Backups, offline plans and tabletop exercises for the worst day

Prepare for the worst day with three things: backups kept offline and tested by restoring them, an incident plan that exists on paper and offline, and a tabletop exercise you run on a schedule. CISA's ransomware guide and NIST's incident response guidance say the same thing in different words: practice before you need it.

This checklist is calm by design. It does not predict any event, and it names no date.

Why offline backups?

CISA's guide notes that many ransomware variants try to find and delete or encrypt accessible backups, so it recommends keeping backups of critical data offline and encrypted. Keep golden images, infrastructure as code templates and source code with them, plus spare hardware to rebuild on.

A tested restore matters more than the backup. The guide says to test backup procedures regularly and check that data is available and intact in a disaster recovery scenario. A backup you have never restored is a hope, not a control.

Cisco Talos, writing about the Kaseya attack, described the 3-2-1 approach: three copies of data on two systems with one stored offline.

For regulated EU financial entities, DORA Article 12 requires documented backup policies, periodically tested restoration procedures and restoration on segregated systems.

What belongs in the plan?

CISA says to create, maintain and exercise an incident response plan and a communications plan. Keep a hard copy and an offline version, because email and file shares may be down. Have the CEO or equivalent approve the plans in writing, and prepare holding statement templates.

Add a contact table with 24 hour numbers for IT and security, leadership, managed service providers, cyber insurance and law enforcement contacts.

NIST's incident response publication, SP 800-61 Revision 3 (April 2025), replaced Revision 2 and is built as a profile of the Cybersecurity Framework 2.0. It says the Govern, Identify and Protect functions help prevent some incidents and prepare for others, and that lessons learned feed back into governance and risk management.

What does a tabletop exercise involve?

A tabletop is a discussion, not a technical test. Pick a scenario, such as ransomware on file servers on a Friday evening. Walk through who is called, who decides, what is isolated, how people communicate when email is down and when customers and regulators are told. Write down every question nobody could answer.

CISA recommends exercising the plan against a ransomware scenario on a regular basis and offers tabletop exercise packages.

What does the first hour look like?

CISA's response checklist starts with detection and analysis. Identify affected systems and isolate them, taking the network offline at the switch level if several are involved. Use out of band communication such as phone calls. Snapshot cloud volumes for forensics. Triage systems for restoration using your predefined critical asset list. Power devices down only if you cannot disconnect them.

Then report and notify according to your plan, contain and eradicate, and recover from offline backups in priority order without reinfecting clean systems. Afterwards document lessons learned.

What to do

1. Identify your ten most critical systems and where each is backed up.
2. Make sure one copy is offline or otherwise out of reach of normal credentials.
3. Restore one system from backup this quarter and time it.
4. Print the incident plan and contact table, and store a copy offline.
5. Schedule a tabletop exercise with leadership at least once a year.
6. After each exercise, update the plan and assign owners to each gap.

Quick check

Sources

• CISA: #StopRansomware Guide
• NIST: SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• Cisco Talos: REvil ransomware actors attack Kaseya
• EUR-Lex: Regulation (EU) 2022/2554 (DORA)

Last reviewed: 18 October 2026.