A tabletop exercise walks your team through a realistic ransomware scenario without touching production. It is one of the cheapest, fastest ways to find gaps in your recovery plan.
Who should be in the room
- IT operations and backup administrators
- Security / incident response
- Application owners for critical services
- Legal, communications and an executive decision-maker
A simple structure
- Set the scene: an alert that backups are being deleted at 2 a.m.
- Inject updates every 10–15 minutes: production encrypted, attacker demands, regulator questions.
- At each stage ask: who decides, what do we do, where is the evidence?
- Close with a debrief and an owner for every gap.
What good looks like
Teams know where the last clean copy is, who can authorize recovery, how long recovery will take and how to communicate with customers and regulators.
Sample injects to use
- “Backup jobs have failed across all sites for the last three nights.”
- “The attacker has posted a sample of your customer data online.”
- “Your cyber-insurer asks for evidence of when backups were last tested.”
- “A regulator calls asking whether personal data was exposed.”
- “The CEO wants to know when the website and ordering system will be back.”
Each inject should force a decision and reveal whether the information needed to make it is available. Record every “we don’t know” — those are your highest-priority actions.
Key takeaways
- Tabletops are low-cost and high-value.
- Include business and legal, not just IT.
- Every finding needs an owner and a date.
Want a facilitated tabletop?
We run independent recovery exercises and turn the findings into a practical roadmap.
