Rehearse Your Worst Day: The 90-Minute Tabletop Exercise Any SMB Can Run

Every business with more than a few staff runs fire drills. Almost none rehearse the far more likely emergency: the Monday morning the files won’t open, or the customer who calls asking why you emailed them a strange invoice. A tabletop exercise is that rehearsal — no actors, no simulated hacking, just your key people around a table talking through a scenario for 90 minutes. It is the highest-value security exercise per dollar that exists, because it costs one meeting.

The setup

• Who: the owner, whoever runs operations, whoever touches money, and your IT provider (on a call is fine). Four to six people.
• What: one printed scenario, someone to read it out and keep time, and someone taking notes on every gap discovered.
• Rules: no blame, and no “that would never happen” — the point is to find holes on a calm Tuesday instead of a terrible Monday.

A scenario to steal

9:05am: three staff report their files won’t open, and there’s a text file on the server called READ_ME. Inject one twist every 15 minutes: the backup drive is encrypted too … a customer emails that they paid the “new account” on your last invoice … a journalist rings. For each stage ask the same four questions: Who do we call first? Who decides? What do we tell staff and customers? How do we keep trading this week?

What good looks like afterwards

• A list of gaps with owners and dates — typically: no printed contact list, nobody knows the insurer’s hotline, backups never restore-tested, no agreed spokesperson.
• Your one-page incident response plan updated with what you learned (printed — the digital copy is encrypted in this scenario).
• A calendar entry to run it again in 12 months, or after any major change.

Insurers and tender questionnaires increasingly ask “do you test your incident response plan?” — after one tabletop, you answer yes with a straight face. More importantly: if the real Monday ever comes, your team has been there before.