How to Run Your First Tabletop Exercise (In 90 Minutes)

The phrase “tabletop exercise” makes small business owners think of something expensive and theatrical, run by consultants, involving a war room. It is none of those things. A tabletop is a group of people sitting around a table talking through what they would do if something went badly wrong. Nothing gets unplugged. No systems are touched. Nobody is tested.

It is the cheapest security exercise available and, in my experience, the one that produces the most surprising findings — because the gaps it exposes are almost never technical. They are questions like who calls the insurance company, and where is the client contact list if email is down, and the long pause that follows.

You can run a good one in 90 minutes. Here is how.

Who Is in the Room

Six to ten people. Fewer and you miss perspectives; more and it becomes a presentation.

• The owner or an executive who can authorize spending and decide to close for a day. Without decision authority in the room, every hard question ends in “we’d have to ask.”
• Operations or the office manager — the person who knows how the work actually gets done, as opposed to how it is documented.
• Finance — whoever touches banking, payroll, and vendor payments.
• Whoever speaks to clients or patients. Someone will have to, and it should not be improvised.
• HR or the people lead, because “what do we tell 40 employees who cannot work today” is a real question.
• Your IT provider. They should be participants, not the ones running it, for reasons I will come back to.
• Optional and valuable: your attorney and your insurance broker. Many will attend for an hour. It is worth asking.

Two roles get assigned before you start. A facilitator, who presents the scenario and keeps the conversation moving without answering the questions. And a scribe, whose only job is to write down every moment the room cannot answer something. Do not combine these; the facilitator will miss half the findings.

The facilitator should ideally be someone with no stake in the answers looking good. If your IT provider facilitates, there is a quiet pressure not to surface the gaps that are theirs. Have them in the room as a participant and let an internal manager or a neutral third party run it.

Fifteen Minutes of Preparation

Book 90 minutes and put phones in a basket. Print the scenario and the injects — the facilitator keeps them, the room does not see them in advance. Bring a whiteboard or a large pad. Do not prepare slides; slides turn a discussion into a briefing.

Set the ground rules out loud in the first two minutes:

• Nobody is being evaluated. The purpose is to find gaps, and finding one is a success.
• “I don’t know” is the most valuable sentence available. It goes on the list immediately.
• No fixing during the exercise. If someone spots a problem, it gets written down and the discussion continues.
• Assume the systems in the scenario are genuinely unavailable. No rescuing yourself with “well, we’d just restore it.”

The Printable 90-Minute Agenda

1. 0:00 – 0:05 — Purpose and ground rules. Facilitator reads the four rules above.
2. 0:05 – 0:15 — The scenario. Read it aloud. First reaction round: each person says what they would personally do in the first 15 minutes.
3. 0:15 – 0:35 — Inject 1, the first hour. Containment, who is called, who decides to stop work.
4. 0:35 – 0:55 — Inject 2, day one. Insurance, legal, staff, and clients.
5. 0:55 – 1:10 — Inject 3, the pressure. The demand, the deadline, and the decision authority.
6. 1:10 – 1:20 — Recovery and the return to work. What comes back first, and how you know it is safe.
7. 1:20 – 1:30 — Findings round. Scribe reads the list back. Every item gets an owner and a date before anyone leaves the room.

That last ten minutes is the entire value of the exercise. Protect it. If the discussion is still lively at 1:20, stop it anyway.

A Ready-to-Use Ransomware Scenario

The scenario. It is 7:20 on a Tuesday morning. The first employee to arrive turns on her computer and finds a text file on the desktop saying the company’s files have been encrypted and to contact an address for instructions. She cannot open anything in the shared folder. She calls the office manager, who tries logging in from home and finds their Microsoft 365 password is rejected. Nobody has seen anything unusual in the past week.

Inject 1 — 8:15 a.m. Fourteen employees have now arrived. Two more people report the same message. Someone asks whether they should turn the computers off. Someone else has already started emailing clients from a personal Gmail account to warn them.

Inject 2 — 11:00 a.m. Your IT provider confirms the file server and the backup appliance in the same closet are both encrypted. Email is not accessible. A client calls the main line asking why an invoice they received this morning has different bank details on it than usual.

Inject 3 — 4:30 p.m. Someone finds an email on their phone from the attackers. They claim to have copied 60 gigabytes of files before encrypting anything, they name two of your largest clients, and they give you 72 hours before publishing. A local reporter has left a voicemail.

Recovery — day four. A clean environment is being rebuilt and one backup copy appears usable. You have to decide the order in which systems come back and how you will tell staff, and eventually clients, that things are safe again.

Three deliberate details in that scenario are the ones that draw blood: the backup sitting in the same closet as the server, the invoice with changed bank details (which means the compromise probably started in email weeks earlier), and the data theft that turns a technical problem into a notification and reputation problem. If your room glides past all three, add a fourth inject: the outage is now in its second week.

The Questions That Expose Gaps

The facilitator’s job is to keep asking the next uncomfortable question. These are the ones that reliably surface something:

• Who is in charge right now? Not who is responsible in general — who is running this, by name, and who runs it if that person is on a plane?
• Who calls the insurer, and what number? Most cyber policies require prompt notice and may require you to use their approved responders. Calling your own forensics firm first can create a coverage problem.
• Where is the contact list if email is down? Staff, clients, vendors, bank, payroll. If the answer is “in Outlook” or “on the server,” that is a finding.
• Who talks to clients, and what exactly do they say on day one? Someone will call. What comes out of the receptionist’s mouth is your public statement whether you planned it or not.
• Who can authorize a payment — of any kind — and up to what amount? Emergency responders, hardware, overtime, and the ransom question itself.
• How do we communicate internally if email and chat are down? Pick the fallback now: personal phones, a text group, a specific meeting time each morning.
• How do people get paid on Friday? Payroll is the deadline nobody thinks about until day three.
• Do we have a legal notification obligation, and what is the clock? If you handle protected health information, that clock is specific and it does not pause for the outage.
• How do we know when it is over? Who declares the incident closed, and on what evidence?

Two of those questions have known right answers that people usually get wrong. Do not power off the affected computers — disconnect them from the network instead, because powering down can destroy memory-resident evidence responders need. And do not use the compromised email system to coordinate the response, since attackers frequently still have access and are reading it. Our walkthrough of the first 72 hours after a breach covers the full sequence, and it is a reasonable thing to hand the room afterwards.

Capturing the Findings

The scribe writes three columns and nothing else: gap, owner, due date. Not a narrative, not minutes.

A gap is written as a specific missing thing, not a theme. “Communication needs improvement” is useless. “No printed client contact list exists outside email — Maria — November 15” is a task somebody can finish. Aim for eight to fifteen findings; a first tabletop that produces three either had the wrong people in the room or a facilitator who kept rescuing them.

Categorize them quickly at the end into three buckets: things you can fix this week and cost nothing (print the contact list, put the insurer’s number on a card), things that need a decision (who has authority, what the communication policy is), and things that need money or a project (the backup that sits in the same closet as the server). That last bucket usually overlaps with the items most disaster recovery plans are missing.

What Happens Afterwards Is the Whole Point

Within a week, the facilitator sends a one-page write-up: date, who attended, the scenario used, and the findings table with owners and dates. One page. Anything longer does not get read.

Then three things. Put the no-cost items on a 30-day clock and actually confirm they got done — a finding with no follow-up is worse than no exercise, because it manufactures the belief that you addressed something. Take the decisions to whoever needs to ratify them and write the answers into your plan document. And put the funded items into the budget conversation with the scenario attached, because “we need a better backup” loses to “in our October exercise we established that our backup sits in the same closet as the server.”

Keep the write-up. A file of dated exercise records is what auditors, insurers, and — in healthcare — regulators ask to see when they want evidence that your plan is real. It is also what makes next year’s exercise take half as long.

Run the next one in twelve months, or six if you are in healthcare or handle sensitive client data, and change the scenario: a vendor breach, a flood in the server room, or the sudden departure of the one person who knows how the billing system works. The scenario matters less than the habit.

Related Questions