A ransomware tabletop is a one hour discussion where your team walks through a scripted attack and makes the decisions it would face. Both the NCSC and NIST say plans should be exercised, so use the session to find gaps in decisions, contacts and access, not to test tools.
Why bother
The NCSC advises planning the response, including communications, ransom and data leak decisions and legal reporting, keeping offline playbooks, and exercising the plan regularly. NIST SP 800-184 advises testing recovery plans with realistic scenarios. A tabletop is the cheapest way to do both.
Who to invite
IT operations, security, legal, communications, an executive with authority to decide, and someone who owns key vendor relationships. If your insurer or incident response provider will join, even better.
The eight decisions
Reveal the scenario in stages and ask the room to decide at each.
- Isolation. A server shows encrypted files. Who orders network isolation, and how? (CISA: isolate, at the switch if needed, and avoid powering off.)
- Communications. Email is down. How does the team talk? (CISA: out of band channels.)
- Priorities. Which three services come back first, and what do they depend on?
- Backups. Can anyone confirm the last good backup is intact and out of the attacker's reach?
- Evidence. Who preserves images and logs before rebuilds start?
- Reporting. Who contacts law enforcement and the insurer, and in what order?
- Data theft. A leak site post appears. Who decides what to tell customers?
- Payment. The attacker sets a deadline. Who is in the decision, what advice do you need, and what do you record?
Facilitator script
- Minutes 0 to 10: set the scene and ground rules. No blame.
- Minutes 10 to 45: reveal the stages, one decision at a time.
- Minutes 45 to 60: list gaps and assign owners.
What to produce
A one page action list with owners and dates. Typical findings: a missing phone number, no one with backup console access, no named person who can declare an incident over, or no agreed way to assess materiality for disclosure.
After the session
Update the plan and put the next exercise on the calendar. CISA also suggests documenting lessons learned after real incidents to guide future exercises, so feed the same loop.
Scenario starters
Use a scenario close to your own risk: a file server encrypting overnight, a leak site post naming your company, or a vendor with remote access reporting a compromise. Vary it each time so the team does not memorise the answers. Add a twist partway through, such as a backup that fails its integrity check, to see how decisions change.
Quick check
How often should we run one?
The sources say regularly without a fixed interval. Choose one you will keep, and run another after a major change or incident.
Do we need an outside facilitator?
Not necessarily. An internal facilitator who is not responsible for the plan often gives a more honest session.
Sources
Last reviewed: 19 October 2026.
