: 10:00 a.m.
Your IT support confirms several computers and the file server are affected. Email in Microsoft 365 seems to be working. A customer calls asking why an invoice link doesn't work.
- Do you have cyber insurance? Who has the policy number and the insurer's incident hotline? Many policies expect you to call them before bringing in your own outside help.
- Who talks to customers, and what are they allowed to say?
- Can staff use email and phones safely, or should you assume accounts are compromised too?
Stage 3: 2:00 p.m.
The backups exist, but the most recent clean copy is from Friday night, and restoring everything will take at least two days.
- What has to come back first: accounts, scheduling, a particular client project?
- How do you run the business on paper or from phones until then?
- Has anyone reported the attack? The FBI asks victims to report ransomware to its Internet Crime Complaint Center (IC3) at ic3.gov, whether or not a ransom is paid.
Stage 4: Wednesday
The attackers email, threatening to publish customer data unless they are paid.
- Who decides how to respond, and who advises them: the insurer, a lawyer, law enforcement?
- Do you hold personal data that might need notifying under state law? Who would find out?
What usually comes out of it
Expect the exercise to surface gaps rather than answers. Typical findings are things like these: the only copy of the IT provider's emergency number is in an email nobody can open; nobody is sure where the insurance policy is; the person who knows the backup system is on vacation that week; there is no agreed way to reach all staff if email is down. Each gap is cheap to fix once it is written down.
After the session
- Turn the notes into a one-page list of actions, each with a name and a date.
- Write a short contact sheet: IT support, insurer hotline and policy number, bank, key suppliers, a lawyer, and IC3. Keep printed copies off the network, at the office and at home.
- Agree who is in charge during an incident, and who stands in when that person is away.
- Fix the technical gaps the discussion exposed, such as backups that are not separated from the network or accounts without multi-factor authentication.
- Repeat it once a year, or after a big change such as a new IT provider or new office, with a different scenario.
If you want ready-made material, CISA publishes free Tabletop Exercise Packages, including ransomware scenarios, with facilitator guides that a small business can adapt.
How we can help
The exercise is only worth running if the gaps it finds get fixed. Our ransomware protection service covers backups, account security and monitoring, and our guide on how to recover from ransomware explains what happens after an attack. To talk through what your exercise turned up, call (213) 986-4855.