A ransomware tabletop exercise lets a small team practice its worst Monday without breaking a single computer. Imagine the finance laptop displays a ransom note just as a customer asks for an invoice. Who takes charge? Who calls your IT provider? And where is the contact list if email stops working?
This 30-minute, five-round game gives founders, office managers, and IT staff a practical way to find those gaps. You need a timer, a shared worksheet, and a willingness to say “we do not know yet.” The fun comes from solving the puzzle together; the useful result is three improvements with names and deadlines.
Quick start: Spend 5 minutes assigning roles, 20 minutes on the five cards below, and 5 minutes choosing actions. Discuss decisions only. Do not deploy malware, disconnect production systems, contact real customers, or make actual incident reports during the game.
Table of Contents
Set up your ransomware tabletop exercise
A tabletop is a discussion of a fictional incident. It explores decisions and dependencies; it cannot prove that a backup restores or that a security tool blocks an attack. Those need separately planned technical tests. NIST recommends exercising recovery plans, testing restoration, and maintaining response contacts in its ransomware preparation guidance.
Pick one business service to protect: issuing invoices, fulfilling orders, or supporting customers. Keep the scenario narrow enough for everyone to understand. A five-person design studio might choose its project folder and invoicing system. A retailer might choose order fulfillment. The starting question is what would stop work today.
Give everyone a job
Facilitator: reads the cards, controls time, and labels all material “EXERCISE.” Incident lead: makes business decisions and records approval limits. Technical lead: explains what IT or the managed service provider would investigate. Communications lead: drafts internal and customer updates. Scribe: records decisions, unknowns, and owners. In a tiny team, combine roles but keep a separate facilitator if possible.
Bring your existing incident plan, response contacts, backup summary, and a blank decision log. Use fictional customer details. Do not copy passwords, sensitive client files, or real ransom messages into the worksheet. If a fact is missing, write “unknown” instead of giving yourselves credit for an imagined capability.
Agree on two rules: no blame and no magical shortcuts. “We would call IT” needs a named contact and a reachable channel. “We would restore everything” needs an identified backup and a realistic check of what has actually been tested.
Play these 5 ransomware tabletop exercise rounds
Read one card at a time. Allow roughly one minute to read, two minutes to discuss, and one minute to log a decision. The facilitator can say “pause the clock” when a question needs a later technical or legal answer. That keeps the session friendly while making uncertainty visible.
Round 1: The laptop has a ransom note
Read aloud: “It is 9:05 a.m. Finance cannot open several files. A message demands payment. Another employee says a shared folder looks unusual. We do not yet know which systems are affected.”
Choose: Who declares an incident, who contacts the responder, and who can approve containment that interrupts work? Ask the technical lead to describe how a suspected device would be isolated under your approved procedure and how relevant evidence would be preserved. Keep all actions hypothetical.
Facilitator prompt: “What do we know, what are we assuming, and what would change our decision?” Record the first observed symptom and time. Do not assume every unavailable service is infected. A useful answer identifies the decision maker and the information needed next.
Round 2: Your usual contact is unavailable
Read aloud: “The IT contact does not answer. The incident lead is traveling. Company email might be unsafe to use. The contact list is stored in the shared folder that nobody can open.”
Choose: Name the backup decision maker and an alternative communication channel that can be reached without the affected account. Explain how participants would verify the identity of someone giving instructions. A familiar display name alone is a weak basis for an urgent request.
Facilitator prompt: “If the contact list disappeared right now, could a colleague reach the right person?” Write down the missing dependency. If the exercise reveals that specialist help is unavailable, use our incident response retainer guide to frame a later provider discussion around actual gaps.
Round 3: The backup is green, but restoration is unknown
Read aloud: “The backup dashboard says the last job succeeded. Nobody can recall a recent restore test. The latest copy may include files changed after the first suspicious activity.”
Choose: What evidence would make a backup trustworthy enough to use? Which service returns first, who authorizes recovery, and what dependencies must be ready? Discuss a clean recovery environment, the age of the chosen copy, access requirements, and validation before reconnecting recovered systems.
Facilitator prompt: “Does a successful backup job tell us how long the business will be offline?” Distinguish acceptable data loss from acceptable downtime. For this game, choose hypothetical targets such as losing no more than one day of invoicing data and resuming invoicing within one working day. These are discussion targets, not measured recovery promises.
Round 4: A customer wants an answer
Read aloud: “A customer asks whether their project files were stolen. Support wants to say everything is safe. The technical lead has not established whether data left the business.”
Choose: Who approves external statements, what facts can be shared, and when will the next update happen? Identify who checks contracts, applicable reporting duties, and insurance contact requirements. The drill does not decide universal notification deadlines; those depend on your situation.
Practice statement, for the exercise only: “We are investigating an incident affecting access to some systems. We have not yet determined whether customer data was accessed. Our next update will be provided at [time] through [channel].” Have the communications lead adapt this to the fictional facts, then mark it as an unsent draft.
Round 5: The attacker claims to have copied data
Read aloud: “An attacker claims to possess customer documents. A manager suggests paying immediately so everyone can get back to work. The claim has not been verified, and restoring files would not tell us whether information was copied.”
Choose: Who coordinates specialist investigation, leadership, counsel, insurance, and appropriate reporting? What evidence is needed to assess the claim? Who has authority for consequential financial decisions? Do not negotiate with anyone or simulate a payment outside the discussion.
NIST notes that payment does not guarantee recovery and that stolen customer data can raise notification issues in its small-business ransomware resource. The useful exercise outcome is a clear escalation path for uncertainty, rather than a rushed promise that one decision will make every problem disappear.
Score clarity, then choose your next 3 fixes
Use a cooperative score, not a leaderboard. After each round, award one point for a named decision owner, one for a concrete next step, and one for either supporting evidence or an honest unknown with a follow-up owner. Each round has a maximum of 3 points; five rounds total 15. This is our discussion rubric, not a certification or a validated measure of ransomware resistance.
A lower score is useful if it exposes a missing phone number or untested assumption. A high score still cannot demonstrate technical recovery. Compare your next exercise with this one to see whether decisions became clearer and whether previously assigned actions were completed.
Copy this compact worksheet into your meeting notes. Add one row per round, then select the three fixes that would remove the most consequential uncertainty.
| Decision log field | What to record |
|---|---|
| Known facts | Observed symptom and exercise time |
| Decision and owner | Chosen action and person with authority |
| Evidence or unknown | Existing proof, or the gap to investigate |
| Follow-up | One deliverable, one owner, one due date |
Example action: “Office manager will create a protected, reachable response contact sheet with primary and backup contacts by Friday. Completion means a colleague can locate it and verify the listed contact routes.” Choose a second action for a safely planned restore test and a third for approval limits or a communication template, if those were your largest gaps.
Keep the next exercise fresh
At your next session, keep the same core service but change one constraint: the owner is away, the outage occurs before payroll, or a supplier is unavailable. Let quieter colleagues answer first and rotate the incident lead. Give the team a playful “best question” award for catching an unsupported assumption. Avoid rewarding speed at the expense of thoughtful decisions.
Invite your IT provider to review technical unknowns after the meeting. Separate discussion follow-ups from production changes and arrange technical tests through normal approvals. Repeat after important staffing, supplier, or system changes; pick an ongoing cadence that matches your business rather than treating this article as a compliance schedule.
Ransomware tabletop exercise FAQ
Can a three-person business run this?
Yes. One person facilitates and keeps notes, one represents business decisions and communications, and one represents technical coordination. If you outsource IT, record questions for that provider instead of guessing what they can do. Even a solo founder can walk through the cards with a trusted adviser.
Is 30 minutes enough?
It is enough for a focused first discussion, not a complete incident program. If a card reveals a difficult dependency, log it and schedule a deeper session. Expand the scope only after the team can explain the first service, its owners, and its recovery assumptions.
Do we need paid tabletop software?
No. Printed cards, a timer, and a simple document work for this exercise. Software may help organize a larger program, but it cannot supply missing authority or proof of restoration. Start with the people and decisions you need to understand.
Where can we find official exercise material?
CISA publishes cybersecurity scenarios, including tabletop topics such as ransomware, phishing, and insider threats. Use those resources when you want a broader facilitated exercise. The five cards and scoring rubric in this article are an original simplified activity, not an official CISA exercise package.
Your next step: Put the five cards on the table, choose one service, and start the timer. A useful ransomware tabletop exercise ends with a clearer answer to “who decides next?” and three fixes your team can actually complete.
Sources checked October 12, 2026. This guide is based on document research; the fictional scenario has not been field-tested by Kioptrix Labs. Illustrations were generated with AI.