How to Run Your First Cyber Incident Tabletop Exercise in 45 Minutes, Without a Consultant

It's 9:40 on a Tuesday morning. Your controller calls. QuickBooks won't open, and there's a text file on the desktop saying your files are encrypted. Two other people have the same screen. You call your IT provider and it goes to voicemail.

What do you do next?

Not in theory. Right now, with your actual team. Who makes the call to shut things down? Who calls the insurance company, and where's the policy number? Does anyone tell clients, and who decides what to say? Can payroll still go out on Friday?

Most leadership teams have never talked that through. A tabletop exercise is just that conversation, before you need it.

What a tabletop actually is

The name makes it sound bigger than it is. A tabletop exercise is a meeting. You get the people who would make decisions in an incident around a table, someone reads out a realistic scenario, and you talk through what you'd do, step by step. Every ten minutes or so, the facilitator adds a complication. The backup turns out to be encrypted too. A reporter calls. The attacker emails asking for payment.

Nobody touches a computer. Nobody gets graded. The point is to find the gaps in a conference room instead of during a real incident.

CISA publishes free tabletop exercise packages for exactly this reason. The large ones are built for organizations with a security team. Most small businesses need something shorter and more practical.

Why insurers and auditors ask for it

More cyber insurance applications now ask whether leadership has walked through an incident together in the last year. SOC 2 and HIPAA reviews ask the same thing in different words.

They ask because it's one of the best predictors of how an incident goes. Companies that have practised call the right people in the right order. Companies that haven't spend the first two hours working out who's in charge, and those are expensive hours.

It's also one of the easiest yeses on the form to earn. 45 minutes, once a year, and you have a dated report to show for it.

Who should be in the room

Keep it small. Three to eight people.

The owner or CEO. The person who makes the final calls.

Whoever runs operations. They know what stops when systems are down.

Whoever handles money. Payments, payroll, and the bank are where attackers aim.

Whoever staff call first when something breaks. Often the office manager.

Your IT provider, if you have one. Invite them. Their answers to "how fast can you get here" are part of what you're testing.

How a session runs

1. Pick the scenario. Start with something that's actually likely. Ransomware is the classic. An admin account takeover, or a voice-clone call asking for an urgent wire, are both good second sessions.

2. Read the opening situation and ask the first question. "It's 9:40, this is on the screen. What happens next?" Let people talk. Write down what they say, especially "I think" and "I'm not sure."

3. Add the complications. Every eight to ten minutes, a new development. Each one tests a specific thing: whether the backup is separate, whether anyone knows the insurer's breach hotline, whether there's a way to verify a payment request.

4. Stop at 40 minutes and list the gaps. Every "I don't know" becomes a line item with an owner and a date.

5. Write it up the same day. A one-page after-action report: date, who was there, the scenario, the gaps, the owners. That's the document your insurer wants.

What it usually finds

The same handful of gaps come up in almost every first session. Nobody knows where the cyber insurance policy is or what the breach hotline number is. The IT provider's after-hours process is a voicemail. There's no agreed way to verify a payment request by phone. Nobody's sure whether the backup could be reached by the attacker. There's no list of who to tell, clients, staff or regulators, and in what order.

None of those are expensive to fix. You just have to find them first.

What to do with the gaps

The after-action report is only useful if the gaps get closed. Here's how we handle them with clients.

Sort the list into two piles. The first pile is things you can fix with a phone call or a document: put the insurer's breach hotline in the incident plan, agree a callback rule for payment changes, write down who tells clients and who tells staff. Most of these take a day. Do them that week, while everyone still remembers why they matter.

The second pile is technical: the backup that might be reachable, the admin accounts without MFA, the IT provider's after-hours response. Those go to whoever owns your IT, with a date next to each one.

Then put the next session on the calendar. Six months is a good gap for the first year. Use a different scenario so you're testing different muscles. The second session is always shorter and calmer than the first, and that's the measure that it worked.

Keep every report in the same folder as your insurance documents. When the renewal asks for the date of your last exercise, you'll have it, along with proof that you fixed what it found.

A kit that lets Claude run it

We built Tabletop in a Box, a free kit at skills.methodologyit.tech/tabletop. It's a skill file for Claude, with instructions for ChatGPT and Gemini. Claude plays the facilitator: it reads the scenario, adds the complications on schedule, asks who does what, keeps notes, and writes the after-action report at the end.

Three scenarios come in the box: ransomware, an admin account takeover, and a voice-clone wire request. One person drives the keyboard; everyone else talks.

Where to start

1. Book 50 minutes with the people above, in the next two weeks.
2. Download the kit and pick the ransomware scenario for the first session.
3. File the after-action report with your insurance documents.

---

One question to answer this week: if ransomware hit at 9:40 tomorrow morning, who in your company would make the first call, and to whom? Get Tabletop in a Box free, or book 15 minutes if you'd like us in the room for the first one.

Keith Parker is the CEO of Methodology IT, a managed IT services provider in Los Angeles that has supported healthcare practices, nonprofits, and growing businesses across Southern California since 1997.

Sources: CISA Tabletop Exercise Packages