Tabletop Exercise for Small Business: A Ready-to-Run Script

Friday, 7:50 a.m. At a parts distributor in Laval, the dispatcher can't open the order file. Every folder on the server now holds a new text file: "Your files have been encrypted."

Who calls whom? Who decides to unplug the server? Who has the insurer's number? What do you tell the customers expecting their parts on Monday?

If your team can't answer those questions on a quiet Tuesday, it will struggle on a Friday in the middle of a crisis. A tabletop exercise lets you rehearse the crisis to find the gaps. Here's a how-to guide and a ready-to-run script built for a Canadian business with 20 to 50 employees.

What is a tabletop exercise?

A tabletop exercise is a session in which decision-makers walk through a fictional cyberattack scenario, step by step, to check that their response plan holds up.

In its ITSAP.40.003 publication, updated in January 2026, the Canadian Centre for Cyber Security says to "develop exercises to test your plan and response," and to test, revisit and revise the plan annually. Its ITSM.10.014 guidance goes further: "Run a tabletop exercise with the key employees identified in the plan."

It's neither a penetration test nor a phishing simulation: you're testing decisions, roles and communications. No plan yet? Start with our incident response plan template; the exercise can also help you build one.

Preparing the exercise: roles and logistics

Light preparation over two or three weeks is enough: set the objectives, bring the right people together and print what you'd need if the network went down.

Before the session:

• Set two or three objectives, for example: reach the insurer in under 30 minutes, locate the latest offline backup, know who decides to notify the privacy regulator.
• Print the incident response plan and contact list. The Cyber Centre recommends alternate means of contact, such as mobile phone numbers.
• Invite your IT provider and, if possible, your insurance broker.
• Block two hours, phones away.
• Announce the ground rule: we're testing the plan, not the people.

The ready-to-run script: "The Friday ransomware"

This two-hour scenario follows a ransomware attack with data theft, a type of incident with an average cost of $330,000, according to industry data cited by Insurance Business Canada in October 2025.

Background (fictional): Laval Parts Inc., 35 employees. On-site file server, Microsoft 365, accounting software, biweekly payroll, external IT provider, cyber insurance policy.

Allow 10 to 15 minutes per inject. To compare your team's answers with the right reflexes, keep our article on the first 24 hours of a ransomware attack handy.

Facilitating without trapping: the ground rules

The facilitator gets people talking rather than correcting them: the goal is to reveal what the team would really do, including every "I don't know."

• Play with what you have. If nobody knows the insurer's number, look it up for real, and note how long it takes.
• Dig deeper. "We'd restore the backups" calls for a follow-up: which ones, tested when, by whom?
• Make a call. Every inject ends with a decision, even a provisional one, and the name of whoever made it.
• Stick to the schedule. Better to cut a debate short and note it than to skip the ending.

Monday's inject is the privacy moment. In Quebec, the privacy lead has to explain how they would record the incident in the register (Law 25, s. 3.8), assess the risk of serious injury, and notify the Commission d'accès à l'information and the people concerned "promptly" (s. 3.5); there's no fixed 72-hour deadline in Law 25. Outside Quebec, federal or provincial privacy law sets its own breach reporting and record-keeping rules, so adapt the inject. To make it concrete, fill in a mock entry in our incident register template. In a real incident, confirm your analysis with legal counsel.

After the exercise: the report and the actions

An exercise is only worth what changes afterwards: write a short report within a week, with three to five actions, each with an owner and a deadline.

The Canadian Centre for Cyber Security recommends a lessons learned document, and CISA's packages include an after-action report template. One page is enough: what worked, the gaps, the actions.

Typical actions after this scenario:

• Print the emergency contact list and the insurer's emergency hotline number.
• Create a second Microsoft 365 admin account, protected by a security key.
• Test a full restore from an offline backup.
• Prepare a template message for customers and another for staff.
• Put in writing who decides when the president is away.

Schedule the next exercise in 12 months with a different scenario: wire transfer fraud, a compromised Microsoft 365 account or a hacked IT provider.

Do you need an outside facilitator?

It isn't required, but an outside facilitator will ask the uncomfortable questions, and frees the owner to play their real role instead of running the session.

If you have no in-house security resource, our comparison of MSP, MSSP, vCISO and in-house options helps you decide who should own these exercises. Our ongoing security partner service keeps your roadmap and incident policies current throughout the year; let us know if you'd like to plan an exercise into it. The session works best in person: request an on-site visit.