Running a 60-Minute Ransomware Tabletop for a Small IT Team

A 60-minute ransomware tabletop is a discussion exercise in which a facilitator walks two to six IT staff through a realistic ransomware scenario, one inject at a time, and records the decisions they make. Nothing touches production. The goal for a small IT team is to find gaps in the plan, contacts, backups and authority before a real incident does, then leave with a short list of fixes, each with an owner and a date. It takes about an hour to prepare and an hour to run.

What is a ransomware tabletop exercise?

It is a talk-through, not a test of systems. NIST defines a tabletop as a discussion-based exercise in which a facilitator presents a scenario and asks questions so participants can validate a plan by discussing their roles and responses.

CISA publishes free Tabletop Exercise Packages, including a Ransomware situation manual (September 2023), with template objectives, scenarios, discussion questions and an after-action report. This guide applies the same idea in one hour for a team that runs its own servers, endpoints and backups.

Who should be in the room?

Keep it small: a facilitator, two to six participants, and someone to take notes. Small enough that everyone speaks, large enough to cover the systems involved.

• Facilitator: runs the clock, reads injects and asks questions. Ideally not the person who owns the systems, so they can push back.
• Participants: whoever would actually respond: IT lead, systems or network admin, the person who runs backups, and the help desk lead. Add your MSP contact if they handle alerts.
• Note-taker: records decisions, open questions and gaps as they happen. The facilitator can do this for a team of two, but it is harder.

This format is for the technical team. Leadership, legal and communications decisions appear as escalation points in the scenario, not as roles in the room.

Preparation checklist

Spend under an hour on preparation:

• Book 60 minutes in a room or a call with cameras on. Ask people to silence other work.
• Print or share the current incident response plan, the escalation contact list, the backup schedule and the network diagram if one exists.
• Choose one scenario target that matches your environment: a file server, a hypervisor host or a line-of-business application server.
• Prepare the five injects below on separate cards or slides, adjusted to your systems.
• Bring a blank decision record and after-action template (at the end of this page).
• Tell participants it is a no-blame exercise and that "I don't know" is a useful answer.

Safety boundaries

A tabletop is safe because it stays on paper. Hold these rules:

• No live malware, no test ransomware samples and no attack tools.
• No changes to production: do not disconnect, restore or reconfigure anything during the session. Discuss what you would do.
• No offensive steps or exploitation detail. The scenario describes what defenders see, not how the attacker got in.
• No claim that completing the exercise proves readiness. It shows where the plan is untested or missing.

If someone wants to verify a fact during the session, such as whether a backup job ran last night, record it as an action item for afterwards.

The 60-minute agenda

Run to the clock. If a discussion runs long, park it on the action list and move on.

• 00:00 to 05:00, introduction. Facilitator states the objective (test detection, containment, backup and escalation decisions), the safety rules, and that notes are no-blame.
• 05:00 to 15:00, inject 1: the initial alert. Discuss triage.
• 15:00 to 25:00, inject 2: spread and containment. Discuss containment choices and their cost.
• 25:00 to 35:00, inject 3: backup uncertainty. Discuss what is known about recovery.
• 35:00 to 45:00, inject 4: communications and escalation. Discuss who must be told and who decides.
• 45:00 to 52:00, inject 5: the recovery decision. Discuss order of restoration and criteria.
• 52:00 to 60:00, debrief. What worked, what was missing, and assigned actions.

Scenario and injects

Adapt names and systems to your environment. Read one inject at a time and do not reveal the next until the discussion ends.

Inject 1, 08:10 Monday. The help desk has three calls: users cannot open files on the shared drive, and file names now end in an unfamiliar extension. The EDR console shows a high-severity alert on the file server from 03:40.

• Who is notified first, and how? Who is on call before 08:00?
• What do you check first, and where does that information live?
• Who has authority to declare an incident?

Inject 2, 08:35. A second server and two workstations show the same file changes. A ransom note text file is in several folders.

• Do you isolate individual systems, segments or the whole network? Who decides, and what does each choice take down?
• CISA's ransomware checklist says to determine which systems were impacted and immediately isolate them. Can you do that from the EDR console, a switch, or only by pulling cables?
• What evidence do you preserve before anything is wiped or rebuilt?

Inject 3, 09:15. The backup admin reports that last night's job finished with warnings, and the backup console login page is behaving oddly.

• When was the last successful backup of the affected servers, and how do you know?
• Is there a copy that is offline or immutable? When was a restore last tested?
• Could the backup system itself be affected, and who checks?

Inject 4, 09:45. The operations manager asks when the shared drive will be back. A user forwards an email from an unknown sender claiming to have copied company data.

• Who informs leadership, and what do you tell them now, knowing little?
• Who contacts the cyber insurer or broker, outside counsel and any MSP? Are those numbers in the printed plan?
• Who decides on reporting to law enforcement? CISA recommends reporting ransomware to CISA, the FBI or the Secret Service.

Inject 5, 11:30. Containment is holding. Leadership asks for a recovery plan.

• Which systems come back first, and why?
• What must be true before a restored system is reconnected?
• Who declares the incident over, and against what criteria?

Decision record

During each inject, the note-taker writes one line per decision: time in the scenario, the decision, who made it, what information was missing, and any assumption the team relied on. Assumptions are where the action items come from.

After-action list and template

Spend the last eight minutes turning gaps into tasks. Each item gets one owner and a date. CISA's ransomware guidance calls for documenting lessons learned to update plans and guide future exercises.

Compact after-action template:

1. Exercise date, facilitator, participants
2. Scenario summary: one sentence.
3. What worked: two or three points.
4. Gaps found: for example, no after-hours EDR alert routing; last restore test date unknown; insurer contact not in the printed plan.
5. Actions: item, owner, due date. Example: "Test restore of the file server from offline copy; backup admin; 2026-12-05."
6. Plan updates needed: which sections of the incident response plan change.
7. Next exercise date.

Two gaps often found in small teams lead naturally to other work. If no one knew who watches EDR alerts overnight, see how to answer the EDR question on a cyber insurance application, which walks through documenting that arrangement. If the team was unsure what to capture before rebuilding, see how to preserve evidence before patching a server.

Printable facilitator checklist

• Objective, rules and no-blame statement read aloud.
• Plan, contact list and backup schedule on the table.
• Five injects ready, revealed one at a time.
• Timer visible; parked items written down.
• Every decision recorded with its missing information.
• Every gap turned into an action with an owner and date.
• After-action note sent within two working days.
• Next exercise booked.

How this differs from a public-sector tabletop

Larger exercises cover more ground. In Missouri, for example, the Department of Public Safety's Office of Homeland Security has advertised a ransomware tabletop in Jefferson County with state, federal and CISA partners, scheduled for four hours and aimed at county and municipal officials, schools, emergency services and other public-sector organizations. That format tests leadership decisions across many organizations. The 60-minute version here is narrower: one IT team, one scenario, and practical fixes by next month. Running it does not certify readiness or satisfy any insurance or regulatory requirement.

Sources

• CISA Tabletop Exercise Packages
• CISA cybersecurity scenarios, including the Ransomware CTEP situation manual
• CISA #StopRansomware: I've been hit by ransomware
• CISA #StopRansomware Guide
• NIST glossary: tabletop exercise (from SP 800-84)
• Ransomware Tabletop, Jefferson County, Missouri (event page)