How to Run a Ransomware Tabletop Exercise
A tabletop exercise lets a team rehearse decisions and discover missing contacts, permissions, backups, and communication plans before a crisis.
Who this guide is for
Small organizations preparing for a ransomware incident without disrupting real systems.
Practical checklist
- Choose a facilitator and a scenario involving inaccessible files, suspicious logins, and unavailable systems.
- Ask who can disconnect devices, contact providers, approve downtime, and communicate with customers.
- Walk through backup validation, legal or insurance contacts, evidence preservation, and recovery priorities.
- Capture assumptions that could not be verified during the discussion.
- Turn findings into tracked actions and repeat the exercise after major changes.
Common mistake to avoid
Treating the exercise as a technical quiz rather than a test of roles, decisions, and dependencies.
A safer way to proceed
Use a realistic scenario, record decisions and gaps, then assign owners and deadlines for improvements.
Product features, prices, eligibility, and policies can change. Confirm important details on the provider’s official website before purchasing, renewing, changing account settings, or acting on a security alert. If an incident may involve financial loss, sensitive personal data, or a business network, consider qualified professional help and the appropriate official reporting channel.