Direct answer
Use a hypothetical scenario to walk through reporting, containment, evidence, recovery and communication decisions, then assign owners to gaps and test the revised plan.
Set the scenario and roles
Choose a realistic event such as a finance laptop reporting inaccessible files during payroll. Include incident response, IT, business owners, communications and decision makers. Define scope and exercise rules; do not deploy ransomware or disrupt real users.
Walk through decisions
Ask how the team identifies the device, preserves evidence, contains accounts and devices, finds unaffected backup copies and prioritizes business operations. NIST's recovery guidance discusses defining milestones and reviewing the response after an incident.
Reference: NIST: Guide for cybersecurity event recovery.
Record and follow up
Document decision owners, missing contact details, recovery dependencies and timelines. Assign concrete corrective actions with dates, then repeat the exercise or a safe restore test. Keep scenario artifacts separate from real incident records.
Introduce a conflicting priority
In the exercise, assume the affected laptop supports a time-critical customer service while evidence preservation is also needed. Ask who can approve containment, what alternate workflow exists and how the team will communicate the decision. Capture the responsible names and missing dependencies, then test the revised plan in a subsequent exercise with the same decision makers.
Assessment limits
A tabletop tests decisions and coordination, not the technical effectiveness of every control. Conduct approved technical tests separately.
Frequently asked questions
Should the exercise run real ransomware?
No. A tabletop uses a hypothetical scenario; technical testing requires a separately authorized and controlled plan.
Does a good discussion prove backups restore?
No. Perform a safe representative restore test as well.
Who should participate?
Include teams responsible for security, IT recovery, business decisions and communication.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.