Who would make the decisions if your booking system stopped working tomorrow morning? Now add one complication: the person who normally calls the IT provider is on holiday.
You can explore that question before anything goes wrong. Get the relevant people together and talk through an imagined incident, using the arrangements you already have. Nobody needs to send a fake attack or interrupt a working system.
This is a tabletop exercise. The NCSC's Exercise in a Box offers free resources for rehearsing cyber incident responses, including discussion exercises. Our shorter meeting plan below is a suggested starting point for a small business, not an official exercise or certification requirement.
Have a basic plan to practise
Before the meeting, gather your incident contacts and existing response instructions. If those don't exist yet, first agree who coordinates an incident, who can authorise business decisions and how people contact support. That's planning work you need before a rehearsal can meaningfully test it.
The NCSC's exercise creation guidance distinguishes testing existing plans from creating them. It also recommends clear objectives and following up what you learn.
For this first session, set one objective: find out whether you can coordinate a response when your normal system and usual contact are unavailable. Leave detailed technical recovery for a separate exercise.
Invite the business decision-maker, someone who uses the affected service and your IT contact where practical. In a very small firm, one person may cover several roles. Write those roles down so an absent person doesn't accidentally disappear from the discussion.
Make it safe to discuss the awkward bits
Book 30 minutes at a quiet point in the week. One person reads the scenario and watches the time. Another records decisions and gaps, if you have enough people.
Tell everyone that this is a discussion only. Don't disable accounts, disconnect equipment, restore backups, send customer messages or call emergency services as part of it. Use fictional names and clearly mark every example message as an exercise.
Keep passwords, real customer information and sensitive security details out of the shared notes. Discuss where authorised people would find protected information without copying it into the meeting document.
Agree how to stop the session if a real issue arises. People should never have to guess whether an alarming message is part of the exercise.
Minutes 0 to 5: agree what you know
Try this invented situation: “It's 9am. Staff at our fictional repair shop can't open the booking system. Two customers are waiting. Nobody knows whether the problem is with our computers, the supplier or an account.”
Ask the group to describe the first things it needs to establish. Keep confirmed facts separate from guesses. “We can't sign in” is a fact in this scenario. “We've been hacked” hasn't been established.
Then ask who takes charge of coordinating the response. Listen for an actual role and a deputy, rather than “someone in management”. Record any disagreement so you can resolve it after the exercise.
Minutes 5 to 15: introduce the missing person
Add the complication: the usual IT contact is away, and the supplier's support details are saved inside the unavailable booking system.
Ask where the team would find a trusted support number now. Can an authorised colleague access it? Who has permission to request help or approve paid assistance?
Don't make a live support call during the exercise. Record what needs checking afterwards through the proper contact.
Next, ask how the team would communicate if work email also became unavailable. Name the agreed alternative and how people would recognise a genuine instruction. Avoid accepting “we'll use our phones” without deciding which number or channel staff would use.
Minutes 15 to 23: deal with the waiting customers
Bring the discussion back to the two customers at the desk. What can the team safely tell them? Who decides whether to pause new bookings, and what information would they need to make that decision?
Ask someone to draft two sentences for staff to use. In this fictional situation, the message should describe the service problem and when another update is expected. It shouldn't invent a cause or promise that no information has been affected.
Discuss any temporary way of recording work. If the suggestion is a paper list or another approved tool, ask who protects it, who can use it and how records will later be reconciled. A workaround that creates conflicting bookings may prolong the disruption.
Minutes 23 to 30: choose the fixes
Finish by selecting the most useful gaps to resolve. Give each action an owner and a date. “Improve communication” is vague. “Store the approved support contact sheet where the deputy can access it without the booking system” is something somebody can complete.
Keep the exercise result honest. A clear discussion shows that people could explain their intended response. It doesn't prove the backup restores, the support number works or every system can recover. Arrange those separate checks where needed.
If this format helps, set aside another short session next month and confirm that the earlier actions were finished. That monthly rhythm is our practical suggestion, not a mandated frequency.
For a fuller rehearsal, choose a suitable scenario from the NCSC's tabletop exercise collection, then allow the time its materials require. A useful session ends with fewer unanswered questions and changes somebody owns, not just a calendar entry saying training happened.