Practical Incident Response Tabletop Exercise for Australian SMBs: Run a 2-Hour Ransomware Drill

Why tabletop exercises matter for SMBs

Cyber incidents are not just an enterprise problem. Australian small and medium businesses often run lean IT, rely on cloud tools, share admin access between staff, and depend on suppliers for accounting, payroll, managed services, ecommerce, or file storage. That makes preparation more important, not less.

A tabletop exercise is a structured discussion, not a technical penetration test. The goal is to answer practical questions before the real crisis: who decides whether systems go offline, who calls the insurer, who speaks to customers, who checks backups, who preserves evidence, and who has authority to approve emergency spending?

For SMB owners, the biggest benefit is decision rehearsal. During a ransomware event, leaders may face incomplete facts, staff pressure, customer calls, media concern, legal obligations, and operational downtime at the same time. A tabletop drill creates safe pressure so the team can practise calm, documented decisions before money, reputation, and data are at risk.

Run a 5-10 person exercise in 2 hours

Keep the format simple. Invite the people who would actually be involved in a business-impacting incident:

• Business owner, CEO, or managing director
• Operations manager
• IT lead, managed service provider, or technical administrator
• Finance lead
• HR or people manager
• Customer service or account manager
• Legal, privacy, or compliance adviser if available
• Communications or marketing lead
• External cyber provider, insurer, or incident response contact if already engaged

Use this two-hour agenda:

1. 0-10 minutes: Set rules Explain that the exercise is not about blame. No one is expected to have perfect answers. The purpose is to expose gaps early.

2. 10-25 minutes: Confirm roles Assign incident commander, technical lead, communications lead, finance lead, legal/privacy lead, scribe, and executive decision-maker.

3. 25-40 minutes: Scenario briefing Present one scenario card. Give only the facts the business would realistically know at the start.

4. 40-85 minutes: Injects and decisions Add new information every 10-15 minutes: a customer calls, the attacker emails, backups fail, the bank asks questions, a journalist messages LinkedIn, or a regulator notification clock may apply.

5. 85-105 minutes: Score decisions Rate the team on speed, evidence, role clarity, customer impact, legal/privacy handling, recovery thinking, and documentation.

6. 105-120 minutes: After action review Capture three strengths, three gaps, named owners, due dates, and the next exercise date.

Use the NIST incident response lifecycle

The NIST incident response model gives SMBs a practical structure: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. You do not need enterprise-scale tooling to use it.

Preparation means having contact lists, backups, MFA, cyber insurance details, admin access records, legal contacts, and communication templates ready before the incident. Detection and analysis means deciding what happened, what systems are affected, what evidence exists, and whether the event is still active.

Containment is where executive pressure usually appears. Do you disconnect the file server and stop work for the day? Disable a departing employee account immediately? Freeze payments? Block vendor access? Containment decisions should be fast, documented, and reversible where possible.

Eradication and recovery focus on removing attacker access, resetting credentials, rebuilding systems, restoring clean data, and returning to operations in a controlled way. Lessons learned turns the drill into improvement: better access control, clearer escalation paths, tested backups, updated playbooks, and more specific supplier requirements.

Realistic 2026 scenario cards

Use one scenario per exercise. Rotate scenarios quarterly so the team does not rehearse only ransomware.

Scenario card 1: Ransomware on the file server

At 8:40am, staff report they cannot open shared files. Several folders contain ransom notes. The accounting team says payroll files are unavailable. The managed service provider is not yet sure whether backups are affected.

Key decisions:

• Who becomes incident commander?
• Do you disconnect the server or the whole office network?
• Who checks backup integrity?
• Who contacts cyber insurance or external responders?
• What do you tell staff, customers, and suppliers today?

Scenario card 2: Business Email Compromise with invoice fraud

A supplier calls asking why a $48,000 invoice has not been paid. Finance confirms payment was made yesterday, but the bank details were changed by email two days earlier. The email thread appears legitimate.

Key decisions:

• Who contacts the bank and how quickly?
• Who verifies whether mailbox rules or forwarding were created?
• Do you notify the supplier, insurer, or police?
• How do you stop further payments until checks are complete?
• What approval process failed?

Scenario card 3: Cloud misconfiguration data leak

A staff member finds customer documents accessible through a public link. The link appears to expose quotes, contracts, and identity documents uploaded over several months.

Key decisions:

• Who disables public access?
• Who determines what data was exposed and for how long?
• Who assesses privacy notification obligations?
• How do you preserve logs before changing settings?
• What message goes to affected customers?

Scenario card 4: Insider threat via departing employee

A senior employee resigns and joins a competitor. IT notices large file downloads from cloud storage the night before their final day. Their account still has access to CRM exports and shared drives.

Key decisions:

• Who can suspend access immediately?
• Who reviews logs and device access?
• Who handles HR and legal communications?
• How do you separate malicious activity from normal handover?
• What access should have been removed earlier?

Scenario card 5: Supply chain compromise via vendor

Your outsourced payroll or IT vendor reports a security incident. They cannot yet confirm whether your company data or credentials were accessed. Staff are asking whether payroll will still run.

Key decisions:

• Who contacts the vendor and requests written facts?
• What vendor access should be disabled or rotated?
• Do you activate business continuity processes?
• Who assesses contractual, privacy, and customer obligations?
• What evidence do you require before reconnecting trust?

Tabletop exercise template

Copy this template into a document before the session.

Exercise overview

• Business name:
• Date:
• Facilitator:
• Scenario selected:
• Participants:
• Systems in scope:
• Exercise objective:
• Assumptions:
• Out-of-scope items:

Role assignment

• Incident commander:
• Executive decision-maker:
• Technical lead:
• Communications lead:
• Finance lead:
• Legal/privacy lead:
• HR lead:
• Customer/supplier liaison:
• Scribe:
• External support contact:

Scenario inject log

Time	Inject	Decision required	Decision made	Owner	Evidence needed
00:15	Initial alert	Is this an incident?
00:30	Business impact grows	Contain or keep operating?
00:45	Customer/supplier pressure	What do we communicate?
01:00	New technical finding	Escalate, isolate, or restore?
01:15	Legal/privacy concern	Notify whom and when?

Scoring rubric

Score each area from 1 to 5.

Area	1 = weak	3 = acceptable	5 = strong
Role clarity	Confusion over authority	Roles mostly understood	Clear owner for every decision
Speed	Decisions delayed	Key calls made with some delay	Time-critical calls made quickly
Evidence	Guesswork dominated	Some facts checked	Decisions tied to evidence and logs
Containment	No clear containment	Partial containment	Fast, proportionate containment
Communication	Inconsistent messages	Basic internal update	Clear staff, customer, supplier plan
Legal/privacy	Ignored obligations	Flagged for review	Clear escalation and notification path
Recovery	No recovery path	Backup/rebuild discussed	Prioritised recovery with validation
Documentation	Notes missing	Basic notes captured	Decisions, owners, times recorded

After action report template

• Exercise summary:
• What went well:
• What failed or slowed decisions:
• Missing contacts, tools, access, or documents:
• Policy or process updates required:
• Technical remediation required:
• Training required:
• Supplier or contract follow-up required:
• Priority actions for the next 7 days:
• Priority actions for the next 30 days:
• Action owners and due dates:
• Date of next tabletop exercise:

Practical recommendations

Start with ransomware if you have never run a tabletop before. It forces decisions about downtime, backups, communications, insurance, and recovery priorities.

Do not let the session become a technical debate. The technical lead should explain options, but executives must practise making business decisions with imperfect information. That is the point of the drill.

Document every decision with time, owner, reason, and evidence needed. In a real incident, good notes help with insurance, legal review, regulator engagement, customer communication, and post-incident improvement.

Run the exercise at least twice a year. Alternate between operational disruption scenarios, such as ransomware, and trust scenarios, such as invoice fraud or vendor compromise. Each exercise should produce a short action list with named owners, not a long report that nobody reads.

FAQ

Conclusion

A realistic incident response tabletop exercise helps Australian SMBs practise the decisions that matter most: who leads, what gets contained, how customers are protected, when experts are called, and how recovery is prioritised. Start with one two-hour ransomware drill, score the decisions honestly, and convert the after action report into a 30-day improvement plan.

Visit consult.lil.business for a free cybersecurity assessment.

References

1. Australian Cyber Security Centre - Exercise in a Box
2. NIST Computer Security Incident Handling Guide SP 800-61 Rev. 2
3. NIST Cybersecurity Framework 2.0
4. SANS Incident Handler's Handbook
5. Australian Cyber Security Centre - Business Email Compromise

Verifier warning: verifier could not run (PluginLlmTrustError).