How to Run a 90-Minute Ransomware Tabletop Exercise: A Playbook for Mid-Market Owners and Operators

How to Run a 90-Minute Ransomware Tabletop Exercise: A Playbook for Mid-Market Owners and Operators

2026-10-13

The takeaway: A written incident response plan you’ve never rehearsed is a guess. A 90-minute tabletop exercise, a guided “what would we do?” walk-through of a fake attack, will show you who can make decisions, whether your backups really restore, and which vendor calls nobody knows how to make. Run one this quarter, then keep running them.

Why this belongs on the leadership calendar

Ransomware is malicious software that locks your files and systems until you pay. It showed up in 48% of the breaches in Verizon’s 2026 Data Breach Investigations Report, up from 44% the year before. The report covers more than 22,000 breaches from incidents between Nov. 1, 2024, and Oct. 31, 2025 (Verizon DBIR 2026; Verizon DBIR overview page; Verizon news release, May 19, 2026). Verizon’s summary says small organizations are “disproportionally impacted by Ransomware,” often with fewer resources to respond (DBIR 2026 Executive Summary).

Slow response is expensive too. IBM’s 2026 Cost of a Data Breach Report, run by Ponemon Institute across 602 breached organizations (breaches from March 2025 through February 2026), put the global average cost at $4.99 million, and $11.5 million in the U.S. Breaches that took more than 200 days to identify and contain averaged $5.65 million, compared with $4.32 million for faster ones (IBM Cost of a Data Breach Report 2026; IBM news release, July 29, 2026). Both reports are the latest editions as of this writing. Averages from big samples won’t match your exact numbers, but the direction is clear: speed and preparation matter.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) tells small businesses to host quarterly tabletop exercises and to have senior leaders take part (CISA Cyber Guidance for Small Businesses).

Before the session (one hour of prep)

  • Pick a facilitator. It can be your IT lead, your MSP (the outside firm that runs your IT), or a fractional CTO. CISA’s free Tabletop Exercise Packages include template objectives, scenarios, and discussion questions, and the package documentation adds invitation, feedback, and after-action report templates. There’s a ransomware situation manual, dated September 2023 (CISA Cybersecurity Scenarios).
  • Invite decision-makers, not just IT. That means the CEO or owner, finance, operations, HR, whoever handles customer communications, and your MSP.
  • Print the plan and the contact list. CISA says your incident response plan should include an address book you can use if the network is down (CISA). If it only lives on the file server, that’s your first finding.
  • Find your cyber insurance policy and its breach hotline number.

The 90-minute agenda

0–15 min: The first call

Scenario: At 7:40 a.m. Monday, an accounts payable clerk finds a ransom note on their laptop. That’s close to the common scenario CISA itself describes: one employee finding their laptop blocked by ransomware (CISA).

Ask: who do they call? Who has the authority to declare an incident? What does “declare” actually trigger?

15–35 min: It spreads

The file server and the accounting system are now encrypted.

Ask: who can order systems shut down or disconnected, even if that stops shipping or billing? Is the MSP’s contract clear on after-hours response? Does your insurer require you to use its approved responders before you hire anyone?

35–55 min: The backup moment of truth

Ask: when did we last do a full restore, not just confirm that the backup job ran? How many hours would it take to bring back payroll or the ERP? CISA warns that many ransomware victims had no backups or incomplete or damaged ones, and that some found restores took significantly longer than expected. That’s why it says to regularly test both partial and full restores (CISA).

55–75 min: Extortion and the vendor twist

The attackers threaten to leak customer data. The entry point turns out to be a vendor’s remote-access account.

Ask: who talks to customers, and when? Who calls legal counsel and law enforcement? Who makes the ransom decision, and on what criteria? For context, 69% of ransomware victims in Verizon’s dataset didn’t pay, and the median payment was $139,875. Breaches involving a third party reached 48% of the total (DBIR 2026).

75–90 min: The hot wash

List every “we don’t know” from the session. Give each one an owner and a due date. NIST’s incident response guide, SP 800-61 Revision 3 (Apr. 3, 2025), says lessons learned should feed continuous improvement across the whole program, and should often be shared as soon as they’re identified rather than after recovery ends (NIST SP 800-61r3).

Gaps to look for

  • Nobody is named as the person who can declare an incident or authorize shutdowns.
  • The contact list lives on systems that would be encrypted.
  • Backups “succeed” every night, but nobody has timed a full restore.
  • Vendor remote access isn’t covered by multifactor authentication (a second login step beyond the password) or isn’t reviewed.
  • Customer and employee messaging gets written for the first time during the crisis.

Make it a habit

Rotate scenarios: a stolen laptop next quarter, a vendor breach after that. Keep the after-action list short and actually close the items.

If you’d like an outside facilitator for your first session, or help closing what it uncovers (from backup restore testing to vendor access reviews), Yellow Coop’s fractional CTO and technology project work is built for exactly that kind of follow-through. Let’s talk.

Internal links: Secure, What We Do, How We Engage, Track Record, Contact, Insights.

Sources