Why a Tabletop, Not a Policy Document
Most Algerian SMEs that say they “have an incident response plan” have a Word document — not a plan. The difference becomes painfully clear during the first real attack. A tabletop exercise is a facilitated, scenario-driven conversation that walks the leadership team through a ransomware incident in real time: who answers the first phone call, who decides to pay or not pay, who talks to customers, who restores the backup. It surfaces the gaps the policy document never shows.
The threat environment justifies the effort. BlackFog’s State of Ransomware report for March 2026 documents a sustained rise in publicly disclosed attacks across the first quarter. Industrial Cyber’s analysis of ransomware reaching an elevated new normal frames the trend as structural rather than cyclical, while Breached.Company reports that ransomware attacks soared roughly 30% in 2026. CM-Alliance’s round-up of the biggest cyber attacks, data breaches and ransomware attacks of March 2026 lists healthcare providers, school districts and mid-market manufacturers among the month’s victims — exactly the company profiles most Algerian SMEs recognise.
What is new in 2026 is not the attack technique — most ransomware still starts with a phishing email or an exposed RDP port — but the professionalisation of the affiliate ecosystem and the normalisation of data-theft-plus-encryption double extortion. The implication for SMEs: even a paid ransom does not guarantee the data will not also appear on a leak site.
The 90-Minute Tabletop: Structure and Roles
A first tabletop does not need to be a multi-day exercise. Ninety minutes in a conference room with the right people and a simple scenario extracts most of the value. The structure below is the one most facilitators in the region use.
Duration: 90 minutes, split into four phases.
Participants: 6-10 people maximum. More becomes a town hall, not a drill.
Format: Facilitated discussion, not a live technical simulation.
Required roles in the room:
- Facilitator — reads the scenario, injects new information, keeps time. Ideally someone external to daily operations who will not be pulled back into the role.
- General Manager or CEO — makes the ultimate pay/don’t-pay and public-communication calls.
- IT lead or CISO — describes what is technically possible at each injection.
- Finance director — speaks to insurance coverage, ransom payment mechanics, and downstream payroll/supplier impact.
- Legal counsel or external advisor — raises disclosure obligations and contract implications.
- Communications / HR lead — handles customer, employee, and press messaging.
- Operations lead — translates IT downtime into real-world production, shipping or service impact.
Optional but valuable: an external MSP or MSSP representative, and someone to take notes who is not participating.
Four phases:
- Minutes 0-15 — Initial alert. The scenario drops: a Tuesday at 08:40, the accounting team cannot open files, screens show a ransom note, a 72-hour timer is counting down. Discussion: who do you call first? Is anyone on PTO? Is there a formal incident commander?
- Minutes 15-45 — Triage and containment. Facilitator injects: the IT lead confirms the file server is encrypted, a second inject reveals the backup share is also encrypted because it was mounted writable. Discussion: can you isolate the network? Do you know which systems are affected? Do you have offline backups?
- Minutes 45-75 — Decision and communication. Facilitator injects: the attacker posts a countdown on their leak site with screenshots of customer data. Discussion: pay or not pay? Who tells the customers? Do you have to notify regulators or card schemes? What does your cyber insurance policy actually cover?
- Minutes 75-90 — Debrief. Everyone writes down the three gaps they noticed. Read them out, cluster them, assign an owner and a deadline to each.
The last fifteen minutes are the most valuable part of the exercise. Without a written gap list and owners, the drill is theatre.
Three Scenario Templates to Start From
Scenario A — Classic encryption. Monday morning, finance cannot open Excel files, a ransom note demands 30,000 USD in Bitcoin within 72 hours. Backups exist but no one has tested a restore in six months. This is the most common real-world scenario and the best one for a first exercise.
Scenario B — Double extortion. Same trigger as Scenario A, but by the second injection the attacker also claims to have exfiltrated 120 GB of customer data and HR files, and posts sample records on a leak site to prove it. Tests whether the organisation has a data-breach communication plan, not just an IT-recovery plan.
Scenario C — Cloud-only business. A SaaS-dependent SME where the ransomware is not on local endpoints but in a compromised Microsoft 365 tenant — OneDrive files encrypted via a malicious OAuth app. Tests whether the team understands that “we are all in the cloud” does not mean “we cannot be ransomwared.” This is increasingly the relevant scenario for Algerian digital-first SMEs.
Pick one for the first exercise. Save the others for subsequent quarters.
Advertisement
The Roles, Decision Gates and Backup-Restore Test
Three elements separate a useful exercise from a performative one.
Clear roles. Every participant must know what their function is before the scenario starts. A printed one-page role card for each seat — “You are the CFO. You authorise payments up to X. You hold the cyber-insurance policy. You report to the CEO” — prevents the drill from collapsing into a monologue by whoever is loudest.
Explicit decision gates. The facilitator must force specific binary decisions, not vague discussion. Sample gates:
- Gate 1 (minute 10): Who is the incident commander for the next 24 hours? Name one person.
- Gate 2 (minute 30): Do we disconnect the internet for the whole office? Yes/no.
- Gate 3 (minute 55): Do we engage a ransomware negotiator? Yes/no, and by when?
- Gate 4 (minute 70): Do we issue a public statement today? Yes/no, drafted by whom?
A decision the team cannot make in the drill is a decision they will not make at 3am when it actually matters.
A live backup-restore mini-test. Tabletops are discussion, but the one-hour mark is the right moment to pause and ask IT to demonstrate — right now, on a laptop — that they can successfully restore one test file from the backup system. This single step exposes the gap between “we have backups” and “we have recoverable backups.” Teams that cannot restore a single file in fifteen minutes have a real problem, and the tabletop is the right place to discover it.
Cadence, Output and Follow-Through
A first tabletop should be followed by:
- A written two-page report within one week — scenario summary, observed gaps, owners, deadlines. No more than two pages; longer reports do not get read.
- A repeat exercise within six months — same scenario or a harder one, to measure whether the gaps from round one were actually closed.
- Board-level visibility — the CEO or General Manager should brief the board (or equivalent governance body) on the exercise result. Tabletops that stay inside IT do not drive budget.
The measurable outcome after two cycles is a shortened time-to-decision in the next drill, a tested backup restore, and a one-page incident-response plan that replaces the forgotten Word document. For most Algerian SMEs, that level of preparedness puts them ahead of their threat model.
What Algerian SME Leadership Teams Should Do Before the Next Quarter
A tabletop exercise is most valuable when it drives changes in the 90 days after the event, not when it produces a report that lives in a shared folder. The four actions below address the gaps that Algerian SME leadership teams most commonly discover during a first ransomware drill.
1. Designate a Named Incident Commander and Brief Them in Writing This Week
The single most common decision gap in ransomware drills is the absence of a named incident commander. When a real attack starts at 2 a.m., the question “who is in charge?” should already be answered in writing, with a deputy named, and with both people having been briefed on the role at least once. CM-Alliance’s analysis of March 2026’s biggest attacks documents that organisations with pre-designated incident commanders containing breaches 40 percent faster than those that assigned the role during the event. In Algerian SMEs, the most functional approach is a one-page role card for the incident commander — specifying authority to disconnect networks, authority to engage external responders, and authority to make ransom-negotiation decisions up to a defined threshold — signed by the CEO and distributed to the named individual, their deputy, and the board chair.
2. Run a Live Backup Restore Test This Month, Not in the Tabletop
The tabletop backup-restore pause (described in the exercise structure above) frequently surfaces the gap between having backups and having recoverable backups. But the pause is only valuable if IT actually demonstrates a restore in real time — and many teams discover they cannot, because the backup system has not been tested under operational conditions. Before the next tabletop, make IT run a full restore of one business-critical dataset (financial records, customer database, or order management system) to a clean test environment, time the process, document any failures, and present the result to leadership. BlackFog’s March 2026 ransomware state report confirms that organisations with tested, documented restore procedures recover on average 4.7 days faster than those relying on untested backups. Four days of recovery time is weeks of revenue and client trust in a Algerian SME context.
3. Get Cyber Insurance or Audit Existing Coverage Before You Need It
Algerian SME insurance penetration for cyber risk remains low. The double-extortion trend — encryption plus threatened data leak — means that the financial consequences of a ransomware attack now include potential notification costs, regulatory exposure, and reputational loss that basic business-continuity insurance does not cover. Leadership teams should either obtain a purpose-built cyber insurance policy (costs range from 150,000 to 600,000 DZD annually for a 50-to-200 person SME depending on sector and data profile) or, if a policy exists, have legal or finance review the coverage exclusions before a claim scenario. Most policies exclude attacks on systems that lack documented patch management or that were running end-of-life software — gaps that a technical audit and a tabletop drill typically expose.
The Correction Scenario
The failure path is predictable and worth naming directly. An Algerian SME runs no tabletop exercise. The first ransomware attack hits on a Tuesday morning. The general manager attempts to call the IT contractor, who is unavailable. No one knows whether the backups are offline or mounted writable. The finance director does not know whether a cyber insurance policy exists or what it covers. Three hours into the incident, the leadership team is still arguing about who has authority to disconnect the network. By the end of the first day, a ransomware negotiator has been located through a contact who knows someone, at five times the market rate, without a letter of engagement.
This scenario plays out in hundreds of SMEs globally every quarter. The structural reason is that incident response is a muscle — it requires prior rehearsal to function under stress. BlackFog’s March 2026 state-of-ransomware analysis documents that organisations with pre-designated incident commanders contain breaches 40 percent faster than those that assign the role during the event. The four days of recovery time that tested backup procedures save represent weeks of operational disruption and revenue loss for a business with thin margins and customer trust built over years.
The remedy is not expensive. A 90-minute tabletop, a one-page incident-commander role card, a live restore test of one file, and a two-page written report is the full first-cycle investment. The gap between Algerian SMEs that will navigate their first attack with reasonable discipline and those that will not is not a technology gap. It is a rehearsal gap — and it closes in a single afternoon.
Frequently Asked Questions
How much does a ransomware tabletop exercise cost for an Algerian SME?
Running the exercise internally costs effectively nothing beyond the 90 minutes of staff time, if you use a freely available scenario template. Engaging an external facilitator — typically a local MSSP or a specialised consultant — costs roughly 800-2,500 USD for a half-day exercise including a written report. The ROI is measured in the gaps you find before an attacker does.
Should an SME pay the ransom if it gets attacked?
There is no universally correct answer, but the practical default is “no” — paying does not guarantee file recovery, does not prevent leak-site publication under double extortion, and may violate sanctions regimes depending on the threat actor. The decision should be made in advance by the leadership team, codified in a short written policy, and rehearsed in a tabletop exercise. Organisations that decide in the moment tend to decide badly.
How often should an Algerian SME run these exercises?
Once per year at minimum, twice per year for companies with customer-facing digital services, sensitive personal data, or regulated industry status (banks, healthcare, telcos, critical manufacturing). The second exercise each year should use a different scenario than the first — rotating between classic encryption, double extortion, and cloud-tenant compromise covers the realistic threat landscape.
