A ransomware incident can force a business to make difficult decisions quickly: Which systems should be isolated? Who contacts customers? Can backups be restored safely? A tabletop exercise lets your team practice those choices without disrupting real operations. Participants talk through a realistic scenario, explain what they would do, and uncover gaps in plans or communication. The goal is not to catch people out. It is to leave with clear, assigned actions that make your response stronger.
Set a practical objective
Choose one exercise objective before writing the scenario. You might test how staff report a suspicious message, how leaders decide whether to shut down a system, or how the team verifies that backups are usable. A focused objective keeps discussion useful and helps you judge whether the exercise met its purpose. Avoid trying to test every part of your response plan in one session.
Invite people who would make or support decisions during an incident. This often includes IT, security, business operations, communications, leadership, and whoever manages legal or customer obligations. Include a facilitator to guide the conversation and a note-taker to capture decisions, questions, and missing information. Tell participants the exercise is for learning, not performance reviews.
Build a believable scenario
Base the scenario on your organization’s systems, workflows, and likely points of disruption. For example, staff may find that shared files have been renamed and a ransom note appears on a workstation. Add details gradually: a critical application becomes unavailable, a supplier reports a similar problem, or employees receive questions from customers. Each new detail should prompt a decision, not merely add drama.
Keep the scenario plausible and avoid giving participants facts they would not have during a real incident. Prepare short updates, known as injects, that the facilitator can introduce as the discussion unfolds. Do not assume the cause, scope, or recovery timeline is immediately clear. That uncertainty is part of the exercise: ask how the team would verify information and communicate what is known without overstating it.
Guide decisions, not speeches
Open by explaining the rules: participants should answer from their real roles, use the plans and tools they would normally have, and say when they do not know something. Then present the opening situation and ask practical questions. Who receives the first report? What evidence needs preserving? Who can authorize isolating a device or system? Where will the team coordinate if email is unavailable?
As the scenario develops, test assumptions with follow-up questions. If someone says the team will restore from backup, ask who confirms the backup is clean, how restoration is prioritized, and who approves the system returning to use. If a plan depends on a contact list, ask where it is stored and whether it works outside the company network. Record the answers without turning the session into a debate over blame.
Turn findings into action
After the discussion, sort observations into strengths, gaps, and decisions that need verification. Look for unclear ownership, missing contact details, untested recovery steps, and communications that rely on unavailable systems. Separate confirmed problems from questions that need follow-up. This makes the review specific and prevents a long list of impressions from becoming difficult to act on.
Give every follow-up item an owner, a due date, and a concrete result. Replace “improve backups” with an action such as documenting who tests a restore and where the results are recorded. Prioritize tasks that affect safety, business continuity, or the ability to make informed decisions during an incident. Share the action list with participants, check progress at regular intervals, and use a future exercise to test whether the changes work.
A useful ransomware tabletop exercise feels realistic, gives people room to explain their decisions, and ends with accountable next steps. Start with one objective, keep the scenario relevant to your business, and treat unanswered questions as valuable findings. If you want support designing or facilitating an exercise, Beacon Backup can help your team plan a practical session.