Free checklist · For vCISOs and MSPs running annual exercises for clients
Incident Response Tabletop Exercise Kit
A tabletop exercise is the cheapest way to find out whether an incident response plan works. This kit gives you a planning checklist, a four-stage ransomware scenario with questions for each inject, and an after-action template.
Before the exercise
Set objectives
E.g. test escalation, decision rights, communications and backup recovery.
Invite the right people
Leadership, IT, legal/compliance, communications, plus the MSP and insurer contact if relevant.
Share the IR plan in advance
Participants should know where the plan and contact list live.
Assign a facilitator and a scribe
The scribe captures decisions, gaps and actions.
Agree ground rules
No-fault environment; decisions made with information available at the time.
Inject 1 – Detection (Monday 7:40am)
Scenario
Several staff report files they cannot open with a strange extension; one sees a ransom note.
Who is notified first, and how?
Is the contact list current and reachable out of hours?
Who has authority to declare an incident?
What is the first containment step?
Isolate devices? Disable accounts? Who can do it?
Inject 2 – Escalation (9:15am)
Scenario
File servers are encrypted; backups on the same domain also appear affected.
When do you call your cyber insurer and breach counsel?
Do you know the policy's notification requirements?
How do you preserve evidence?
Which business processes stop, and what is the manual workaround?
Inject 3 – Extortion (2:00pm)
Scenario
Attackers post a sample of customer data and threaten to publish more.
Who decides on ransom negotiations, and on what basis?
Consider legal and sanctions implications.
What are your regulatory and contractual notification deadlines?
What do you tell staff, customers and the media?
Who approves statements?
Inject 4 – Recovery (Day 3)
Scenario
Clean offline backups are found that are 5 days old.
In what order are systems restored?
Does this match your BIA priorities?
How do you confirm the attacker is gone before reconnecting?
What data was lost, and how is it recreated?
After-action review
What went well
Gaps identified
Plan, people, tooling, contacts.
Actions with owners and due dates
Plan updates required
Date of next exercise
Get the full Incident Response Tabletop Exercise Kit
All 26 items, plus a spreadsheet (CSV) you can open in Excel or Google Sheets. Free — we'll email you the link too.
No spam. Unsubscribe in one click. Prefer to skip? Start free — the full framework is built in.
Run this for every client — without the spreadsheet
Log exercises and real incidents per client in NovaGRC, generate AI-assisted post-mortems, and turn gaps into tracked remediation tasks.
The Starter plan is free: one client workspace, up to 3 team members, no credit card.
