Ransomware Tabletop Exercise: How to Run One That Works

A ransomware tabletop exercise is a facilitated, discussion-based rehearsal in which your leaders and technical staff walk through a simulated attack and decide, step by step, what they would do. No systems are touched. What you test is your people, your decision rights, your contact lists and your recovery assumptions. Done well, a session of about two hours exposes the gaps that would otherwise surface at 2 a.m. during a real encryption event, when the attackers already have the keys and every minute of confusion costs money.

This guide shows Canadian small and mid-sized organizations how to plan, run and follow up an exercise, using guidance from the Canadian Centre for Cyber Security, provincial governments and Canadian academic and professional bodies.

TL;DR

• A tabletop exercise tests decisions, roles and communication, not technology. Plan for roughly 90 to 120 minutes, a designated facilitator and everyone who has a role in a ransomware response.
• Build the scenario around your real systems and your most critical business functions, then release the events in stages (injects) so pressure builds the way it would in an incident.
• Rehearse the hard questions: whether to pay, who calls the insurer, when privacy breach reporting applies, and how you communicate when email is down.
• Finish with an after-action review. Every finding needs an owner, a target date and a way to verify the fix.
• Repeat the exercise on a regular schedule and after major changes, such as a new IT provider, a new core system or a key staff departure.

Table of Contents

• Why Canadian organizations should rehearse ransomware specifically
• What a tabletop exercise should test
• Who should be in the room
• Build a realistic scenario
• Deliver injects that build pressure
• The decisions to rehearse
• Small organizations: scale the exercise, not the discipline
• Evaluate the exercise and build an improvement plan
• How often to repeat it
• Our perspective
• Get help preparing your exercise
• FAQ
• Sources

Why Canadian organizations should rehearse ransomware specifically

The Cyber Centre’s National Cyber Threat Assessment 2025-2026 identifies ransomware as the top cybercrime threat facing Canada’s critical infrastructure. Small organizations are not outside that picture. Ransomware-as-a-service has lowered the barrier to entry, and incident response firm Coveware, cited in a British Columbia government report, observed that even less sophisticated attackers now succeed against small businesses.

The cost of getting it wrong is documented. The Canadian Survey of Cyber Security and Cybercrime reported that total recovery costs for cyber security incidents in 2023 doubled to $1.2 billion CAD. Much of that cost is not the ransom. It is downtime, rebuilt systems, legal work and lost clients.

A written incident response plan does not protect you if nobody has read it. The Cyber Centre’s Ransomware Playbook states that a practised plan helps an organization make good decisions under pressure. A tabletop is the cheapest way to practise. If you want the plan itself in a compact form first, our one-page audit-ready incident response plan is a useful starting point.

For context on why Canadian firms in particular are being singled out, see our analysis of why Canadian businesses are being targeted by ransomware in 2026.

What a tabletop exercise should test

The exercise is not a quiz on technical trivia. Define three or four objectives before you build anything. The Cyber Centre’s playbook points to the areas that matter most, and they translate directly into objectives:

• Recovery objectives. Do leaders know which business functions, applications and data must come back first, and how long each can be down? The playbook says recovery plans should identify and prioritize critical business functions, applications and data.
• Backup and recovery strategy. Does anyone know where the last clean backup is, who can restore it, and how long a restore really takes?
• Communications. Who tells staff, clients, the board, the insurer and regulators, and through which channel if email and the phone system are unavailable?
• Stakeholder contacts and external coordination. Can you reach your managed service provider, your security specialists and your legal counsel at night, with current numbers?

The British Columbia government’s Tabletop Exercise in a Box describes its ransomware exercise in similar terms: structured scenario events and questions that test decision-making under pressure and coordination among technical, business and leadership teams. Each exercise takes approximately 90 to 120 minutes, which is a realistic budget for a small organization too.

Who should be in the room

The Cyber Centre’s Ransomware Playbook says a tabletop should include all participants who have roles in a ransomware response, and it should test whether they understand their required actions. In a small organization that usually means:

If your IT is outsourced, your provider belongs at the table. The point is to find out in advance whether their escalation path and your expectations match.

Choose a facilitator who does not play

British Columbia’s guidance calls for a designated facilitator and a dedicated meeting space aligned with regular business practices. The facilitator controls timing, delivers the injects and keeps the discussion on decisions rather than on blame. Ideally this is someone who does not own the response plan, because the owner tends to defend it. If nobody inside qualifies, an outside specialist is a sound choice.

Build a realistic scenario

A scenario that resembles your actual business produces useful findings. A generic scenario produces polite agreement.

Start from your own environment: your line-of-business application, your file shares, your Microsoft 365 tenant, your remote access method, your backup product. Then choose an initial access path that is plausible for you, such as a phished Microsoft 365 credential, an exposed remote desktop service or a compromised vendor account.

The threat actor profile should be believable too. The Cyber Centre’s joint advisory on LockBit notes that its affiliates have targeted financial services, education, energy, government and emergency services, healthcare, manufacturing and transportation worldwide. If you operate in one of those sectors, you can say honestly that the scenario mirrors real targeting.

A workable scenario outline for a 25-person firm:

1. Setting. It is Friday at 4:40 p.m. before a long weekend.
2. Trigger. The office manager reports that files on the shared drive will not open and a text file demands payment.
3. Hidden complexity. The most recent backup job failed two nights ago and nobody noticed.
4. Escalation. The attacker claims to hold client data and threatens to publish it.

Write these down before the session, along with the questions you want each role to answer. Keep the scenario’s hidden facts with the facilitator only.

Deliver injects that build pressure

Injects are the scripted developments the facilitator introduces over time. The University of Toronto’s usage guide for tabletop exercises advises facilitators to use realistic incidents or injects strategically, and to use predefined roles to assess response and communication times. Treat the clock as data: note how long it takes participants to name the incident lead, to reach the provider, to decide on isolation.

A sample inject sequence:

The Disaster Recovery Institute Canada’s Great Canadian Disaster inject is a useful Canadian model for the later stages. It asks participants to handle an extortion demand, uncertain breach notification, competing cyber priorities, degraded operations and verified communications. Borrow those themes for the second half of your session, when fatigue and ambiguity are highest.

The decisions to rehearse

Containment without panic

The instinct to act forcefully is strong, and it is not always right. A British Columbia government security news digest cautions against “action bias”, noting that hasty decisions during a data breach can create problems where none existed. Use a tabletop to agree in advance which containment steps are pre-authorized (isolating a device, disabling an account) and which require the incident lead’s approval (shutting down a server, taking a site offline).

For a walk-through of how a real response unfolds from triage to eradication, see how security incident response works for IT managers.

Backups and recovery

Ask the uncomfortable question: if your backups were also encrypted or deleted, what then? Attackers routinely look for backup systems first. Rehearse who can reach offline or immutable copies, how long restoration takes per system, and which functions you would run manually in the meantime. Our guide to immutable backups and ransomware explains what protected copies look like, and our overview of cloud backup and disaster recovery in Canada covers how they are managed day to day.

Insurance

The Cyber Centre’s playbook notes that if an organization decides cyber security insurance is beneficial, its policy may provide incident response expertise during a ransomware attack. In your exercise, have someone find the actual policy, read the notification clause and state the claims hotline aloud. Many organizations discover that their policy requires insurer approval before engaging a response firm or negotiating.

The ransom question

Do not leave the payment decision to be invented during a crisis. The Cyber Centre states that paying is complex and carries significant risks: no guarantee of file recovery, the potential for re-targeting, and legal concerns about funding criminal organizations or violating sanctions. Your exercise should settle who holds the decision, which advisors (counsel, insurer, incident response firm) must be consulted first, and what facts would inform it. Record the process, not a pre-committed answer.

Privacy and reporting obligations

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), private sector organizations must notify affected individuals of breaches that pose a real risk of significant harm and report them to the Privacy Commissioner of Canada, as the Cyber Centre’s guidance states. Provincial laws can add obligations, and regulated sectors such as healthcare carry their own. Have your privacy officer walk through the harm assessment during the session and name who files the report. Our PIPEDA compliance guide for Canadian businesses covers the requirements in detail, and clinics handling health data can map duties with our 90-day HIPAA and PIPEDA plan.

Communications when systems are down

Assume email, chat and possibly phones are unavailable. Test whether leaders have personal mobile numbers for each other, whether an out-of-band channel exists, and who is authorized to speak to clients, the press and regulators. Verified communication matters: attackers sometimes monitor compromised mailboxes, so the exercise should ask how participants confirm that a message is genuinely from a colleague.

Small organizations: scale the exercise, not the discipline

A ten-person accounting firm does not need a day-long simulation with a crisis cell. It needs one focused session, a scenario that includes its client data and tax-season deadlines, and honest answers. Smaller organizations also tend to depend on a handful of people and a single provider, which makes single points of failure the most valuable finding. For a wider look at how security failures erode client confidence, this piece on website security and customer trust is worth reading alongside your risk assessment.

Layered defences reduce how often a scenario like this becomes real. Modern endpoint protection is one of the controls we most often see missing from small-business environments, and your tabletop will often point at it.

Evaluate the exercise and build an improvement plan

The session is only half the value. Hold the after-action review immediately, while memory is fresh. Public Health Ontario’s guidance on in- and after-action reviews recommends using thematic analysis of qualitative findings to prepare a report with an action plan for short- and long-term follow-up, sharing it with participants and senior leadership, and following up on progress. The University of Toronto’s guide likewise recommends an after-action review to identify knowledge gaps.

A practical format:

1. What worked. Capture the decisions that were fast and correct, so you keep them.
2. What was slow, unclear or missing. Group findings into themes: authority, contacts, backups, communications, privacy.
3. Actions. For each finding, record the change to make, the owner, the expected result, the target date and how you will verify it.
4. Follow-up. Review the list monthly until it is closed, and track whether each fix was both implemented and effective.

Typical first-exercise findings include an out-of-date contact list, an untested restore, no named person authorized to approve a payment, and an insurance policy nobody has read. All are fixable within weeks.

How often to repeat it

There is no single mandated interval for private organizations in Canada, so treat the cadence as a risk decision. Our recommendation for most small and mid-sized organizations is once a year, plus a fresh session after a significant change: a new IT provider, a major system migration, turnover in a named response role, or a real incident. Regulated organizations, and those that hold sensitive client or patient records, often benefit from alternating a leadership-focused exercise with a technical one. Rotate scenarios between sessions so participants cannot rely on rehearsed answers.

Our perspective

Most organizations we meet have an incident response plan. Far fewer have ever tested it, and the first test is usually an actual attack. A tabletop exercise closes that gap at very low cost, but only when it is built around the real environment: the real backup product, the real remote access path, the real escalation numbers.

This is where our cybersecurity-first approach to managed IT shapes how we work. We treat the exercise as an input to everyday operations. Findings about weak backups, missing endpoint protection or unclear authority feed directly into the controls we manage, monitor and report on, with 24/7 support and a response time we aim to keep under 30 minutes. For clients in regulated sectors such as healthcare and finance, we map the exercise outputs to the compliance obligations they already carry.

Our advice is simple: run the session, write down every gap, and assign every fix. If you are unsure where to begin, begin with the backups and the call list. They are the two things you will need first.

247techify Team

Get help preparing your exercise

If you would rather not build the scenario, the injects and the improvement plan on your own, we can help you turn the findings into working controls. Our cybersecurity services include managed detection and response, an AI security readiness assessment and penetration testing, and our managed security services cover the monitoring and response that a tabletop exercise assumes you have. If you are already under attack, see our emergency ransomware recovery service.

To discuss your own exercise, contact 247Techify and ask for a cybersecurity review.

FAQ

How long does a ransomware tabletop exercise take?

Plan for about 90 to 120 minutes of facilitated discussion, which is the range given in the British Columbia government’s exercise materials. Add 30 to 45 minutes immediately afterward for the after-action review. Preparation by the facilitator usually takes longer than the session itself.

Do we need an outside facilitator?

Not necessarily, but you need a designated facilitator who is not defending the plan. A trusted colleague outside IT can work for a first session. An external specialist is worth considering when your leadership team is new to incident response or you work in a regulated sector.

Should we decide in the exercise whether we would pay a ransom?

You should decide who makes that decision, who advises, and what information they need, rather than committing to a fixed answer. The Cyber Centre describes payment as complex and risky, with no guarantee of recovery and possible legal and sanctions concerns. Involve your counsel and insurer in setting that process.

What should we do if the exercise reveals serious gaps?

That is the purpose of it. Record each gap as an action with an owner, a target date and a verification method, address the highest-risk items first (usually backups, contacts and decision authority), and run the exercise again once those are closed.

Sources

• National Cyber Threat Assessment 2025-2026, Canadian Centre for Cyber Security
• Ransomware playbook (ITSM.00.099), Canadian Centre for Cyber Security
• ITSM.00.099 Ransomware Playbook (2021 PDF), Canadian Centre for Cyber Security
• Have you been a victim of cybercrime? Canadian Centre for Cyber Security
• Understanding ransomware threat actors: LockBit, Canadian Centre for Cyber Security
• The 2020 State of Crypto Crime, Province of British Columbia appendix
• Usage guide, Information Security at University of Toronto
• Great Canadian Disaster, Inject Three, Disaster Recovery Institute Canada
• Best Practices for Conducting In- and After-Action Reviews, Public Health Ontario

Recommended

• Immutable Backups and Ransomware: A Security Leader’s Guide
• Stop Ransomware: Upgrade the 3-2-1 Backup Rule to 3-2-1-1-0
• OneDrive Ransomware Protection: 30 Days to Restore for IT Admins
• NIST Aligned, Operations First: Disaster Recovery Testing, IT Managers