Most SMEs have an "incident plan" in a PDF that nobody has opened since it was written. A tabletop exercise is the cheapest way to find out whether that plan means anything — before the day of the attack tells you for free.
Tabletop isn't a technical drill. Nobody unplugs anything, nobody restores a backup, nobody calls the cyber insurer's hotline. Everyone sits in a conference room, receives a scenario on paper, and says out loud what they would do in the first minutes of an attack. It takes 90–120 minutes. It costs one afternoon. And it exposes more holes than a full paper audit.
Why the paper plan isn't enough
In one of our projects, a 30-person wholesaler distributing industrial parts had a 22-page business continuity plan built around Comarch Optima and an in-office file server. The document was fresh, signed, sitting in a binder on the shelf. We invited the owner, the head accountant, the operations manager and the IT admin to a two-hour tabletop. Scenario: Friday 14:00, ransomware note on five workstations, network drives encrypted too.
Within the first 20 minutes, four things surfaced that weren't in the plan:
- The cyber insurer's phone number was in Outlook, which was busy encrypting itself.
- The admin who was the only person knowing the backup console password was on holiday in Greece that week.
- Nobody knew who had authority to disconnect the office internet — the router was hosted by the ISP, and the login/password were "somewhere in an email from 2021".
- The Comarch Optima database sat on a network share that was also mounted as a drive letter on the salespeople's workstations — so the ransomware was encrypting it as an
.mdffile, not as a database.
The paper plan said "disconnect infected stations, restore from backup". It didn't say who does that on a Friday at 14:07, with the owner out of the country.
What a tabletop is
A tabletop exercise is an incident simulation run as a conversation. A facilitator reads out a scenario — usually ransomware, a data leak, or loss of access to a critical SaaS. Participants answer questions: "It's 14:03. The accountant calls, her Excel won't open and shows a ransom note. What do you do as the first person the call reaches?". And so on for two hours, act by act.
It's not a knowledge test. Nobody gets graded. The point is that people, for the first time in their careers, together rehearse the decisions they very much hope not to face live. And that gaps come out that would never surface on a calm Monday morning.
Who belongs in the room
For a 20–50 person SME the minimum set is five people:
- Owner or CEO. They decide about paying the ransom, halting production, advancing payroll when HR is down. Without them it's theatre.
- The IT person (in-house or your outsourcing provider). Knows the infrastructure, backups, admin accounts.
- Head accountant or the person owning finance. Knows personal data, knows what invoices must go out on Friday, knows where the insurance policy is.
- Someone from operations — warehouse, production, customer service manager. Knows what stops if the ERP goes down.
- Facilitator — ideally external. Cannot be someone who then performs the response themselves, because they will defend their own plan.
Don't invite everyone. Fifteen people in the room is not a tabletop, it's a meeting.
A scenario that actually hurts
A good scenario is not Hollywood. It is painfully ordinary. The one we most often use for an SME running Comarch Optima / enova365 / Subiekt:
Friday, 14:03. The accountant calls IT: "Optima won't let me in, there's a red popup in English". A salesperson pings on Teams: "Folks, a file called HOW_TO_DECRYPT.txt just appeared on my desktop". Within 10 minutes, identical reports from 6 other stations. Warehouse cameras are working. Email is working. But the printers won't print invoices.
The facilitator asks questions minute by minute:
- 14:04 — who decides that this is an incident? Very common gap: the first person sees it, thinks "probably Optima acting up", calls Optima support, loses 40 minutes.
- 14:15 — who disconnects the network? Physically, cable out. Seriously, who has the key to the rack?
- 14:30 — who calls the insurer? Number? Hours? Does the policy require notification within 24 or 72 hours?
- 15:00 — does the backup actually work? When was the last restore test — not "is the file there", but full recovery to a test machine?
- 17:00 — Monday morning, can we still pay salary advances if the HR/payroll system is not back? Who has bank access if the token was on one laptop only?
- Tuesday — what do we tell customers? Who drafts the message? Are we obliged to notify the data protection authority (72 hours in the EU)?
There are no "correct" answers. The point is that at each of these questions someone in the room looks at someone else and says: "I thought you knew that".
Recurring gaps
After a dozen or so tabletops in SMEs, we see the same patterns:
- The backup key in one person's head. Admin on holiday = no access.
- Contact numbers stored in email — which the attack is encrypting. You need a printout or a separate channel (Signal, personal phones).
- No clear decision path on ransom. The owner "will read up online". The insurer expects a consult with their legal team in hours, not days.
- Nobody knows how much the company loses per hour of downtime. Without that number, every prioritisation call is a guess.
- The person responsible for internal and external communication is the same person doing the technical response.
Every gap goes on a list with an owner and a deadline. That's the entire value of the exercise.
Follow-up — without it the whole thing was wasted
Within a week of the tabletop:
- Compress the incident plan down to one A4 sheet ("what I do in the first hour, who I call, where the phone list is").
- Print it. Really. Paper, in a binder, in reception and at the owner's home.
- Put critical phone numbers outside company email (printed list, Signal, personal mobiles).
- Schedule one real backup restore within 30 days. Not verifying that the file exists — a full restore of the Optima database to a test machine, with someone logging in and running a report.
- Establish a second person for the admin account on the backup console (the two-key rule).
- Book the next tabletop 6–9 months out with a different scenario (data leak, CEO email compromise).
When to bring in an outsider
The first tabletop in a company is best facilitated by someone external who knows scenarios from the market and has no emotional attachment to any element of the plan. Internal IT will naturally defend their own decisions from two years ago. An outside facilitator can calmly say "that procedure won't work on Friday at 14:07" and nobody takes offence.
Subsequent tabletops you can run yourself — you have a scenario, you have notes from the previous round, you have practice. The real trick is starting at all, instead of waiting for ransomware to ask whether you're ready.
A paper incident plan tests itself the moment you actually need it. That's always too late.