A cybersecurity tabletop exercise for small business is a short, discussion-based meeting where your team walks through a simulated incident to find gaps in your response plan before a real attack does. NIST SP 800-84 describes tabletop exercises as "discussion-based exercises where personnel meet in a classroom setting or in breakout groups to discuss their roles during an emergency." The Canadian Centre for Cyber Security's guide Developing your incident response plan (ITSAP.40.003) tells organizations to "Develop exercises to test your plan and response." This guide covers how to run one for a small team in Canada or the US.

What is a cybersecurity tabletop exercise?

A tabletop exercise is a structured conversation, not a technical test. According to CISA, organizations can use its Tabletop Exercise Packages (CTEPs) "to initiate discussions within their organizations about their ability to address a variety of threat scenarios." Nothing goes offline and no data is at risk. NIST SP 800-84 explains: "A facilitator presents a scenario and asks the exercise participants questions related to the scenario."

CISA describes each package as customizable, with "template exercise objectives, scenarios, and discussion questions as well as a collection of references and resources." The scenario usually unfolds in stages, and at each stage participants say who does what, who they call, and what information they need. The value comes from the conversation itself.

Why should a small business run a tabletop exercise?

Because the first hours of an incident are the worst time to work out who is in charge. The Canadian Centre for Cyber Security says to "Test, revisit, and revise your incident response plan annually to keep it effective," and a tabletop exercise is a practical way to do that test. As we covered in incident response planning before something happens, considering these scenarios in advance, even informally, can reduce the chaos and improve outcomes.

A one-hour session with your leadership team, IT provider, and key staff can surface hard questions: Who has authority to shut down systems? Who calls the cyber insurer? What happens if the incident starts at 2 AM on a Saturday?

What should a tabletop exercise cover?

Pick one scenario that matches your real risk, then walk it through every phase of your plan. CISA says its cybersecurity CTEPs "incorporate various cyber threat vectors including ransomware, insider threats, phishing, and Industrial Control System (ICS) compromise." For most small businesses, ransomware is a good first scenario because it touches detection, containment, backups, and communication in one session.

ITSAP.40.003 structures an incident response plan around these phases, and your exercise can test each one:

  • Detection and analysis: How would you know an incident is happening, and what would trigger escalation?
  • Containment: The Cyber Centre says "Containment is crucial for your organization's recovery" and that strategies depend on the type of incident, the degree of damage it can cause, and your operational requirements. Who decides to disconnect systems?
  • Eradication: How would you identify and remove all elements of the incident from affected systems?
  • Recovery: How would you restore systems and confirm they are running effectively? Have your backups been tested?
  • Post-incident activities and lessons learned: The guidance recommends reviewing the root cause, evaluating what went well and what needs improvement, and creating a lessons learned document.

For the first steps of a ransomware response specifically, see our checklist on what to do in the first hour after a ransomware attack.

Who should take part in the exercise?

Invite everyone who would make or carry out decisions during a real incident. ITSAP.40.003 says your response team "should include employees with various qualifications and have cross-functional support from other business lines." Its roles to consider include critical path personnel, security practitioners, IT or cyber security specialists, project engineers for operational technology environments, legal, and management.

For a small business, that may be three or four people: an owner or manager who can authorize spending and shutdowns, your internal IT lead or managed service provider, someone who handles legal or insurance questions, and whoever would speak to customers. The Cyber Centre also says to ensure your team has "alternate means of contact, such as mobile phones or out of band email," and that each member should have a backup contact. The exercise is a good time to confirm both exist.

How do you run a tabletop exercise step by step?

Plan for about an hour, one scenario, and one facilitator. CISA's CTEP documents include templates for "the initial invitation to participants, a slide deck to use for both planning meetings and conduct, a feedback form to distribute to participants post-exercise, and an After Action Report." A simple run looks like this:

  1. Set objectives. For example: confirm who can authorize shutting down systems, test the call list, and check that backups can be restored.
  2. Choose a scenario. Ransomware or business email compromise works for most small businesses. Adapt a CISA package with details from your own business.
  3. Invite the right people. Include your IT provider if your support is outsourced.
  4. Run it in stages. Share the first sign of trouble, then add developments. At each stage, ask what people would do, who they would contact, and what they would need.
  5. Write it down. Record decisions, gaps, and owners for each action item, using an after action report.
  6. Follow up. Fix the gaps and update your incident response plan, as ITSAP.40.003 recommends using your test results to revise and improve it.

What gaps do tabletop exercises often reveal?

The most common findings are about people and process rather than technology. ITSAP.40.003 points to several of them directly: a communications plan with "multiple communication mechanisms," alternate contact methods, backup contacts for each team member, and a reliable backup process. Typical gaps include:

  • Unclear authority: No one knows who can shut down systems, approve emergency spending, or speak to customers.
  • Contact lists in the wrong place: Key numbers live only in email, which may be unavailable during an incident.
  • Untested backups: Everyone assumes backups work, but no one has restored one recently.
  • Vendors left out: As our post on third-party vendor risk from an SMB perspective notes, a breach at a vendor can cascade to its customers, so your plan should say what you do if a key provider is the one compromised.
  • No prepared messages: Nobody has drafted what to tell customers, staff, or partners.

If you want help beyond the exercise itself, Cyber Unit's incident response service covers rapid threat containment, root cause identification, remediation support, and a post-incident review. Our managed security awareness training adds simulated phishing campaigns that mirror real-world attacks, so your team learns to spot them.

Does this apply to Canadian and US businesses alike?

Yes, the method is the same on both sides of the border. CISA is a US agency and the Canadian Centre for Cyber Security is Canada's, but both publish guidance online that any business can use to plan an exercise. Canadian organizations can also use the Cyber Centre's Report a cyber incident page, which helps a small or medium business find out where to report an incident. Reporting and notification duties differ by jurisdiction, so confirm yours with legal counsel.

What should you ask your IT provider this week?

Start with one question: "When did we last walk through how we would respond to a ransomware attack, and what did we change afterward?" If the answer is "never" or "I'm not sure," schedule an hour, pick one scenario from a CISA package, and run it with your team before the end of the quarter.

To see where your incident response readiness and other controls stand first, take our free cybersecurity assessment. It takes under 5 minutes, covers 22 security areas, and runs in your browser with no signup required.

This article is intended for general informational purposes only and does not constitute professional security, legal, or compliance advice. Guidance is based on publicly available materials from CISA, NIST, and the Canadian Centre for Cyber Security as of the date of publication and may change. Organizations should consult qualified professionals to develop incident response plans appropriate to their circumstances.