A facilitator-led exercise a small organization can run itself in about 60 to 90 minutes: a phishing account takeover, ransomware or a payment-change fraud, told one piece at a time, with questions and where the answers are.
Free to print and adapt3 scenariosAbout 60 to 90 minutesLast reviewed October 2026
What a tabletop exercise is
A guided conversation about an incident that is not happening, so the real one is less of a surprise.
A facilitator reads out a situation, then new pieces of information (called injects) one at a time, as an incident would unfold. The people who would really respond talk through what they would do. Nothing on a computer is touched. Afterwards you have a list of what worked, what was missing and what to change.
The NCSC’s Exercise in a Box describes tabletop exercises as group discussions, each designed to identify your potential responses to an unfolding cyber incident, and its guide to effective steps to cyber exercise creation explains injects, ground rules and the short review straight afterwards (a “hot wash”). The NCSC also says exercising should test plans you already have, not create them. CISA’s Tabletop Exercise Packages are designed to help organizations conduct their own exercises, with template objectives, scenarios and discussion questions, and an After Action Report.
This page follows that format. The three scenarios, the injects, the timings and the wording are ours, not CISA’s or the NCSC’s, and are written only from the Commons guides each inject links to. For more scenarios, both agencies’ resources are free.
Before the day
Half an hour of preparation, a week ahead.
Pick one scenario. The one closest to your biggest worry, or the one you have never discussed. One scenario per session.
Have a plan to test. Print your one-page plan from the incident plan builder. If you have none, make it first: an exercise tests a plan.
Invite the right people (see the roles below), and book 90 minutes in a room with a table. Get the agreement of whoever decides, so the actions can happen.
Send the participant sheet a few days before, so people know the ground rules. It has the setup, not the injects.
Adapt the details. Swap in your real mailbox, supplier, systems and job titles. Keep the injects in order.
Bring the printed plan, this facilitator pack, a participant sheet for each player, and a copy of the one-page review template for the close.
Roles
Three jobs, kept separate so nobody has to play and run the room at once.
Facilitator. Runs the session: reads the setup and each inject, asks the questions, keeps time and keeps it blame-free. They do not need to be technical, and they do not play. Ideally someone who would not lead a real response.
Note-taker. Writes down decisions, questions nobody could answer, and anything that was missing: a number, a password, a person, a step. These notes become the findings.
Players. The people who would really be involved, in their real roles: the person who decides and their deputy, whoever looks after systems, whoever handles money, and someone who would deal with staff and the people you serve. Four to eight works well.
Observer (optional). Someone who watches how the group decides rather than what it decides, and speaks only in the review at the end.
Ground rules
Read them aloud at the start.
No blame. The aim is to find gaps in plans, tools and habits, not in people. Thank anyone who says “I don’t know”: that is the finding you came for.
Say it is an exercise. The NCSC suggests starting every exercise message, spoken or written, with “EXERCISE, EXERCISE, EXERCISE” and the exercise name, so nobody mistakes it for a real incident. Tell anyone not in the room that it is happening.
Don’t fight the scenario. Even if it seems unlikely, play it as written. Decide with incomplete information: that is what the first hour of a real incident is like.
Use what you really have. Your printed plan, your real contacts, your real process. If something is missing, say so and note it, rather than inventing it.
Touch nothing real. Do not call emergency or fraud lines, change settings, or contact suppliers during the exercise. Check that a number exists, not that it answers.
Park side questions. The note-taker keeps a list of questions outside the scenario, to come back to.
Running order
About 60 to 90 minutes. Shorten the discussion of each inject, not the review at the end.
A 90-minute running order
Minutes
What happens
0 to 10
Welcome and ground rules. The facilitator says “EXERCISE, EXERCISE, EXERCISE” and the exercise name, explains the roles and reads the ground rules.
10 to 15
The setup. Read the setup aloud. Players have the participant sheet in front of them.
15 to 65
Injects. Read each inject, ask its questions, let the players decide. About 10 to 15 minutes each. Do not reveal the next inject early.
65 to 80
Quick review. What helped, what got in the way, what surprised us. The note-taker reads back the findings.
80 to 90
Actions and close. Agree three to five actions, each with one owner and a date. Say “end of exercise”.
This running order is our suggested format. With a small group, three injects and a 15-minute review fit in an hour.
Scenario 1 of 3Exercise name: Shared inbox
Phishing: someone takes over a mailbox
Aim. Rehearse the first hour and the first day after a password is typed into a fake page: who hears about it, what gets locked down and in what order, and who else needs to know.
Who should be there. Whoever looks after your email and systems, whoever handles money, the person who decides, and a member of staff who uses a shared mailbox every day.
The setup
Read out
“EXERCISE, EXERCISE, EXERCISE. Shared inbox.” It is a Tuesday morning. Your organization has a shared finance mailbox that three people use. At 9:50 one of them receives an email that says “Your mailbox is 98% full” with a button to fix it. They click, a page that looks like your email sign-in opens, and they type the mailbox password. The page then shows an error. Nothing else seems to happen.
Inject 1 of 4About 10 minutes
The report
Read out
At 10:20 the person who clicked finds the office manager and says, quietly, that they think they typed the finance mailbox password into a fake page. They nearly said nothing because they felt foolish. Your IT help is a contractor who works from home.
Ask the group
What do we say to the person who reported it?
Who do we tell, and how: email, phone or in person?
What has to happen in the first hour, and who does each thing?
Who starts writing things down, and where?
What a good answer points to
Thanks for reporting, and no blame: a quick report is the most useful thing anyone can do (the first hour).
Telling whoever looks after your systems straight away, by phone or in person. The NCSC’s first advice for a work device is to contact the IT department.
Your IT contractor looks at the mailbox settings. There is a rule, created at 10:05 this morning, that forwards a copy of every message containing “invoice” or “payment” to an outside address, and moves replies to the RSS Subscriptions folder. The password has not been changed yet.
Ask the group
What do we do first: delete the rule or change the password? Why?
Are there settings only an administrator can see? Who checks those?
What do we keep as evidence before we change anything?
What else on the account should we look at?
What a good answer points to
Checking mail rules and forwarding first, and deleting any you did not create before changing the password: the NCSC’s order for a hacked account (the same day: lock the account down).
Knowing the signs Microsoft lists: forwarding to unknown addresses, and rules that move messages to rarely opened folders such as RSS Subscriptions (checking mail rules and forwarding).
A screenshot of the rule, with the time, before deleting it, and keeping the phishing email (preserving evidence).
Then the recovery details, sign-in methods, app passwords and connected apps: all should be yours.
In the Sent folder you find a message sent from the finance mailbox at 10:12 to four regular partners and suppliers. It says your bank details have changed and asks them to use a new account for future payments. One of them has already replied: “Thanks, updated.”
Ask the group
Who do we contact, how, and what do we tell them?
Could any money already be going to the wrong place? Who checks?
What do we tell our own staff today, and what do we leave out?
Who else might need to know?
What a good answer points to
Warning the people who got the messages to treat them with suspicion and not to act on requests for money (tell your contacts).
Looking for payment-change requests sent from, or answered by, the mailbox, and calling the bank on its official number if money may have moved (banks and payments).
Telling staff the same day, briefly, with no names and nothing still being investigated (what to tell staff).
Phoning partners on numbers you already had, not ones from the email: the same rule as in the callback procedure.
Wednesday, 8:30. The password was changed yesterday and the rule deleted. This morning the account shows a sign-in alert from a device nobody recognizes. Someone mentions that the shared mailbox never had a second sign-in step, “because three people use it”.
Ask the group
What does the alert tell us, and what do we do now?
Which other accounts could be reset through this mailbox, or used the same password?
Who outside the organization should be told, and who decides?
Was any personal information in the mailbox? Who works out what that means for us?
What a good answer points to
Turning on 2-step verification (multi-factor authentication) for the account, then for every email and banking account, and removing sign-in methods you do not recognize (multi-factor authentication).
Watching for the signs in the next 24 hours and giving every linked account the same checks (the next 24 hours).
Working through who to notify: the account provider, the bank, your insurer, the national agency, contacts, and regulators if personal information may have been seen (who to notify; privacy duties, country by country).
Swap in your real mailbox, your real IT help and the real names of roles (not people). The closer it is to how you work, the more you learn.
If the group jumps to “we would just reset the password”, read the second inject: the order of the steps is the point.
Ask whoever uses the shared mailbox how they would report a click today. If the answer is “I’m not sure”, that is a finding.
Scenario 2 of 3Exercise name: Locked files
Ransomware: files will not open
Aim. Rehearse the first hour of a ransomware attack: what to disconnect, who decides, who to call first, whether your backups would get you back, and who might need to be told.
Who should be there. The person who decides and their deputy, whoever looks after your systems and backups, whoever holds the insurance policy, and someone who works with the records of the people you serve.
The setup
Read out
“EXERCISE, EXERCISE, EXERCISE. Locked files.” It is a Thursday at 4:30 in the afternoon. A colleague says the files on the shared drive will not open: their names now end in a strange extension. A text file has appeared in every folder. It says your files have been encrypted and asks for payment.
Inject 1 of 4About 10 minutes
It is spreading
Read out
Two more people say the same. One laptop now shows the payment demand on screen. Someone asks whether to switch everything off at the wall. The director is in a meeting across town and is not answering email.
Ask the group
What do we do with the affected computers, right now?
Who makes decisions while the director is away? Does everyone know that?
If email and chat may be compromised, how do we talk to each other?
Where is our plan, and can we get to it without the network?
What a good answer points to
Disconnecting affected devices from the network, but leaving them switched on: switching off can destroy evidence (the first hour of an incident). The FTC tells businesses to take affected equipment offline but not to turn machines off (preserving evidence).
Moving to a safe channel, such as phone calls, because email and chat may be compromised.
A printed plan that names the incident lead and a deputy who decides when the lead cannot be reached (incident plan builder).
The note gives a deadline of 48 hours and an address to contact. The director calls back and asks whether paying would be the quickest way to reopen tomorrow. Nobody is sure whether you have cyber insurance, or where the policy is.
Ask the group
Who do we call first, second and third? Do we have the numbers on paper?
Do we have cyber insurance? What does it ask us to do, and when?
Who, if anyone, decides about the payment demand, and on whose advice?
What goes in the record now?
What a good answer points to
Calling the insurer first if you have cyber insurance, because many policies require it, then reporting to your national cyber security agency (the first hour).
Your IT help finds that the backup drive was plugged into the server all the time, and its files are encrypted too. There is also a cloud copy. Nobody can remember when anyone last restored something from it.
Ask the group
Which copy of our data could ransomware not reach?
Who can restore from the cloud copy, and how long would it take?
What would we need back first to reopen: files, finance records, settings?
What do we change so the answer is better next time?
What a good answer points to
At least one copy offline, or in a service that prevents deletion for a set period: a backup on a drive that is always connected is not a backup (keep a backup ransomware can’t reach).
A list of what you would need to reopen, where each copy goes and who can restore it, with restore tests on a schedule (backup planner).
The shared drive held a spreadsheet of the names, addresses and phone numbers of people your organization serves. A member of staff asks whether anyone outside needs to be told, and whether to delete the spreadsheet from the laptops that still work.
Ask the group
Could we have a duty to tell anyone? Who would tell us?
This scenario works best with the printed plan on the table. If you do not have one yet, make it with the incident plan builder before the exercise and test that instead.
Players often argue about paying. Do not settle it in the room: note who would decide and on whose advice, and move on.
If your IT help cannot attend, the facilitator reads their part: “I can be there in two hours.”
Scenario 3 of 3Exercise name: New bank details
Payment-change fraud: new bank details
Aim. Rehearse the callback rule under pressure, and what to do in the first hours if a payment has already gone to the wrong account.
Who should be there. Everyone who can enter, approve or change a payment, the person who decides, whoever looks after your email, and whoever would speak to the bank.
The setup
Read out
“EXERCISE, EXERCISE, EXERCISE. New bank details.” It is a Monday morning. An email arrives in the finance inbox from the real address of a supplier you have paid for years. It quotes this month’s invoice correctly and says their bank has changed: please pay the invoice, due today, to the new account in the attached letter. It adds that the contact is travelling and cannot take calls this week.
Inject 1 of 4About 10 minutes
The request
Read out
The person who handles payments reads it out. The letter has the supplier’s logo. The invoice amount is right. The approval queue shows the payment due today.
Ask the group
What, if anything, about this email is a warning sign?
What does our process say happens to a change of bank details?
Who checks, and how?
What a good answer points to
Recognizing the signs: a change of bank details, urgency, pressure not to call, a request that bypasses the normal approval process (warning signs).
Knowing the email can come from the right address and quote a real invoice when the attacker is inside a genuine mailbox (how it works).
Someone replies to the email: “Can you confirm these details are genuine?” Within two minutes a reply arrives: “Yes, confirmed. Please pay today. Your director has approved.” A forwarded message seems to show the director agreeing. The director is on leave.
Ask the group
Is that a confirmation? Why or why not?
Which number do we call, and where does it come from?
Who is the second person who approves the change?
What do we write down, and where is it kept?
What a good answer points to
Looking up the number yourself (from the contract, a previous invoice you paid or the official website), never the number, link or reply address in the message (the callback procedure).
Calling someone you know or can verify, reading back the details, a second person approving, and a written record of who called whom, on which number, when.
The same rule for everyone, including the director, so a genuine request expects a call (a two-person, two-channel rule).
While you talk, a colleague checks the payment system. The invoice was paid to the new account at 9:40, before anyone saw the email: a second, identical request had gone to another colleague, who approved it from the queue.
Ask the group
What do we do in the next ten minutes, and who does it?
Who do we report it to, and where?
What do we keep, and who calls the real supplier?
Who tells the insurer and the board?
What a good answer points to
Calling your bank now on its official fraud number, asking it to recall or reverse the payment and contact the receiving bank: minutes matter (if money has gone: the first hours).
Reporting at once: in the United States to the FBI’s IC3, in England, Wales and Northern Ireland to Report Fraud, in Scotland to Police Scotland, elsewhere to the police and national agency (where to report).
Keeping the emails with full headers, invoices, confirmations and call notes, and warning the real supplier on a number you already had (banks and payments).
The real supplier, reached on the number from your contract, says they sent nothing. Your IT help then finds a forwarding rule in your own finance mailbox that nobody created.
Ask the group
What do we do with our mailbox now?
What do we tell staff, and what changes from tomorrow?
What does the supplier need from us?
What a good answer points to
Assuming the mailbox may be compromised: change the password, sign out all sessions, check forwarding and inbox rules, turn on multi-factor authentication (secure the email account).
Locking the account down in the NCSC’s order, rules first (the same day).
Reading the five-minute briefing to staff and putting the poster up by the finance desk (a five-minute staff briefing).
Use a real supplier’s name (not a real person’s) and your real approval process: the gaps are usually in how approvals actually happen.
The second inject tests whether people trust a reply. Let the group decide before you say anything.
If your organization has never had a callback rule, the main action from this exercise may be to agree one and brief staff.
Close: from findings to fixes
An exercise is only useful if something changes afterwards.
The quick review (15 minutes)
Straight after the last inject, while it is fresh. The note-taker reads back what they wrote, then ask:
What helped? A number that was on the plan, a person who knew what to do.
What got in the way? A missing password, an unclear owner, a step nobody knew.
What surprised us?
Which of these would have mattered most in a real incident?
Actions (10 minutes)
Agree three to five actions. Each has one owner and a date: “everyone” and “soon” are not owners or dates.
Actions from this exercise
Action
Owner
Date
Feed it into the incident review
Write the findings up on the one-page incident review template, as you would after a real incident: the scenario goes under “What happened”, the injects under “Timeline”, and the quick review under “What helped”, “What got in the way” and “What we will change”. Then:
One page per scenario for each player: the setup and the ground rules, not the injects. They print after the facilitator pack, or one at a time from each scenario’s button.
Exercise · Exercise · Exercise
Participant sheetExercise name: Shared inbox
Phishing: someone takes over a mailbox
This is an exercise. Nothing here is really happening.
The situation
It is a Tuesday morning. Your organization has a shared finance mailbox that three people use. At 9:50 one of them receives an email that says “Your mailbox is 98% full” with a button to fix it. They click, a page that looks like your email sign-in opens, and they type the mailbox password. The page then shows an error. Nothing else seems to happen.
The facilitator will read out new information as the exercise goes on. You will not see it in advance.
Your part
Say what you would do, in your real role, with what you know at that moment.
“I don’t know” is a useful answer: it is how we find the gaps. Nobody is being tested or blamed.
Play the scenario as written, even if it seems unlikely. Touch nothing real.
Bring your organization’s incident plan, if there is one, and the phone you would use.
Your notes
Questions you could not answer, and anything that was missing:
This is an exercise. Nothing here is really happening.
The situation
It is a Thursday at 4:30 in the afternoon. A colleague says the files on the shared drive will not open: their names now end in a strange extension. A text file has appeared in every folder. It says your files have been encrypted and asks for payment.
The facilitator will read out new information as the exercise goes on. You will not see it in advance.
Your part
Say what you would do, in your real role, with what you know at that moment.
“I don’t know” is a useful answer: it is how we find the gaps. Nobody is being tested or blamed.
Play the scenario as written, even if it seems unlikely. Touch nothing real.
Bring your organization’s incident plan, if there is one, and the phone you would use.
Your notes
Questions you could not answer, and anything that was missing:
This is an exercise. Nothing here is really happening.
The situation
It is a Monday morning. An email arrives in the finance inbox from the real address of a supplier you have paid for years. It quotes this month’s invoice correctly and says their bank has changed: please pay the invoice, due today, to the new account in the attached letter. It adds that the contact is travelling and cannot take calls this week.
The facilitator will read out new information as the exercise goes on. You will not see it in advance.
Your part
Say what you would do, in your real role, with what you know at that moment.
“I don’t know” is a useful answer: it is how we find the gaps. Nobody is being tested or blamed.
Play the scenario as written, even if it seems unlikely. Touch nothing real.
Bring your organization’s incident plan, if there is one, and the phone you would use.
Your notes
Questions you could not answer, and anything that was missing:
Official sources only. The first three describe the tabletop format; the rest are the sources already cited by the guides each inject links to. Each was opened and checked on 21 October 2026. If something here no longer matches the source, the source wins; please tell us at hello@moraph.org.
An email when we publish a new Commons guide or tool, and occasional news from Moraph for Good. Nothing else, and only when there is something worth sending.