A ransomware crew doesn’t need to break into your ERP to stop your plant. One encrypted file server, one locked MES database, or one line that won’t start is enough to halt shipments for a week. For a mid-market manufacturer, that week usually costs more than the ransom note asks for.
Most plants already own the parts of a defense. There are backups somewhere, an endpoint tool on most machines, an insurance policy in a drawer, and an incident response plan that someone updated 2 years ago. What almost nobody owns is proof that those parts work together at 2 a.m. on a Saturday, when the maintenance lead is the only person answering a phone. A ransomware tabletop exercise gives you that proof before an attacker charges you for it.
This guide walks through the full cycle. You’ll get the threat picture for manufacturing, a scenario that feels like your own plant, the roster for the room, an agenda with timed injects, the decisions worth rehearsing, and a method for turning findings into funded work. It’s written for companies with 100 to 2,000 employees, 1 to 10 sites, and an IT team small enough that the same 3 people run the help desk, the network, and security.
TL;DR
· Ransomware remains one of the most reported threats against US critical infrastructure, and critical manufacturing sits near the top of the list every year.
· A ransomware tabletop exercise is a discussion drill. No systems are touched, so you can rehearse the ugly decisions safely.
· Plans fail on 4 things: who decides, how to reach people when email is down, what order systems come back in, and whether anyone has actually tested a restore.
· Put 10 to 14 people in the room, including plant operations, finance, legal, HR, and 1 executive who can spend money.
· Run 90 to 120 minutes with 4 injects. Score the gaps, write an after-action report within 5 business days, and assign owners and dates.
· Repeat 2 to 4 times a year, and change the scenario each time so people can’t coast on memory.
Why Ransomware Keeps Landing on Mid-Market Manufacturers
Attackers pick targets by tolerance for downtime, and few businesses tolerate it worse than a plant with a production schedule and penalty clauses. The FBI’s Internet Crime Complaint Center logged 3,611 ransomware reports in 2025, with more than $32 million in directly reported losses, and its 2025 Internet Crime Report again placed critical manufacturing among the hardest hit critical infrastructure sectors. That loss figure excludes lost production, wages, and recovery labor, which is where the real damage sits for a manufacturer.
Size is part of the story. Mid-market manufacturers carry enterprise-grade exposure with small-business staffing. You have flat networks that grew by acquisition, remote access for machine vendors, a 15-year-old PLC that can’t be patched, and 1 security-aware person who also owns Microsoft 365. That mix is attractive and common.
The business model of the attackers matters too. Groups like Akira, Qilin, Lynx, BianLian, and Play use ransomware or extortion. Some groups combine encryption with data theft and then threaten to publish drawings, contracts, and employee records if you restore from backup and refuse to pay. Others, including BianLian, have shifted to exfiltration-only extortion. Clean backups reduce the encryption problem. They do nothing about the leak site.
Customers have noticed. Automotive and aerospace buyers now ask suppliers for evidence of tested response plans, not just a signed questionnaire. Ransomware readiness is now part of the commercial conversation, and that pressure is the practical reason many firms pair managed cybersecurity services with a real exercise program, because a tier 1 customer audit asks what you did last quarter, not what your policy says. Manufacturing cybersecurity has become a commercial requirement as much as an IT one.
What a Ransomware Tabletop Exercise Actually Is
A ransomware tabletop exercise is a facilitated conversation. People sit in a room, a facilitator describes a situation, and participants talk through what they’d do, who they’d call, and what they’d decide. Nothing gets unplugged. No system is touched. The cost is a few hours of calendar time.
That format has a long federal pedigree. NIST’s Guide to Test, Training, and Exercise Programs separates discussion-based exercises from functional ones, and it defines the supporting roles: a facilitator who runs the discussion, a data collector who captures issues, and a debrief that feeds the after-action report. Those 3 roles are the difference between a drill and a meeting.
Know what the format can’t do. A tabletop won’t tell you whether your backups restore, whether your EDR agent blocks a specific loader, or how long a 4 TB SQL restore takes over a saturated link. Those are functional tests, and they belong on a separate calendar. What a tabletop does very well is expose decision gaps, authority confusion, and missing phone numbers. It tests whether your incident response plan survives contact with the people who have to use it.
Three formats fit different needs:
· Executive tabletop. 60 minutes, leadership only, focused on the pay decision, customer notification, and public statements.
· Full operational tabletop. 90 to 120 minutes, the whole roster, focused on containment, plant continuity, and recovery order.
· Plant-floor tabletop. 45 minutes at a single site, focused on manual operations and shift handover.
Most mid-market manufacturers should start with the full operational version, then add the shorter ones as the program matures. A single ransomware tabletop exercise done well beats 4 rushed ones that nobody documents.
Where Manufacturing Response Plans Break Under Pressure
Every gap below shows up in real exercises, usually within the first 20 minutes. None of them are exotic, and all of them are cheap to fix once you’ve seen them.
Authority is the first one. The plan says “escalate to the incident commander,” and nobody in the room can name that person. Worse, 2 people think it’s them. Until someone can say “I can shut down line 3 without asking anyone,” your incident response plan is a document rather than a plan.
Communication is the second. The contact list lives in a SharePoint site that sits behind the credentials the attacker just encrypted. Email is down, Teams is down, and the plant manager’s mobile number is in Outlook. Print the roster. Put a copy in the guard shack and 1 in every supervisor’s truck.
Detection timing is the third. Ransomware deployment is usually the last step of an intrusion that started days or weeks earlier with stolen credentials. Small IT teams rarely watch logs overnight, which is why a plant with third-shift production often pairs its internal team with managed detection and response coverage so somebody is watching when the shop floor is running and the office is dark.
Recovery order is the fourth, and it’s the gap that separates manufacturing cybersecurity from generic IT security. Teams restore what’s easiest instead of what pays. You’ll find that shipping can’t run without the label printer server, which nobody classified as critical, so it sits at position 40 on the restore list while trucks queue at the dock.
The fifth is quieter. Nobody has read the insurance policy. The company calls its own forensics firm on day 1, and the carrier later disputes the cost because the panel vendor wasn’t used.
Building a Scenario Your Plant Will Recognize
Scenario quality decides how much ransomware readiness you actually gain. Generic scenarios produce generic answers. If the inject says “a ransomware attack occurs,” your team will say “we’d follow the plan,” and you’ll learn nothing. Name real systems, real sites, and real customers.
Start with a short asset inventory and pick the 5 systems whose loss stops revenue. For most manufacturers that list includes ERP, the MES or shop-floor scheduling system, the file server holding drawings and CAD, the domain controllers, and whatever runs shipping labels and EDI. Build the scenario around those.
Then choose an entry point that matches your actual exposure. Common realistic starts include a compromised VPN account without MFA, a remote-support session from a machine builder, a phishing email to accounts payable, and an exposed RDP host left behind after a 2021 project. CISA’s tabletop exercise packages include more than 100 customizable scenarios with situation manuals and facilitator handbooks, and they’re a fair starting skeleton as long as you rewrite the details in your own language.
A workable scenario for a 3-site manufacturer reads like this. On a Friday at 4:40 p.m., a maintenance technician reports that shared drawings won’t open. By 5:15 p.m., the helpdesk sees ransom notes on 2 file servers and the ERP application server. Backup jobs from the last 48 hours show failures nobody reviewed. A leak site posts your company name 3 days later with a sample of HR files.
Write injects for a ransomware tabletop exercise as facts rather than questions. “Your ERP is encrypted” moves the discussion forward. “What would you do if ERP were encrypted?” invites theory.
Who Belongs in the Room
Ransomware is a business event, so an IT-only ransomware tabletop exercise produces IT-only answers. NIST’s Guide to Operational Technology Security makes the same point for industrial environments, recommending a cross-functional team that includes IT staff, a control engineer, a control system operator, a security specialist, management, and safety. Use that list as your floor, then add the commercial roles.
| Role | Who fills it | What they’re there to answer |
| Incident commander | COO, VP operations, or IT director | Who decides, and what they can decide alone |
| Plant operations | Plant manager, production supervisor | Can we run manually, and for how long |
| Controls and OT | Controls engineer, maintenance lead | What’s connected, what can be isolated safely |
| IT and security | IT manager, systems admin | Containment steps, restore order, evidence |
| Finance | CFO or controller | Payroll, cash, vendor payments, ransom funding |
| Legal and compliance | General counsel or outside counsel | Notification duties, privilege, contracts |
| HR | HR director | Shift pay, employee data, internal messaging |
| Sales and customer service | Account lead | Who calls which customer, and in what order |
| Communications | Marketing lead or external firm | Holding statements, media, leak site response |
Cap the room at 14 people. Past that, the quiet participants stop talking. If you lack a security leader who can chair the session, many manufacturers borrow one through a virtual CISO arrangement rather than handing the facilitator job to the person who also has to answer the technical questions.
One rule pays for itself: invite at least 1 executive who can approve spending in the room. Findings without a budget owner die in the after-action report.
The 90-Minute Agenda, Inject by Inject
Structure keeps a ransomware tabletop exercise honest. Give each inject a hard time box, and let the facilitator cut discussion when it circles.
| Time | Segment | What happens |
| 0:00 to 0:10 | Ground rules | No blame, no “we’d never do that,” phones down |
| 0:10 to 0:30 | Inject 1: first signals | Detection, triage, who gets called at 4:40 p.m. on a Friday |
| 0:30 to 0:50 | Inject 2: spread and shutdown | Containment, isolating OT, the decision to stop lines |
| 0:50 to 1:10 | Inject 3: extortion and data theft | Ransom note, leak site, legal and insurance activation |
| 1:10 to 1:20 | Inject 4: day 4 recovery | Restore order, manual operations, customer commitments |
| 1:20 to 1:30 | Hot wash | Top gaps, owners, immediate actions |
Inject 1 tests the first hour. Ask for names and numbers, not roles. The right answer is “I call Dave at this number, and if he doesn’t answer in 10 minutes I call Maria.”
Inject 2 tests the hardest technical call in manufacturing. Someone has to decide whether to pull the plant network from the business network, and that decision usually stops production. CISA’s #StopRansomware Guide pairs prevention practices with a response checklist that’s useful here as a reference during the discussion, and it helps settle arguments about what to isolate first.
Inject 3 moves the room from technical to commercial. Data theft changes the calculus, because restoring from backup no longer ends the event.
Inject 4 is where confident teams get humbled. Ask which system comes back first, then ask what that system depends on, then ask who tested that dependency last.
The Decisions Worth Rehearsing Before You Need Them
Rehearse the calls that are hard to make while your phone is ringing.
Whether To Stop Production
Isolating the shop floor protects it and costs money by the hour. Decide in advance who can order it, what evidence justifies it, and how the order reaches 3 shifts.
Whether To Pay
Treat this as a governed decision, not a reflex. The US Treasury’s advisory on sanctions risks for facilitating ransomware payments discourages payment, warns that payments to sanctioned actors can create legal exposure, and treats a self-initiated, complete report to law enforcement as a significant mitigating factor. Your exercise should confirm 3 things: who authorizes payment, which counsel gets involved, and who contacts the FBI.
When To Call The Carrier
Most policies require notice within a short window and require you to use panel vendors. Confirm the hotline number, and confirm who holds it. A cyber insurance readiness review before the exercise makes this segment far more useful, since the room can test real policy terms instead of guessing.
What You Tell Customers
A tier 1 buyer who hears about your outage from a leak site will treat you differently than one who got a call on day 1. Draft the holding message now and decide who signs it.
When To Declare Recovery
Teams often skip this. Without a stated end condition, incident cost keeps accruing quietly for weeks.
Legal, Insurance, and Reporting Duties to Test
Reporting duties are a timing problem, and a ransomware tabletop exercise is the cheapest place to discover you’d miss a deadline.
Federal reporting is tightening. Under the Cyber Incident Reporting for Critical Infrastructure Act, CISA’s proposed rule would require covered entities to report a covered cyber incident within 72 hours after the entity reasonably believes the incident occurred, and to report a ransom payment within 24 hours after making it. Those CIRCIA reporting duties aren’t yet effective because the final rule is still in progress as of September 23, 2026, so confirm current status with counsel. Rehearse against those proposed windows anyway, using the proposal’s “reasonably believes” standard rather than mere suspicion. Your incident response plan should name who files, who reviews, and who holds the account.
State breach laws still apply on top of that, and they’re triggered by personal data rather than production impact. HR files, health plan records, and payroll data sit on the same file servers your attacker encrypted. Most manufacturers discover during the exercise that nobody knows where employee data actually lives.
Contracts are the third layer, and they’re often the strictest. Automotive and aerospace supply agreements frequently carry notification clauses measured in hours, plus audit rights that follow an incident. Pull 3 of your largest customer contracts before the session and read the security terms out loud. Teams are routinely surprised.
Evidence handling deserves 5 minutes of its own. If IT reimages the first infected machine on day 1, you lose the forensic starting point, and insurers and counsel will both ask about it. Agree in the exercise that the first affected systems get preserved, not cleaned.
Communicating With Customers, Suppliers, and Your Workforce
Communication is the part of manufacturing cybersecurity that no product covers. Silence gets filled by rumor, and in a plant it gets filled fast. Your workforce sees the lines stop long before any statement goes out.
A ransomware tabletop exercise should settle who speaks to whom. A workable split gives customers to sales leadership with counsel review, suppliers to procurement, employees to HR and plant management, and press to 1 named spokesperson. Everyone else refers questions. Put that rule on the printed roster.
Plan the channels that survive the incident. If Microsoft 365 is down, your announcements need a path that doesn’t depend on it. Options include a phone tree, text messages from a payroll system, a physical noticeboard, and a pre-registered external email domain that’s kept separate from the main tenant.
Write the messages in advance. Three short templates cover most of the first day: an internal message to all employees, a customer notice about order impact, and a supplier notice about receiving and payments. Keep them factual and short. Say what you know, say what you’re doing, and say when the next update comes.
Ransomware readiness includes the message you haven’t drafted yet, so prepare for the leak site separately. If data is published, the questions change from “when will my order ship” to “was my information taken.” That’s a legal and HR conversation with a different tone, and the exercise should touch it rather than assume it away.
Measuring the Exercise and Writing the After-Action Report
An exercise without measurement becomes a war story, and mid-market manufacturers rarely get budget from war stories. Score it, and the findings survive contact with the next budget cycle.
NIST’s Incident Response Recommendations and Considerations, finalized in April 2025, restructures incident response around the 6 functions of the Cybersecurity Framework 2.0 and treats response as continuous risk management rather than a 4-phase event. Scoring your exercise against those functions gives you language that maps to audits, customers, and insurers, and it tells you which parts of the incident response plan need rewriting.
| Measure | How you capture it | A reasonable target |
| Time to declare an incident | Facilitator notes the minute the room commits | Under 30 minutes from first signal |
| Correct decision owner named | Data collector checks each decision | 100% of decisions have 1 named owner |
| Reachability of key contacts | Count contacts reachable without email | Every role on the roster |
| Restore order agreed | Compare the room’s list to the documented one | Matches, or the document gets updated |
| Notification deadlines met | Walk the 72-hour and 24-hour clocks | No missed window in the scenario timeline |
| Open gaps closed from last drill | Review the prior report | At least 80% closed |
Write the after-action report within 5 business days, while memory is fresh. Keep it to 4 parts: what happened in the scenario, what worked, what gaps appeared, and what changes are owned by whom with a date. Avoid naming individuals in a negative way. People stop talking in the next drill if the last one became a performance review.
Circulate the report to everyone who attended, plus the executive sponsor. Ransomware readiness improves when findings are visible, and it stalls when reports live in a private folder.
Turning Findings Into Funded Fixes
A single ransomware tabletop exercise usually produces 15 to 30 findings. Sorting them by effort and impact keeps the list from becoming shelfware.
| Window | Typical actions | Owner |
| First 30 days | Print the contact roster, name the incident commander, fix MFA gaps on remote access, confirm the insurance hotline | IT manager and operations |
| 31 to 60 days | Test 3 real restores end to end, classify the top 20 systems by revenue impact, document the restore order | IT and finance |
| 61 to 90 days | Segment plant networks from business networks, remove standing admin rights, review machine-vendor remote access | IT and controls |
Backups deserve the first dollar of any manufacturing cybersecurity budget. A restore that nobody has performed is a theory. Test a full application recovery, not a file-level pull, and record how long it actually took, including the time spent finding credentials and license keys.
Identity comes next. Most intrusions that end in encryption start with a valid account. Multifactor authentication on every remote path, removal of shared logins, and tighter admin rights solve more than any single product purchase.
Detection follows. Pairing an endpoint detection and response rollout with monitored alerting shortens the window between intrusion and deployment, which is usually the only window you get. Where the exercise surfaced unknown exposure rather than unknown process, a vulnerability assessment across internet-facing systems and remote access paths gives you a ranked list instead of a guess.
Update the incident response plan itself as part of the 30-day window, since a finding that never reaches the document gets lost at the next handover. Fund the fixes in the same meeting where you present the report. Findings that wait for the next planning cycle tend to reappear, word for word, in the following exercise.
Recovery Reality: Backups, Restore Order, and Running Manually
Recovery is where optimistic plans meet physics. Rehearse it, because the sequence decides how much revenue you lose.
Backups need 3 properties to matter here: a copy the attacker can’t reach, a tested restore, and a documented recovery time for each system. Immutable or offline copies address the first. Only a real restore addresses the second. Attackers routinely hunt backup servers and delete jobs before encrypting anything, so a backup system that uses domain credentials is a backup system inside the blast radius.
Restore order should follow revenue, not convenience. A practical sequence for most plants runs identity first, then the systems that let you ship what’s already built, then production scheduling, then finance and reporting. Shipping earns cash this week. Reporting can wait.
Manual operations deserve genuine attention. The OT security guidance from NIST describes graceful degradation, moving from full automation to emergency operation with more operator involvement, and then to manual operation with none. Ask concrete questions. Can the line run from printed work instructions? Where are the paper travelers? Can shipping produce a bill of lading without the ERP? How many days of orders can you process by hand before quality records fall behind?
Set a realistic recovery expectation with leadership before an incident. Full recovery for a mid-market manufacturer is commonly measured in weeks, not days, even when a decryption key works. Partial operations come back far sooner, which is exactly why restore order matters more than total restore time.
Building a 12-Month Exercise Program
One drill creates a snapshot. A program creates ransomware readiness that survives turnover.
A workable annual rhythm for mid-market manufacturers looks like this:
· Q1: Full operational ransomware tabletop exercise with the complete roster and a fresh scenario.
· Q2: Technical recovery test. Restore 3 systems for real and time them.
· Q3: Executive tabletop focused on payment, disclosure, and customer impact.
· Q4: Plant-floor drill at a single site, plus a review of the year’s open findings.
Change the scenario every time. Rotate the entry vector, the affected site, and the timing. A drill that always starts on a Tuesday morning trains people for Tuesday mornings.
Add technical validation alongside the discussions, because a scenario built on real weaknesses lands harder. Running penetration testing against remote access, Active Directory, and internet-facing assets gives your next scenario real findings to build on, which is far more persuasive to a skeptical plant manager than a hypothetical.
Track maturity with 3 simple questions asked each quarter. Can every role name the incident commander? Did we restore something real this quarter? Are last quarter’s findings closed? A team answering yes to all 3 has a manufacturing cybersecurity program, not a set of tools.
Bring new people in deliberately. Manufacturing turnover means the person who ran the last exercise may not be there for the next one. Rotate the facilitator role, keep the situation manuals and the current incident response plan in a shared and printed location, and treat the exercise program as a standing operational routine rather than a project with an end date.
Conclusion
Ransomware readiness for mid-market manufacturers isn’t really a technology problem. The tools behind manufacturing cybersecurity are available and affordable. What’s usually missing is a rehearsed set of decisions, a printed phone list, a tested restore, and one person with clear authority to stop a line at 2 a.m.
A ransomware tabletop exercise buys all of that for the price of a long meeting. Run the first one with a scenario that names your own systems, put operations and finance in the room alongside IT, score what you find, and fund the fixes before the memory fades. Then do it again next quarter with a different story.
The manufacturers who recover well aren’t the ones with the biggest security budgets. They’re the ones who had the argument about shutting down line 3 while everyone was calm, took notes, and wrote the answer down.
FAQs
1. How long should a ransomware tabletop exercise take?
Plan 90 to 120 minutes for a full operational session. Executive-only sessions run about 60 minutes, and single-site plant drills work well at 45. Sessions past 2 hours lose the room, and the last 30 minutes rarely produce useful findings.
2. How often should a mid-market manufacturer run one?
Twice a year is a sensible floor, and quarterly is better if you have multiple sites or recent acquisitions. Run an extra session after a major change such as an ERP migration, a new plant, or a change in the leadership team.
3. Who should facilitate the exercise?
Someone who isn’t responsible for answering the technical questions. That can be an internal leader from outside IT, a security leader on a fractional arrangement, or an outside specialist. The facilitator’s job is to keep time, push for specifics, and stop the room from defending the plan.
4. What’s the difference between a tabletop and a functional exercise?
A tabletop is discussion only, so nothing gets touched. A functional exercise has people perform real tasks, such as restoring a server or failing over a site. Both matter. Start with the tabletop, because it’s cheaper and it tells you which functional tests to run first.
5. Should OT and plant staff be included, or is this an IT exercise?
Include them. Most ransomware in manufacturing hits IT systems, but the consequences land on the plant floor, and the decision to isolate or shut down production needs controls and operations input. Manufacturing cybersecurity fails when the plant floor hears about decisions instead of making them, and an IT-only session misses the decisions that cost the most.
6. Do we need to involve legal counsel in a practice exercise?
Yes, at least for the extortion and notification injects. Counsel will flag contract clauses, privilege questions, and state notification duties that technical staff won’t see. Many organizations run the exercise under privilege, which also encourages candid discussion.
7. What should we do if we discover our backups have never been tested?
Treat it as the top finding and schedule a real restore within 30 days. Test a full application recovery rather than a single file, and record actual elapsed time including credential and license retrieval. Untested backups are the most common serious gap these exercises surface.
8. Does cyber insurance cover the cost of running exercises?
Coverage varies, and some carriers offer risk-engineering services or credits that include exercise support. Ask your broker directly. Separately, confirm the notification window, the panel vendor list, and the hotline number, because those terms affect what you do in the first hours.
9. Should we ever pay the ransom?
US government guidance discourages payment, and payments to sanctioned actors create legal exposure. Payment also doesn’t guarantee clean or fast recovery, and it doesn’t undo data theft. Decide in advance who authorizes any payment, which counsel is involved, and who contacts law enforcement first.
10. How do we run an exercise when we only have 3 IT people?
Keep it small and focused. A 60-minute session with 8 people and 2 injects still surfaces authority gaps and contact problems. Use a free scenario package as your base, and borrow a facilitator so your IT staff can take part in the ransomware tabletop exercise instead of presenting it.
11. What documents should we bring into the room?
Bring the incident response plan, the contact roster, the insurance policy summary, the backup schedule with last known test dates, a list of critical systems, and 2 or 3 major customer contracts. The exercise is more useful when the room checks real documents instead of recalling them.
12. How do we measure whether readiness is improving?
Track a few stable measures across sessions: time to declare an incident, percentage of decisions with a single named owner, contacts reachable without email, and the percentage of prior findings closed. Trends over 4 quarters tell you more about ransomware readiness than any single score.
13. What’s a realistic recovery timeline for a plant hit by ransomware?
Partial operations often resume within days, particularly shipping and manual production. Full restoration of ERP, historical data, and reporting commonly takes weeks. Set that expectation with leadership before an incident so the recovery plan is judged against reality.
14. Can we just use a free government scenario without changing it?
You can, but the results will be weaker. Rewrite the scenario with your own system names, sites, shift patterns, and customers. Specificity is what moves participants from quoting policy to describing what they’d actually do.
15. Who should see the after-action report?
Everyone who attended, the executive sponsor, and anyone assigned a finding. Share it within 5 business days. Some organizations also share a summarized version with key customers or insurers as evidence of a tested plan, which is increasingly requested during supplier audits.
