Find the gaps on a Tuesday afternoon, not during a real attack
A tabletop is a guided conversation: your team talks through a realistic incident and discovers what they'd actually do. Nothing is touched, nothing can break, and the only cost is 90 minutes.
Most small businesses should start with the invoice fraud scenario. It's the most likely to happen to you and it brings finance into the room. Run one scenario per session, and try a different one next time.
The three scenarios
Each runs in four stages, with discussion questions and curveballs to add if the team is coasting.
| Scenario | Tests |
|---|---|
| A: The Friday Lockout | Ransomware. Your systems are encrypted and client data may be stolen. Tests decision-making, backups and communication. |
| B: The Invoice That Changed | Business email compromise. A real payment goes to a criminal. Tests financial controls and speed. |
| C: The Helpful Assistant | AI exposure. Copilot surfaces private data, then a connected AI vendor has a breach. Tests whether AI is really part of your plan. |
Ground rules to read aloud
These four lines do more for the quality of the drill than anything else in the kit.
- ///No blame
We're testing the plan, not the people. Mistakes here are free.
- ///Say what you'd really do
Not what you think you should say. Saying you don't know is a great answer, and it goes on the fix list.
- ///Decide with what you have
In a real incident the information is incomplete, so assume the scenario is what it appears to be.
- ///Stay in the room
If you'd need to call someone, say who, and whether you actually have their number.
Know your deadlines
A starting point, not legal advice, and not complete. Have your counsel confirm what applies to your business.
| Rule | Who it affects | The clock |
|---|---|---|
| DFARS 252.204-7012 | DoD contractors and subcontractors with covered defense information | Within 72 hours of discovery |
| Alabama Data Breach Notification Act | Businesses holding Alabama residents' sensitive personal information | Individuals within 45 days |
| CIRCIA | Covered critical infrastructure entities | Not yet in effect |
| Contracts and insurance | Everyone | Often very short |
What's in the full PDF
- ///The full facilitator script for all three scenarios, stage by stage
- ///What good sounds like: look-fors so you can grade the answers
- ///The first-hour card: print it and keep it away from your computers
- ///Fillable emergency contact sheet, decision log and after-action report