Home / Commons / Ten-minute drills

Toolkit · Security

Ten-minute security drills for staff meetings.

Eight short drills a small organization can run itself, one habit at a time: spot the payment-change email, check sign-in protection, restore a file, find the plan. Each card links to the full guide.

Free to print and adapt8 drillsLast reviewed October 2026

How to run a drill

One habit per meeting, practiced together, with no blame.

  • Pick one drill per meeting. Each practices one habit and takes about ten minutes. Run them in any order; the same drill again a few months later shows what changed.
  • One person leads. They read the aim, run the steps, keep time and ask the debrief question. They do not need to be technical: each card links to the guide that explains it.
  • No names, no blame. The aim is to find gaps in how you work, not in people. Thank people who admit they were not sure: that is the finding.
  • End with one action. One owner and a date, written where you will see it again, such as the next meeting’s agenda.
  • Practice safely. Restore to a new place, never over the original. Check numbers against documents instead of calling an emergency line. Never send practice phishing emails without the sign-off and ground rules in the phishing drill kit.

The format follows the UK National Cyber Security Centre’s micro exercises: short exercises, each focusing on a single subject, in its free Exercise in a Box resource. The NCSC sees exercises as a cost-effective way for an organization to find out how well it would cope with a cyber incident. Exercise in a Box also has tabletop exercises: group discussions of an unfolding cyber incident, for when you have longer. Our run-it-yourself incident exercise has three.

The drills, steps and timings are our suggested format, written from the Commons guides each card links to. They are not NCSC exercises. Each drill prints on its own page: use the print button at the top, or your browser’s Print command.

Drill 1 of 8About ten minutes

Spot the payment-change email

Aim. Everyone can spot a request to change bank details, and knows the callback rule that stops payment-redirect fraud.

You need

  • The training example “Updated bank details for invoice payment” from the phishing drill kit, on screen or printed.
  • Your list of supplier phone numbers, or the name of the place it is kept.

Steps

  1. Show the example. Give everyone a minute to say what looks wrong.
  2. Compare with the warning signs in the payment fraud toolkit: a change of bank details, pressure to act today, a request that bypasses your normal approval process.
  3. Walk through the callback procedure: stop, look up the number yourself (from the contract, a previous invoice you paid or the official website, never the message), call and read back the details, have a second person approve, and write it down.
  4. Agree who the second person is for payment changes, and where the record of each call is kept.

Debrief

If a supplier emailed us new bank details this afternoon, who would make the call, and which number would they use?

Then agree one action, with one owner and a date.

The full guide: The callback procedure, in the payment fraud toolkit moraph.org/commons/payment-fraud#callback

Source: FBI Internet Crime Complaint Center (IC3), Business Email Compromise.

Drill 2 of 8About ten minutes

Check multi-factor authentication on the shared inbox

Aim. Know whether every email account, including shared and role mailboxes, needs a second step after the password.

You need

  • Whoever administers your email, with the admin settings open.
  • A list of your shared and role addresses, such as info@ or finance@, including any a volunteer set up.

Steps

  1. List every email account the organization uses, starting with the shared ones and whoever handles money.
  2. For each one, the administrator checks whether 2-step verification (multi-factor authentication) is on. Mark yes, no or not sure.
  3. Where it is on, look at the sign-in methods and devices listed. Microsoft advises removing any you do not recognize: an attacker may have added their own.
  4. For every “no” or “not sure”, agree one owner and a date to turn it on.

Debrief

If someone learned the password to our busiest shared mailbox today, what would stop them signing in?

Then agree one action, with one owner and a date.

The full guide: Multi-factor authentication, in After a phishing click moraph.org/commons/after-a-phishing-click#mfa

Source: CISA, More than a password: multifactor authentication; UK National Cyber Security Centre, Small organisations guide: secure your email; Microsoft, Respond to a compromised email account in Microsoft 365.

Drill 3 of 8About ten minutes

Test restoring one file

Aim. Prove that a backup works by restoring one real file, and find out how long it takes.

You need

  • The person who can restore from your backups.
  • One real file someone used recently, and a safe place to restore it to that is not over the original.
  • The restore-test log from the backup planner, or the backup and restore log template.

Steps

  1. Pick a file together: something real you would miss if it were gone.
  2. Start a timer. The person who can restore it brings it back from the backup to the safe place, without overwriting the original.
  3. Open it. Check it is complete and the version you expected.
  4. Note which copy it came from, and whether that copy is out of reach of ransomware: offline, or in a service that prevents deletion for a set period.
  5. Write it in the restore-test log: the date, what was restored, from which copy, how long it took and whether it worked.

Debrief

If that file had been everything we needed to reopen, how long would it have taken, and what would we have been missing?

Then agree one action, with one owner and a date.

The full guide: Backup planner and restore-test log moraph.org/commons/backup-planner

Source: CISA, #StopRansomware guide (backups: offline, encrypted, tested); UK National Cyber Security Centre, Small business guide: backing up your data.

Drill 4 of 8About ten minutes

Find the incident plan and the out-of-hours numbers

Aim. Everyone knows where the printed incident plan is, who decides, and that the numbers on it can be reached out of hours.

You need

  • Your printed one-page incident plan, if you have one.
  • A phone.

Steps

  1. Ask where the printed plan is, and have someone fetch it without using a computer. If nobody can, that is today’s finding: make one with the incident plan builder.
  2. Read out the incident lead and the deputy. Check the deputy knows they are the deputy.
  3. Check each number on the plan against the insurer’s policy, the IT contract, the bank’s official website and the national agency’s website: is it current, and can it be reached from a mobile phone out of hours?
  4. Check how you would reach staff without email, and that everyone has that contact on their phone.
  5. Write today’s date on the plan and correct anything that changed. The Canadian Centre for Cyber Security says to test, revisit and revise your plan annually.

Debrief

If our email were down tonight, who would you call first, and is that number on your phone now?

Then agree one action, with one owner and a date.

The full guide: Incident plan builder moraph.org/commons/incident-plan

Source: Canadian Centre for Cyber Security, Developing your incident response plan (ITSAP.40.003).

Drill 5 of 8About ten minutes

Report a suspicious message

Aim. Everyone knows how to report a suspicious message here, and that reporting a click is always welcome.

You need

  • One training example from the phishing drill kit, such as “Your mailbox is 98% full”, on screen or printed.
  • Your organization’s reporting route, written down: who to tell, and how.

Steps

  1. Ask the room how they would report a message that looked wrong. Write the answers down: different answers are the finding.
  2. Show the training example and ask what made it suspicious.
  3. Agree the route: tell whoever looks after your systems straight away, by phone or in person. The NCSC’s first advice for a suspicious message on a work device is to contact the IT department.
  4. Each person finds the report button in their own email program, as CISA suggests. In the United Kingdom, suspicious emails can also be forwarded to report@phishing.gov.uk.
  5. Say it plainly: if you clicked, report it anyway. A quick report is the most useful thing anyone can do, and nobody will be in trouble for it.

Debrief

What would make someone here hesitate to report a click, and what can we change so they don’t?

Then agree one action, with one owner and a date.

The full guide: Who to notify, in After a phishing click moraph.org/commons/after-a-phishing-click#notify

Source: UK National Cyber Security Centre, Phishing: I’ve received a suspicious message; CISA, Recognize and report phishing; UK National Cyber Security Centre, Report a scam email.

Drill 6 of 8About ten minutes

Check who still has access

Aim. The people who can get into one important system are the people who should.

You need

  • The administrator of one system you rely on (the shared inbox, finance system, shared drive or donor database), with its list of users and administrators.
  • A current list of staff and volunteers.

Steps

  1. Choose one system for today. Show or print its list of users and administrators.
  2. Read it against your current staff and volunteers. Mark anyone who has left or changed role.
  3. Count the administrators. The field guide suggests keeping that number as small as you can, and writing down who they are.
  4. For a shared account, check its recovery email addresses and phone numbers, sign-in methods and connected apps, as in the NCSC’s steps for a hacked account: they should all be yours.
  5. Agree who removes each leftover account and changes any shared password the person knew, and by when.

Debrief

Which system should we check at the next meeting, and who can bring its list?

Then agree one action, with one owner and a date.

The full guide: Security basics: remove access the day someone leaves moraph.org/commons/security-basics#leavers

Source: UK National Cyber Security Centre, Recovering a hacked account.

Drill 7 of 8About ten minutes

Run the email security check

Aim. Know whether the public records that stop people sending email in your organization’s name are in place, and who can fix them.

You need

  • A screen with an internet connection.
  • Your email domain: the part after the @ in your address.
  • If you can, whoever manages your domain (often your domain registrar or web host).

Steps

  1. Open the email security check and enter your domain. It reads public DNS records only.
  2. Read the results aloud: SPF, DKIM, DMARC, MTA-STS and TLS-RPT. The fix-it guide explains each in plain words. Not finding a DKIM key does not mean DKIM is missing.
  3. List every service that sends email as your domain: your email platform, newsletter tool, donor or client database, website forms, finance and payroll. Ask each team; they often signed up on their own.
  4. Write down where your domain’s DNS is hosted, who can change it, and who will work through the fix-it guide, by when.

Debrief

Which service sends email in our name that nobody here knew about?

Then agree one action, with one owner and a date.

The full guide: Email security check and fix-it guide moraph.org/commons/email-check#fix

Source: UK National Cyber Security Centre, Email security and anti-spoofing.

Drill 8 of 8About ten minutes

Walk the first-hour checklist

Aim. Everyone knows the first steps if something looks wrong, before anyone needs them.

You need

  • The first-hour checklist from the security field guide, printed.
  • Your incident plan, if you have one.

Steps

  1. Read a scenario aloud: “It is late on a Friday. A colleague says files on the shared drive will not open, and a message on screen asks for payment.”
  2. Ask what you would do first, then compare with the checklist: disconnect affected devices from the network but leave them switched on. The FTC tells businesses to take affected equipment offline but not to turn machines off.
  3. Ask how you would talk if email and chat may be compromised. Agree the safe channel, such as phone calls.
  4. Ask who you would call, in what order. The checklist says your insurer first if you have cyber insurance, then your national cyber security agency. Find both numbers.
  5. Ask who writes down what happened and when. Agree who keeps the incident log.

Debrief

Which step would we have got wrong today, and what one change fixes it?

Then agree one action, with one owner and a date.

The full guide: The first hour of an incident, in Security basics moraph.org/commons/security-basics#first-hour

Source: US Federal Trade Commission, Data breach response: a guide for business.

Sources

Where this comes from.

Official sources only. The first two describe the micro-exercise format; the rest are the sources already cited by the guide each drill links to. Each was opened and checked on 21 October 2026. If something here no longer matches the source, the source wins; please tell us at hello@moraph.org.

Last reviewed October 2026

  1. UK National Cyber Security CentreExercise in a Box: overviewwww.ncsc.gov.uk/section/exercise-in-a-box/overview
  2. UK National Cyber Security CentreExercise in a Box: micro exerciseswww.ncsc.gov.uk/section/exercise-in-a-box/micro-exercises
  3. FBI Internet Crime Complaint Center (IC3)Business Email Compromisewww.ic3.gov/CrimeInfo/BEC
  4. CISAMore than a password: multifactor authenticationwww.cisa.gov/MFA
  5. UK National Cyber Security CentreSmall organisations guide: secure your emailwww.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/secure-your-email
  6. MicrosoftRespond to a compromised email account in Microsoft 365learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account
  7. CISA#StopRansomware guide (backups: offline, encrypted, tested)www.cisa.gov/stopransomware/ransomware-guide
  8. UK National Cyber Security CentreSmall business guide: backing up your datawww.ncsc.gov.uk/collection/small-business-guide/backing-your-data
  9. Canadian Centre for Cyber SecurityDeveloping your incident response plan (ITSAP.40.003)www.cyber.gc.ca/en/guidance/developing-your-incident-response-plan-itsap40003
  10. UK National Cyber Security CentrePhishing: I’ve received a suspicious messagewww.ncsc.gov.uk/section/respond-recover/phishing
  11. CISARecognize and report phishingwww.cisa.gov/secure-our-world/recognize-and-report-phishing
  12. UK National Cyber Security CentreReport a scam emailwww.ncsc.gov.uk/collection/phishing-scams/report-scam-email
  13. UK National Cyber Security CentreRecovering a hacked accountwww.ncsc.gov.uk/guidance/recovering-a-hacked-account
  14. UK National Cyber Security CentreEmail security and anti-spoofingwww.ncsc.gov.uk/collection/email-security-and-anti-spoofing
  15. US Federal Trade CommissionData breach response: a guide for businesswww.ftc.gov/business-guidance/resources/data-breach-response-guide-business

Need more than a drill?

Every card links to a free Commons guide or tool. If your organization needs hands-on help, apply to one of the Moraph for Good programs. A person reads every application.

Apply to Moraph for Good