Two Things Every Business Should Do Before the End of the Year: Run a Tabletop Exercise and Test-Restore Your Backup

Do these two things for the end of the year at your company.

Picture this. Leadership at your company sits down around a table, and somebody says: today all of our data was compromised. We don't have access to it, and our clients are all being emailed from our accounts. Then everyone has to work out what happens next.

That conversation is the first thing. The second is simpler. Take whatever you're backing up, restore it, and open it.

Neither one costs much. Neither one takes long. And when something bad does happen, the companies that did both are the ones that have a clue what to do.

What a tabletop exercise actually is

A tabletop exercise is you practicing your incident response plan. Essentially, you're simulating some disaster that happens to your company, and you're working through how you get out of it, how you work your way out of it.

Nobody touches a keyboard. Nobody unplugs a server. It's a meeting. Someone describes the scenario, a little at a time, and the people who'd be making decisions on that day talk through what they'd actually do. Who gets called first. Who talks to clients. Who decides whether to shut systems down. Where the phone list is when email is down.

It's important that you have a plan, because something will happen. Eventually something's going to happen. So it's important that you have a plan and that you spend time actually going through it, so that when something bad does happen, you have a clue what to do.

Most companies that have an incident response plan wrote it once, filed it, and never opened it again. The first time anyone reads it under pressure is the worst possible time to find out it's missing a phone number, or that the person it names left two years ago.

The scenarios worth running

Start with the ones that would stop your business cold. Here are a few we run with our own clients.

You lose access to all of your contact information. Work out where that data lives if Outlook is gone, and how you'd reach your employees and your customers without it. You should have it stored somewhere outside of Outlook, or wherever you normally keep your contacts, even if that's a printed list in a drawer.

Your billing system goes down for a sustained amount of time. If you send invoices every month, you need to know who you normally bill and roughly how much, and whether you could reproduce the invoices without the system. One of the things that comes out of a tabletop like this is, hey, maybe we should keep a month of invoices printed somewhere, so that if we ever had to recreate them, we'd at least have a starting point.

All of your data is encrypted by ransomware on a Monday morning. Your systems are down, your clients are getting emails that look like they came from you, and somebody needs to decide in the next hour what gets said and to whom.

What comes out of these is conversations along the lines of, I never thought about that. That's the whole point. Maybe it means your office goes to paper for a day. Maybe it means you find out nobody knows the login to your insurance carrier's portal. Whatever it is, you'd rather find it in a conference room than in the middle of an incident.

You don't have to write the scenarios from scratch. CISA, the federal cybersecurity agency, publishes free tabletop exercise packages with ready-made scenarios, ransomware and phishing among them, along with discussion questions you can run with your own team. NIST's guide to test, training and exercise programs describes the same approach in more detail if you want the formal version.

Test-restore your backup

The other thing is restore your backup. Do a test restore.

Whatever data you have that you're backing up, and hopefully you're backing up all of it, restore it. Make sure you're able to restore it, take a look at it, and make sure the whole thing happens from start to finish.

I can't tell you the number of times people have come to me thinking they had a backup. They never tested it, and when they needed it, it didn't work. Sometimes the backup job had been failing quietly for months. Sometimes something was added somewhere down the line, a new server or a new shared folder, and it was just never included in what was being backed up. You have years of client data, you have a backup, or so you believe, and nobody has ever actually brought anything back from it.

A backup job that reports success every night only tells you a copy ran. Whether you can get your business back from that copy is a separate question, and the only way to answer it is to restore something and open it.

CISA's ransomware guidance says the same thing in plainer government language: keep offline, encrypted backups of your critical data, and test them regularly. The testing part is what gets skipped.

How to do both before December 31

Neither of these is a big project. Here's how we'd run them.

1. Put both on the calendar now. Pick a date in November or early December, before the holidays eat the schedule. Ninety minutes for the tabletop, an afternoon for the restore test. If it isn't on the calendar, it won't happen this year.

2. Get the right people in the room. The owner or CEO, whoever runs operations, whoever handles finance, and whoever handles your IT, whether that's someone on staff or a provider like us. Everybody who'd be making a call on the bad day.

3. Pick one scenario and stay on it. Don't try to cover everything. Pick the one that would hurt most, run it start to finish, and write down every question nobody could answer.

4. Restore something real, somewhere safe. Pick a few folders and a mailbox, or a whole server if you can. Bring it back to a test location, open the files, and check that they're the current versions. Write down how long it took, because that's how long you'd be down.

5. Turn the gaps into a short list. Every tabletop and every restore test turns up something. Give each gap an owner and a date. That list is the most useful thing you'll get out of the whole exercise.

Where to start

Those are two great things to do at the end of the year, and really every year. They keep you aligned with best practices, and if something ever does happen, you'll know you're going to be able to recover from it.

If you only do one this week, do the restore. Pick one folder you'd hate to lose, bring it back, and open it. You'll know in an hour whether your backup is real.

Then book the tabletop. Get leadership in a room, read them the scenario at the top of this post, and ask them what happens next.

---

One question to answer this week: when did anyone at your company last restore a file from backup and open it? If nobody knows, book 15 minutes and we'll help you run the restore test and your first tabletop before the year ends, or run our free external scan to see what an attacker can already find about your company.

Keith Parker is the CEO of Methodology IT, a managed IT services provider in Los Angeles that has supported healthcare practices, nonprofits, and growing businesses across Southern California since 1997.

Sources: CISA Tabletop Exercise Packages · NIST SP 800-84, Guide to Test, Training, and Exercise Programs · CISA #StopRansomware Guide