How to Run a Ransomware Tabletop Exercise for a Small Business
A ransomware tabletop exercise is a guided conversation about one bad morning: your files are encrypted, a ransom note is on the screen, and nobody has rehearsed what happens next. For a small business, it can be run in about 90 minutes around a conference table, with no technical tools and no outside vendor required.
The goal is not to test whether your antivirus works. It is to find out who makes which decisions, who you call, and what you would actually do for the next three days, while it is still a conversation and not a crisis.
What you need before you start
If you want background on tabletop exercises in general, start with what a tabletop exercise is and why small businesses run them. This guide focuses on running a ransomware scenario.
- A facilitator who is not the main decision-maker. The owner should be answering questions, not asking them.
- The right five to eight people: the owner or general manager, whoever manages IT (or your managed service provider contact), the person who handles payroll and banking, an operations or office lead, and someone who talks to customers every day.
- The documents you would reach for: your incident response plan if you have one, your cyber insurance policy and its claims or breach hotline number, your IT provider contract, and a current staff and vendor contact list.
- Ground rules: no blame, treat it as real, phones down, and “I don’t know” is a useful answer.
- A note-taker whose only job is to write down decisions, gaps and open questions.
A sample scenario: Monday, 7:45 a.m.
Adapt the details to your business. The example below assumes a 12-person service company with cloud email, a shared file server in the office, accounting software and an outside IT provider.
Inject 1: 7:45 a.m. Files won’t open
The office manager can’t open anything on the shared drive. File names have a strange new extension, and a text file named “README_RESTORE” is in every folder. Two laptops show the same thing.
Decision points: Who is in charge right now? Who calls the IT provider, and what number do they use? Does anyone disconnect machines from the network, and who decides that? What do you tell staff arriving at 8:00?
Inject 2: 9:30 a.m. The scope gets bigger
Your IT provider confirms ransomware on the file server and the two laptops. Nobody is sure when the last good backup ran, and synced cloud folders may contain encrypted copies.
Decision points: When do you call your cyber insurance carrier, and does the policy require you to use their approved responders? Can you operate today on paper or phones? Who confirms whether backups are clean before anything is restored?
Inject 3: 12:00 p.m. The demand
An email arrives claiming the attackers copied client files and will publish them unless you pay by Thursday.
Decision points: Who is allowed to make or recommend a payment decision, and who must be consulted first: insurer, legal counsel, ownership? Who reports the incident to law enforcement through the FBI’s IC3? Who determines whether customer or employee data was involved and what notification may be required?
Inject 4: Wednesday. Business pressure
Customers are calling about delays, payroll is due Friday, and a vendor asks whether your systems are safe to connect to.
Decision points: What do you tell customers, and who approves the message? How does payroll get processed? What gets restored first, and who decides that order?
What leadership should be able to answer afterward
- Who declares a cyber incident, and who leads the response if that person is unavailable
- Which outside numbers to call first, and where those numbers live if email and the file server are down
- What your insurance policy requires in the first hours
- Whether backups are tested, offline or separate from the systems they protect, and how long a restore really takes
- How a ransom decision would be made and documented, without making it on the spot
- Who speaks to customers, staff and vendors, and what they are allowed to say
What staff should take away
- Who to tell when something looks wrong, and how fast
- Not to keep working on, restart or “fix” an affected machine on their own
- Where the paper workarounds and contact lists are
- What to say, and not say, to customers who call
After the exercise: turn talk into a short fix list
Spend the last 15 minutes on a hot wash: what worked, what was unclear, what nobody knew. Then pick the five most important gaps, give each one an owner and a date, and schedule a follow-up check. Typical fixes are small: a printed contact sheet, a confirmed insurance hotline, a backup restore test, a named backup decision-maker. Run the exercise again after the fixes are in place, or at least once a year.
Self-run, ready-made package or facilitated?
| Option | What you get | Best for |
|---|---|---|
| Self-run with this outline | The four injects above and your own notes | A first conversation with a small team |
| Ransomware Tabletop Exercise Package ($499) | A scenario with 11 injects across three phases, facilitator guide, participant workbook, and after-action, improvement plan and executive summary templates. Designed for a 2 to 4 hour discussion. | Teams that want a structured exercise and documentation without hiring a facilitator |
| Facilitated tabletop exercise | FSL designs the scenario around your environment, runs the session and writes up the findings. Scope and price are agreed before work begins. | Organizations that want an outside facilitator or need exercise evidence for customers, insurers or leadership |
The U.S. Cybersecurity and Infrastructure Security Agency also publishes free tabletop exercise packages, including ransomware scenarios, that organizations can adapt.
If your team will run exercises regularly, FSL’s tabletop exercise facilitator training teaches your staff to design and run them in-house.
A free place to start
If you are not sure where your biggest gaps are, the free Cyber Preparedness Checklist is a quick way to see what to bring to the table before you run the exercise.
Want the full exercise without building it from scratch?
Get the ready-to-run ransomware package, or talk with FSL about facilitating it for your team.
See the $499 Ransomware Package Ask About Facilitation
