--- title: Business Email Compromise Tabletop Exercise for Small Businesses description: Run a practical business email compromise tabletop exercise in 45–60 minutes. Includes realistic scenarios, facilitator guidance, and worksheets. image: https://mightygrc.com/hubfs/Business%20Email%20Compromise%20Tabletop%20Exercise%20for%20Small%20Businesses.%20MIGHTY%20GRC.png --- [Skip to content](https://mightygrc.com/tabletop-exercise/business-email-compromise#main-content) [![MIGHTY GRC company logo M](https://mightygrc.com/hs-fs/hubfs/Screenshot%202026-05-20%20at%2010.52.57%20AM.png?width=372&height=420&name=Screenshot%202026-05-20%20at%2010.52.57%20AM.png)Homepage](https://mightygrc.com/?hsLang=en) - Products - [PolicyPilot](https://mightygrc.com/products/policypilot?hsLang=en) - [RiskSnap](https://mightygrc.com/products/risksnap?hsLang=en) - [BudgetLens](https://mightygrc.com/products/budgetlens?hsLang=en) - Pricing - [SMB Pricing](https://mightygrc.com/policypilot-pricing?hsLang=en) - [Partner Program](https://mightygrc.com/policypilot-partner-pricing?hsLang=en) - Resources - [MIGHTY Blog](https://mightygrc.com/mighty-blog?hsLang=en) - [SMB Policy Guide](https://mightygrc.com/small-business-policy-guide?hsLang=en) - Tabletop Exercises - [Email Compromise](https://mightygrc.com/tabletop-exercise/business-email-compromise) - Ransomware Event (coming soon) - Company - [The MIGHTY Mission](https://mightygrc.com/about-mighty-grc?hsLang=en) - [Contact Our Team](https://mightygrc.com/contact?hsLang=en) - [Privacy Policy](https://mightygrc.com/privacy?hsLang=en) - [Blog](https://mightygrc.com/mighty-blog?hsLang=en) - [GET A DEMO](https://mightygrc.com/policypilot-demo?hsLang=en) LOG IN - Products - [PolicyPilot](https://mightygrc.com/products/policypilot?hsLang=en) - [RiskSnap](https://mightygrc.com/products/risksnap?hsLang=en) - [BudgetLens](https://mightygrc.com/products/budgetlens?hsLang=en) - Pricing - [SMB Pricing](https://mightygrc.com/policypilot-pricing?hsLang=en) - [Partner Program](https://mightygrc.com/policypilot-partner-pricing?hsLang=en) - Resources - [MIGHTY Blog](https://mightygrc.com/mighty-blog?hsLang=en) - [SMB Policy Guide](https://mightygrc.com/small-business-policy-guide?hsLang=en) - Tabletop Exercises - [Email Compromise](https://mightygrc.com/tabletop-exercise/business-email-compromise) - Ransomware Event (coming soon) - Company - [The MIGHTY Mission](https://mightygrc.com/about-mighty-grc?hsLang=en) - [Contact Our Team](https://mightygrc.com/contact?hsLang=en) - [Privacy Policy](https://mightygrc.com/privacy?hsLang=en) - [Blog](https://mightygrc.com/mighty-blog?hsLang=en) - [GET A DEMO](https://mightygrc.com/policypilot-demo?hsLang=en) LOG IN # Business Email Compromise Tabletop Exercise ## Can Your Team Spot and Stop Email Fraud? **A realistic, step-by-step cybersecurity exercise for small businesses and leadership teams.** **Just 60 minutes. No dedicated IT team required.** ![A tabletop exercise designed for small businesses and MSPs who support them. Explore a business email compromise scenario with MIGHTY GRC.](https://mightygrc.com/hs-fs/hubfs/Business%20email%20compromise%20tabletop%20exercise%20for%20small%20business.%20MIGHTY%20GRC.png?width=600&height=300&name=Business%20email%20compromise%20tabletop%20exercise%20for%20small%20business.%20MIGHTY%20GRC.png "A tabletop exercise designed for small businesses and MSPs who support them. Explore a business email compromise scenario with MIGHTY GRC.") **COMING SOON. Download your free PDF workbook, including scenario cards, worksheets, and facilitator guide.** PDF DOWNLOAD coming soon --- ## Table of Contents ### Simple, real world tabletop exercise for small business cybersecurity. How MIGHTY of you. ***Use the arrows below to jump into any section.*** ![Stronger cybersecurity for small businesses with a 60-minute tabletop exercise from MIGHTY GRC.](https://mightygrc.com/hs-fs/hubfs/60%20minute%20small%20business%20tabletop%20exercise.%20MIGHTY%20GRC.png?width=250&height=500&name=60%20minute%20small%20business%20tabletop%20exercise.%20MIGHTY%20GRC.png "Stronger cybersecurity for small businesses with a 60-minute tabletop exercise from MIGHTY GRC.") #### Definitions and Outcomes  [→](https://mightygrc.com/tabletop-exercise/business-email-compromise#Part_1_Definitions) Define email compromise, how tabletop exercises work, and what your team will learn. #### Preparation and Facilitator Guide  [→](https://mightygrc.com/tabletop-exercise/business-email-compromise#Part_2_Preparation_and_Facilitation) Get your team, materials, and responsibilities organized for a productive exercise. #### The Exercise, Step-by-Step  [→](https://mightygrc.com/tabletop-exercise/business-email-compromise#Part_3_The_Exercise) Work through a realistic, evolving scenario and practice making decisions at every stage. #### The Team Debrief  [→](https://mightygrc.com/tabletop-exercise/business-email-compromise#Part_4_The_Debrief) Evaluate your response, assess your readiness, and identify gaps that need attention. #### The 30-Day Resiliency Plan  [→](https://mightygrc.com/tabletop-exercise/business-email-compromise#Part_5_30_Day_Plan) Turn your findings into prioritized improvements with clear actions, owners, and deadlines. #### Frequently Asked Questions  [→](https://mightygrc.com/tabletop-exercise/business-email-compromise#Part_6_FAQs) Find answers to common questions about running tabletop exercises and strengthening your business's response to cybersecurity incidents and events. ![Tabletop Exercise Time Requirement Icon. MIGHTY GRC](https://mightygrc.com/hs-fs/hubfs/Tabletop%20Exercise%20Time%20Requirement%20Icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Tabletop%20Exercise%20Time%20Requirement%20Icon.%20MIGHTY%20GRC.png "Tabletop Exercise Time Requirement Icon. MIGHTY GRC") #### 45-60 minutes per exercise ![Cybersecurity tabletop exercise for entrepreneurs, beginners and SMBs from MIGHTY GRC.](https://mightygrc.com/hs-fs/hubfs/Entrepreneur%20and%20beginner%20friendly%20icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Entrepreneur%20and%20beginner%20friendly%20icon.%20MIGHTY%20GRC.png "Cybersecurity tabletop exercise for entrepreneurs, beginners and SMBs from MIGHTY GRC.") #### Entrepreneur & beginner friendly ![Participation recommendations for BEC small business cybersecurity tabletop exercise by MIGHTY GRC.](https://mightygrc.com/hs-fs/hubfs/Tabletop%20Exercise%20Participation%20Icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Tabletop%20Exercise%20Participation%20Icon.%20MIGHTY%20GRC.png "Participation recommendations for BEC small business cybersecurity tabletop exercise by MIGHTY GRC.") #### 2-6 participants recommended ![Tabletop exercise for MSPs and Internal IT Teams to support small businesses and SMBs.](https://mightygrc.com/hs-fs/hubfs/Tabletop%20Exercise%20for%20MSPs%20Icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Tabletop%20Exercise%20for%20MSPs%20Icon.%20MIGHTY%20GRC.png "Tabletop exercise for MSPs and Internal IT Teams to support small businesses and SMBs.") #### MSP & IT team participation welcome *Solo business owners can complete this exercise independently, while larger teams can assign separate business, finance, and technical roles.* *If you work with an MSP or have an internal IT team, consider involving them in the exercise to gain deeper insights, identify potential gaps, and develop more actionable next steps.*   ## Part 1: Definitions and Outcomes ![Definition of a tabletop exercise icon. MIGHTY GRC](https://mightygrc.com/hs-fs/hubfs/Definition%20of%20a%20tabletop%20exercise%20icon.%20MIGHTY%20GRC.png?width=500&height=453&name=Definition%20of%20a%20tabletop%20exercise%20icon.%20MIGHTY%20GRC.png)An urgent email arrives from a trusted vendor. They've changed banks and need you to update their payment information before an invoice can be processed. The message looks legitimate. The sender's name is familiar. The invoice amount is correct. And the person requesting the change seems to know exactly how your business operates. ***Would your team know what to do next?*** This business email compromise tabletop exercise helps small businesses practice recognizing suspicious payment requests, responding to potential email account compromises, and protecting their finances before a real incident occurs. Through a realistic, evolving scenario, your team will practice making decisions, assigning responsibilities, identifying weaknesses, and developing practical improvements to your business processes. You don't need advanced cybersecurity knowledge to participate. You just need a willingness to ask questions, challenge assumptions, and improve how your business responds to risk. ### Definition of a business email compromise Business email compromise (BEC) is a form of fraud in which criminals use deceptive or compromised email accounts to trick people into transferring money, changing payment details, sharing sensitive information, or taking other unauthorized actions. Unlike attacks that depend on sophisticated malicious software, BEC often exploits something every business relies on: trust. #### ![MIGHTY GRC Quote for Small Business: People dedicated to clear goals using consistent processes make any business more resilient. ](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   Email compromise often exploits something every business relies on: *trust*.  ![MIGHTY GRC Quote Icon](https://mightygrc.com/hs-fs/hubfs/Quote%20Icon%20Right.%20MIGHTY%20GRC.png?width=25&height=19&name=Quote%20Icon%20Right.%20MIGHTY%20GRC.png) Criminals may impersonate executives, employees, customers, or vendors. Sometimes they use email addresses that closely resemble legitimate ones. In other cases, they gain access to a real email account, making fraudulent requests much harder to recognize. For small businesses, the consequences can include financial losses, interrupted operations, compromised information, damaged business relationships, and unexpected recovery expenses. **The good news?** Clear procedures, independent verification, and well-practiced response plans can make a meaningful difference. ![A tabletop exercise designed for small businesses and MSPs who support them. Explore a business email compromise scenario with MIGHTY GRC.](https://mightygrc.com/hs-fs/hubfs/Business%20email%20compromise%20tabletop%20exercise%20for%20small%20business.%20MIGHTY%20GRC.png?width=600&height=300&name=Business%20email%20compromise%20tabletop%20exercise%20for%20small%20business.%20MIGHTY%20GRC.png "A tabletop exercise designed for small businesses and MSPs who support them. Explore a business email compromise scenario with MIGHTY GRC.") ### What is a tabletop exercise? A tabletop exercise is a guided discussion that allows a business to practice responding to a simulated incident without disrupting real operations. Rather than testing technical systems, participants work through a realistic situation, discuss their decisions, and identify what their organization would need to respond effectively. #### ![MIGHTY GRC Quote for Small Business: People dedicated to clear goals using consistent processes make any business more resilient. ](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   By the end, you'll have documented real actions your business can take to reduce its risk.  ![MIGHTY GRC Quote Icon](https://mightygrc.com/hs-fs/hubfs/Quote%20Icon%20Right.%20MIGHTY%20GRC.png?width=25&height=19&name=Quote%20Icon%20Right.%20MIGHTY%20GRC.png) In this exercise, you'll work through five stages of a suspected business email compromise, from the first suspicious message through incident response and recovery. By the end, you'll have more than a better understanding of email fraud. You'll have documented real actions your business can take to reduce its risk. ### What your team will accomplish By completing this exercise, your business will practice how to: 1. Recognize suspicious requests involving payments or banking information. 2. Independently verify financial instructions, even when an email appears legitimate. 3. Respond when a fraudulent payment may already have been initiated. 4. Identify and contain a potentially compromised email account. 5. Coordinate responsibilities among employees, management, financial institutions, and IT support. 6. Document evidence, decisions, and potential reporting obligations. 7. Turn lessons learned into specific, assigned improvements. ### Who should participate For a small business, the ideal participants are people who: ✔️  Approve payments ✔️ Manage vendor relationships ✔️ Oversee operations ✔️ Provide IT support The business owner or manager can serve as facilitator. An MSP, IT provider, or consultant can also lead the exercise for a client. **You don't need every role represented by a separate person.** In a five-person company, the owner may also handle finance, vendor relationships, and incident response. ## Part 2: Exercise preparation and facilitator guide ### Email compromise tabletop exercise overview ![A tabletop exercise focused on email phishing scams for small businesses by MIGHTY GRC.](https://mightygrc.com/hs-fs/hubfs/Business%20Email%20Phishing%20Scam%20Icon.%20MIGHTY%20GRC.png?width=300&height=330&name=Business%20Email%20Phishing%20Scam%20Icon.%20MIGHTY%20GRC.png "A tabletop exercise focused on email phishing scams for small businesses by MIGHTY GRC.") #### Details and descriptions of tabletop exercise components **Exercise title:** The Vendor Payment Switch **The threat:** Business email compromise and payment diversion **Business type:** Fictional 15-person professional services company **Exercise duration:** 45–60 minutes **Participants:** Owner/manager, finance, operations, IT provider, or other relevant personnel **Format:** Facilitated discussion with five scenario developments **Difficulty:** Beginner to intermediate **Primary objective:** Prevent or limit financial loss, contain potential account compromise, and improve response procedures **Deliverables:** 1. 1. Decision log 2. Incident contact list 3. Payment verification procedure 4. Response checklist, and 5. Improvement plan ### Suggested 60-minute agenda **Introduction and ground rules** | 5 minutes Set expectations and assign roles **5-Stage tabletop exercise** | 40-45 minutes ***Stage 1:*** **The suspicious request** Recognize warning signs and verify instructions ***Stage 2:* The payment** Respond to a possible fraudulent transfer ***Stage 3:*** **The compromised account** Contain the incident and preserve evidence ***Stage 4:*** **The expanding impact** Assess exposure, obligations, and communications ***Stage 5:* Recovery** Restore trust and strengthen processes **Debrief and action plan** | 10-15 minutes Prioritize gaps and assign improvements ***For a 45-minute version,*** *shorten each scenario discussion and select the three highest-priority improvement actions during the debrief. Participants can finish the worksheets afterward.* ### Before you begin ![Prepare for your business email compromise tabletop exercise with a simple checklist.](https://mightygrc.com/hs-fs/hubfs/Pre-Tabletop%20Exercise%20Preparation%20Checklist.%20MIGHTY%20GRC.png?width=400&height=600&name=Pre-Tabletop%20Exercise%20Preparation%20Checklist.%20MIGHTY%20GRC.png)Before you begin the exercise, the facilitator should complete this preparation checklist: ✔️ Identify the facilitator and participants. ✔️ Choose someone to record decisions and improvement actions. ✔️ Locate existing payment approval and vendor verification procedures, if available. ✔️ Identify who manages company email accounts and IT support. ✔️ Locate bank fraud contact information and relevant insurance details. ✔️ Prepare the scenario, decision log, and worksheets. ✔️ Explain that all actions are simulated and no real operational changes should be made. ### Facilitator ground rules Explain these rules to the participants before beginning: 1. This is a discussion-based simulation, not a test or an evaluation of individual employees. 2. Participants should describe what they would actually do using the people, systems, and resources currently available. 3. If a procedure doesn't exist or nobody knows the answer, record it as a gap rather than inventing a process. 4. New information will be revealed in stages. Participants should make decisions using only what they know at that point. 5. Do not send real payments, change live account settings, contact external parties as part of the simulation, or test production systems. 6. The facilitator should distinguish between actions that are documented and tested, actions the team believes it could perform, and improvements that still need to be implemented. #### **Critical note** If participants discover an actual security incident during the exercise, stop the simulation and follow your organization's [**Incident Response Plan**](https://mightygrc.com/mighty-blog/small-business-incident-response-plan?hsLang=en). If your team identifies security gaps, don't let them end up as notes that never get revisited. Assign someone to document and track the necessary improvements in your [**Security Improvement Roadmap**](https://mightygrc.com/mighty-blog/small-business-cybersecurity-roadmap?hsLang=en). **Don't have these policies and plans in place yet?** Read and download [***The MIGHTY Guide to 7 Essential Small Business Policies***](https://mightygrc.com/small-business-policy-guide?hsLang=en) to learn how to build practical policies and procedures yourself. Discover how the right policies can empower your team to work more independently, make better business decisions, strengthen security, and build long-term business resilience.   ![Free PDF Download The MIGHTY Guide to Seven Essential Policies for Small Business, Teams, and SMBs.](https://mightygrc.com/hs-fs/hubfs/The%20MIGHTY%20Guide%20to%20Seven%20Essential%20Policies%20for%20Small%20Business%20and%20Teams.png?width=955&height=745&name=The%20MIGHTY%20Guide%20to%20Seven%20Essential%20Policies%20for%20Small%20Business%20and%20Teams.png) ### The Mighty Guide to Essential Policies **How to create simple, actionable policies for your small business or small team.** The MIGHTY guide, now available as a free PDF download that's easy to read, refer back to, and share with your team. Includes **three actionable worksheets**, only available in the PDF guide, to get you quickly and easily started on your policy creation journey. **That's MIGHTY.** GET YOUR FREE DOWNLOAD ## Part 3: The exercise, step-by-step ### The Vendor Payment Switch #### *Meet your business.* ![Cedar & Co. is a fictional small business conducting a tabletop exercise for a business email compromise.](https://mightygrc.com/hs-fs/hubfs/Modern%20small%20business%20with%20GRC%20needs.%20MIGHTY%20GRC.png?width=600&height=400&name=Modern%20small%20business%20with%20GRC%20needs.%20MIGHTY%20GRC.png)You work for Cedar & Co., a 15-person professional services company. Your business has been growing steadily. You have several recurring vendors, a small administrative team, and an outside IT provider who helps manage your technology. Most employees use email throughout the day to coordinate work, communicate with vendors, and approve purchases. Your office manager, Alex, handles accounts payable. The owner, Jordan, approves larger payments. There is no dedicated cybersecurity employee. One of your longstanding vendors, Summit Office Solutions, provides equipment and services to your business. You've worked with them for three years, and they typically invoice you monthly. An invoice for $18,450 is due this week. Everything has been routine. Until now... #### Have you downloaded the free PDF MIGHTY Guide yet? **Before you jump in, make sure you have everything you need to turn this exercise into action.** > Download your **FREE MIGHTY Business Email Compromise Tabletop Exercise Guide** to access all the worksheets referenced throughout the step-by-step scenario in Part 3. > > Capture important decisions, document your team's response, uncover security gaps, and build a practical plan for improvement. > > **Don't just talk through an imagined scenario. Walk away with tools and actionable next steps to strengthen *your* real world business.** DOWNLOAD YOUR FREE EXERCISE GUIDE (coming soon) ### Stage 1. The suspicious request #### ![Suspicious emails, or business email compromise, is a common cybersecurity concern for small businesses to practice responding to.](https://mightygrc.com/hs-fs/hubfs/Suspicious%20email%20compromise%20icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Suspicious%20email%20compromise%20icon.%20MIGHTY%20GRC.png)It's Tuesday, 9:15 AM Alex receives an email that appears to come from Taylor, the regular billing contact at Summit Office Solutions. The invoice number and amount match the company's records. The email is part of an existing conversation about the invoice. Alex has a busy morning and wants to avoid delaying payment. #### Your turn: What would your business do? Discuss the following questions before moving to the next stage. 1. What details in this request would make you suspicious? Which details make it seem credible? 2. Would your business allow Alex to update the vendor's banking information based on this email alone? 3. How would you independently verify the change? Where would you find a trusted phone number? 4. Who is authorized to approve a change to vendor payment information? 5. If Taylor couldn't be reached, would you delay payment? Who could authorize an exception? #### Make a decision: Would your team approve the change, hold the payment, or take another action? Why did you make this decision? #### **![Facilitator guidance to lead your small business through a real world tabletop exercise with MIGHTY GRC.](https://mightygrc.com/hs-fs/hubfs/Facilitator%20guidance%20for%20tabletop%20exercise%20icon.%20MIGHTY%20GRC.png?width=100&height=100&name=Facilitator%20guidance%20for%20tabletop%20exercise%20icon.%20MIGHTY%20GRC.png)Facilitator guidance** **What a strong response includes.** The team recognizes that an apparently legitimate email is not sufficient evidence to authorize a change to banking instructions. Participants should describe an independent verification process using contact information obtained from existing, trusted records rather than the suspicious email. They should also identify who can authorize changes, what documentation is required, and what happens if the request cannot be verified. **Facilitator prompt:** "What if the email really came from Taylor's account? Would that change your decision?" It shouldn't eliminate the need for independent verification. A legitimate email account can itself be compromised. ***Record the response in Worksheet 1 (Decision Log) and Worksheet 3 (Payment Verification Procedure).*** ### Stage 2. The payment has already been sent #### ![Fraudulent bank transfers can be a security risk for small businesses.](https://mightygrc.com/hs-fs/hubfs/Fraudulent%20bank%20payment%20icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Fraudulent%20bank%20payment%20icon.%20MIGHTY%20GRC.png)Tuesday, 11:40 AM Before your team can finish investigating, Alex checks the payment system and discovers something concerning. Another employee updated the vendor's banking details yesterday after receiving an earlier message in the same email conversation. The employee believed the change had been approved. The $18,450 payment was initiated at 10:30 AM today, using the new account details. Alex calls Summit Office Solutions using the phone number in the company's original vendor records. Taylor answers and says: "I didn't send any request to change our banking information. Our account details haven't changed." The payment is now suspected to be fraudulent. #### Your turn: The clock is ticking 1. Who should Alex contact first, and how would they find the correct contact information? 2. What exactly would you ask your bank to do? 3. Who within your business needs to know immediately? 4. What transaction details and other evidence would you gather? 5. Would you stop other pending payments to this vendor? Would you review recent payment changes involving other vendors? 6. Who would document the actions taken and their timestamps? #### Critical decision Your bank's normal customer service line has a long wait. What alternative fraud-reporting or emergency contact methods are available? #### **![Facilitator guidance to lead your small business through a real world tabletop exercise with MIGHTY GRC.](https://mightygrc.com/hs-fs/hubfs/Facilitator%20guidance%20for%20tabletop%20exercise%20icon.%20MIGHTY%20GRC.png?width=100&height=100&name=Facilitator%20guidance%20for%20tabletop%20exercise%20icon.%20MIGHTY%20GRC.png)Facilitator guidance** The first priority is to contact the sending financial institution immediately through a verified channel, report the suspected fraud, and request available recall, reversal, or recovery actions. The business should ask what information and indemnification documentation the bank requires. The FBI recommends immediate bank contact and prompt reporting through its Internet Crime Complaint Center at [ic3.gov](https://www.ic3.gov?utm_source=chatgpt.com). Time matters, and recovery is not guaranteed. A strong response also includes alerting appropriate leadership, preserving transaction records, checking for additional suspicious payments, and recording each action. **Facilitator challenge:** Ask participants to identify the actual bank fraud number they would use, not simply say, "We would call the bank." ***Complete Worksheet 2 (Incident Contact Directory), Worksheet 4 (Response Timeline), and Worksheet 5 (Evidence Log).*** ### Stage 3. Someone has been reading your email #### ![Cybersecurity email breach alerts should be practiced using a tabletop exercise for small business.](https://mightygrc.com/hs-fs/hubfs/Cybersecurity%20Email%20Breach%20Alert%20icon-mighty%20grc.png?width=150&height=150&name=Cybersecurity%20Email%20Breach%20Alert%20icon-mighty%20grc.png)Tuesday, 1:30 PM Your IT provider reviews the situation. The investigation reveals suspicious activity in Alex's company email account. An unfamiliar sign-in occurred several days ago, and an email forwarding rule appears to have been created without Alex's knowledge. The rule was forwarding certain vendor-related messages to an external address. The IT provider also discovers that the suspicious payment instructions were inserted into an existing vendor conversation. It's now possible that someone has been monitoring your business communications. The incident may involve more than one fraudulent payment. #### Your turn: Contain the incident 1. Who has authority to declare an incident and direct the response? 2. How would your business coordinate with its IT provider to secure the affected account? 3. What actions would you take to revoke unauthorized access and prevent further misuse? 4. How would you investigate whether other accounts or vendor relationships were affected? 5. What information should be preserved before logs or settings are changed? 6. If the affected account is temporarily unavailable, how would essential business communications continue? #### **![Facilitator guidance to lead your small business through a real world tabletop exercise with MIGHTY GRC.](https://mightygrc.com/hs-fs/hubfs/Facilitator%20guidance%20for%20tabletop%20exercise%20icon.%20MIGHTY%20GRC.png?width=100&height=100&name=Facilitator%20guidance%20for%20tabletop%20exercise%20icon.%20MIGHTY%20GRC.png)Facilitator guidance** A strong technical response, led by authorized IT personnel, may include disabling or restricting affected access, revoking active sessions, resetting credentials, reviewing multifactor authentication methods, removing malicious forwarding rules, and investigating suspicious account activity. The sequence should be coordinated with evidence preservation and the urgency of containment. The business should not assume that a password reset alone resolves the incident. **Facilitator prompt:** "Your IT provider cannot respond for another two hours. Who has the authority and technical access to secure the account in the meantime?" This helps reveal whether the business has an effective emergency support arrangement. **Additional challenge for MSP-led sessions:** Ask the provider to identify which account logs are available, how long they are retained, who can export them, and whether the organization could determine the extent of unauthorized access. ***Update Worksheets 1, 4, and 5. Record technical and operational gaps in Worksheet 6.*** ### Stage 4. The problem is bigger than one payment #### ![Business email compromises can quickly spread to multiple accounts, vendors, and payment methods if not quickly addressed via an Incident Response Plan.](https://mightygrc.com/hs-fs/hubfs/Email%20compromises%20can%20spread%20icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Email%20compromises%20can%20spread%20icon.%20MIGHTY%20GRC.png)Wednesday, 8:20 AM The next morning, your business receives two unexpected calls. First, another vendor says they received an unusual email from Alex requesting an updated invoice and customer payment details. Second, a customer says they received a message from Alex asking them to send payment to a new bank account. Your IT provider has not yet determined everything the unauthorized party accessed. The owner is concerned that sensitive customer or employee information may have been exposed. The business has cyber insurance, but nobody is sure what the policy requires. #### Your turn: Assess the impact 1. How would you determine which vendors, customers, and employees might be affected? 2. Who should coordinate external communications? 3. How would you warn potentially affected contacts without spreading inaccurate information? 4. Who would review cyber insurance notification requirements? 5. How would you determine whether legal or regulatory reporting obligations apply? 6. What would you say if a customer asks whether their personal information was compromised and you don't yet know? #### **![Facilitator guidance to lead your small business through a real world tabletop exercise with MIGHTY GRC.](https://mightygrc.com/hs-fs/hubfs/Facilitator%20guidance%20for%20tabletop%20exercise%20icon.%20MIGHTY%20GRC.png?width=100&height=100&name=Facilitator%20guidance%20for%20tabletop%20exercise%20icon.%20MIGHTY%20GRC.png)Facilitator guidance** Participants should distinguish confirmed facts from suspected exposure and unresolved questions. A strong response includes identifying affected parties, preserving relevant records, coordinating with IT and legal advisors where needed, reviewing insurance requirements, and planning accurate, timely communications. Reporting and notification duties depend on the incident facts, information involved, applicable laws, contractual obligations, and insurance policy. They should not be assumed to be identical for every small business. **Facilitator prompt:** "Who is allowed to tell customers that the incident has been contained? What evidence would they need before making that statement?" ***Complete Worksheet 7 (Communications and Notification Assessment).*** ### Stage 5. Recovery and rebuilding trust #### ![A tabletop exercise practicing a business email compromise or BEC can help a small business recover more quickly from an incident.](https://mightygrc.com/hs-fs/hubfs/Incident%20response%20and%20disaster%20recovery%20icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Incident%20response%20and%20disaster%20recovery%20icon.%20MIGHTY%20GRC.png)Friday, 2:00 PM Your IT provider reports that the identified unauthorized email access has been contained and that no additional suspicious activity has been detected since containment. The investigation remains open. Your bank has submitted a recovery request for the fraudulent payment, but the outcome is still unknown. Summit Office Solutions is concerned about its outstanding invoice. Two customers have asked for written confirmation that your payment instructions have not changed. Your employees are frustrated and uncertain about which payment requests they can trust. The immediate emergency may be stabilizing, but your business still has decisions to make. #### Your turn: What happens next? 1. How will you handle the legitimate unpaid vendor invoice without creating another fraud opportunity? 2. What must happen before the affected email account returns to normal use? 3. How will you verify that payment instructions shared with customers and vendors are correct? 4. What changes should be made to financial approvals, vendor records, and email security? 5. Who will communicate progress to employees and affected business partners? 6. How will you verify that the corrective actions actually work? #### **![Facilitator guidance to lead your small business through a real world tabletop exercise with MIGHTY GRC.](https://mightygrc.com/hs-fs/hubfs/Facilitator%20guidance%20for%20tabletop%20exercise%20icon.%20MIGHTY%20GRC.png?width=100&height=100&name=Facilitator%20guidance%20for%20tabletop%20exercise%20icon.%20MIGHTY%20GRC.png)Facilitator guidance** A strong recovery plan addresses both technical and business needs. Participants should consider secure account restoration, transaction reconciliation, verified vendor communication, appropriate follow-up with customers, and practical process improvements. The facilitator should challenge broad commitments such as "train employees" or "improve security." Ask for a specific action, an owner, a deadline, and evidence that the action was completed. ***Complete Worksheet 8 (Improvement Action Plan) and Worksheet 9 (Exercise Debrief).*** ## Part 4: The team debrief ### What did your team learn? The scenario is over. Now comes the most valuable part of the exercise: turning what you learned into improvements. #### ![MIGHTY GRC Quote for Small Business: People dedicated to clear goals using consistent processes make any business more resilient. ](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   Now comes the most valuable part: turning what you learned into improvements.  ![MIGHTY GRC Quote Icon](https://mightygrc.com/hs-fs/hubfs/Quote%20Icon%20Right.%20MIGHTY%20GRC.png?width=25&height=19&name=Quote%20Icon%20Right.%20MIGHTY%20GRC.png) ### Connect and discuss ![Use your team debrief to take a closer look at cybersecurity requirements and improvements for your small business.](https://mightygrc.com/hs-fs/hubfs/Team%20Debrief%20to%20take%20a%20closer%20look%20at%20security%20improvement%20requirements.%20MIGHTY%20GRC.png?width=300&height=278&name=Team%20Debrief%20to%20take%20a%20closer%20look%20at%20security%20improvement%20requirements.%20MIGHTY%20GRC.png "Use your team debrief to take a closer look at cybersecurity requirements and improvements for your small business.") **Bring the group back together and discuss the following questions:**   1. What did we handle well? 2. Which decisions took longer than expected? 3. Where were responsibilities unclear? 4. Which procedures did we assume existed but couldn't locate? 5. Which actions depended on a single employee or outside provider? 6. What could have prevented or reduced the impact? 7. What are the three most important improvements we can make next? ### Assess your response readiness #### How Ready Is Your Business to Respond to Email Fraud? You've worked through the scenario, discussed your decisions, and identified potential gaps. Now it's time to see how prepared your business is to recognize, prevent, and respond to business email compromise. Use the **Business Email Compromise Readiness Scorecard** to evaluate seven key areas of your organization's security practices, from employee awareness and payment approvals to incident response and ongoing improvement. #### Step 1: Score Your Readiness Review each of the seven questions on the scorecard and select the response that best reflects your business's current capabilities. - **0 points – Not Ready:** We don't have reliable procedures or safeguards in place, or we're unsure how we would respond. - **1 point – Somewhat Ready:** We've started addressing this area, but our processes are incomplete, informal, or inconsistently followed. - **2 points – Mostly Ready:** We have most of the necessary safeguards and procedures in place, but some improvements or additional testing are needed. - **3 points – Fully Ready:** We have documented procedures, clear responsibilities, and safeguards that have been implemented and tested. **Be realistic.** The goal isn't to get a perfect score. It's to identify where your business can improve. #### **Business Email Compromise Readiness Scorecard** *This is a self-assessment tool designed to support discussion and improvement, not a formal cybersecurity maturity assessment.* ![Use your BEC tabletop exercise to score your business on your readiness to handle an email compromise or other security incident.](https://mightygrc.com/hs-fs/hubfs/Business%20Email%20Compromise%20Readiness%20Scorecard.%20MIGHTY%20GRC.png?width=700&height=1050&name=Business%20Email%20Compromise%20Readiness%20Scorecard.%20MIGHTY%20GRC.png "Use your BEC tabletop exercise to score your business on your readiness to handle an email compromise or other security incident.")   Evaluate your business across these seven areas: 1. **Team Awareness:** Can your employees recognize suspicious emails and understand the risks of business email compromise? 2. **Policies & Procedures:** Do you have clear, documented processes for handling suspicious emails and payment requests? 3. **Technical Protections:** Are essential email security safeguards, such as multifactor authentication and email filtering, in place? 4. **Communication Channels:** Do employees know how to report suspicious activity and who to contact? 5. **Approval Processes:** Do you have verification procedures for financial transactions and changes to payment information? 6. **Incident Response:** Does your team have a clear plan for responding quickly to suspicious or compromised email accounts? 7. **Ongoing Improvement:** Do you regularly review lessons learned, update procedures, and reinforce employee awareness? #### Step 2: Calculate your score Add the points from all seven questions to calculate your total readiness score. ***Your maximum possible score is 21 points.*** #### Step 3: Understand your results **![Your small business has a strong cybersecurity posture and is ready to address security incidents.](https://mightygrc.com/hs-fs/hubfs/Strong%20readiness%20for%20security%20events%20icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Strong%20readiness%20for%20security%20events%20icon.%20MIGHTY%20GRC.png)18–21 Points: Strong Readiness** Your business reports having nearly all the essential safeguards, procedures, and responsibilities needed to recognize, prevent, and respond to business email compromise. That's a strong foundation! But even well-established security measures need regular attention to remain effective. Focus on maintaining and testing your existing procedures, reinforcing employee awareness, and addressing any remaining weaknesses. Pay particular attention to areas where you didn't score a 3, and confirm that your team can consistently follow established procedures. **![Moderate levels of security readiness for incidents in a small business.](https://mightygrc.com/hs-fs/hubfs/Moderate%20security%20readiness%20icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Moderate%20security%20readiness%20icon.%20MIGHTY%20GRC.png)13–17 Points: Moderate Readiness** Your business has several important security practices in place, but meaningful gaps may still leave you vulnerable to email fraud or slow your response to an incident. Review the areas where you scored 0, 1, or 2. Are employees unsure how to report suspicious activity? Are payment approvals inconsistent? Are your incident response procedures incomplete or untested? Prioritize improvements that could have the greatest impact on preventing financial loss, protecting sensitive information, and minimizing business disruption. **![Your business is at higher risk of impact from a security event or incident.](https://mightygrc.com/hs-fs/hubfs/Higher%20risk%20for%20security%20event%20impact%20icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Higher%20risk%20for%20security%20event%20impact%20icon.%20MIGHTY%20GRC.png)0–12 Points: Higher Risk** Your responses suggest that your business may have significant gaps in its ability to recognize, prevent, or respond to business email compromise. Even if you have some safeguards in place, missing or inconsistent procedures can create opportunities for fraud and make it harder to respond effectively when something goes wrong. Start with the fundamentals: employee awareness, independent payment verification, email account security, and [**clear incident response responsibilities**](https://mightygrc.com/mighty-blog/small-business-incident-response-plan?hsLang=en). You don't need to address everything at once. Identify your most important risks, assign ownership, and begin implementing practical safeguards your team can consistently follow. #### ![MIGHTY GRC Quote for Small Business: People dedicated to clear goals using consistent processes make any business more resilient. ](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   Your score is a starting point, not the finish line.  ![MIGHTY GRC Quote Icon](https://mightygrc.com/hs-fs/hubfs/Quote%20Icon%20Right.%20MIGHTY%20GRC.png?width=25&height=19&name=Quote%20Icon%20Right.%20MIGHTY%20GRC.png) #### Step 4: Turn your results into action Your score is a starting point, not the finish line. Review your lowest-scoring areas and document the security gaps you've identified in your [**Security Improvement Roadmap**](https://mightygrc.com/mighty-blog/small-business-cybersecurity-roadmap?hsLang=en). For each improvement, record the associated business risk, risk level, recommended action, responsible owner, target completion date, and how you'll verify that the improvement works. **Before wrapping up the exercise, agree on your three highest-priority improvements and assign someone to each one.** ![Download the MIGHTY workbook to take your email security tabletop exercise to actionable results and cybersecurity improvements.](https://mightygrc.com/hs-fs/hubfs/Email%20Security%20Investigation%20and%20Improvement%20with%20MIGHTY%20GRC.png?width=300&height=296&name=Email%20Security%20Investigation%20and%20Improvement%20with%20MIGHTY%20GRC.png "Download the MIGHTY workbook to take your email security tabletop exercise to actionable results and cybersecurity improvements.") ### From exercise to action   Want to save your results and turn them into an action plan? Download ***T****he MIGHTY Business Email Compromise Tabletop Exercise** **Workbook***, complete with a printable readiness scorecard, decision logs, and security improvement worksheets. DOWNLOAD YOUR FREE PDF GUIDE (coming soon) ### So, what should you do with your results? #### 1. Document what you discovered. Record the gaps, unclear responsibilities, missing procedures, and opportunities for improvement identified during the exercise. Include what happened, why it matters, and any decisions your team made. Use your Exercise Debrief or After-Action Report, available in the downloadable workbook, to capture these findings while they're fresh. #### 2. Add improvements to your Security Improvement Roadmap. Not every observation requires a new policy, but [**every meaningful security gap should be evaluated**](https://mightygrc.com/mighty-blog/cybersecurity-roadmap-benefits?hsLang=en) and addressed. For each improvement, document: - **The gap:** What needs to be fixed or improved? - **The risk:** What could happen if it isn't addressed? - **Risk level:** Is the potential risk High, Medium, or Low? - **Recommended action:** What specific steps will reduce the risk? - **Action owner:** Who is responsible for making it happen? - **Target date:** When should the improvement be completed? - **Status:** Where does the improvement stand? - **Verification:** How will you confirm the improvement is effective? Start with improvements that address the most significant risks to your business, particularly those that could lead to financial loss, compromised information, or interrupted operations. #### 3. Update the policies and procedures your team actually uses. Some improvements will require changes to existing policies, procedures, or business practices. #### ![MIGHTY GRC Quote for Small Business: People dedicated to clear goals using consistent processes make any business more resilient. ](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   The goal isn't to create more documentation. It's to make sure your team has clear, practical instructions they can easily follow when they really need them.  ![MIGHTY GRC Quote Icon](https://mightygrc.com/hs-fs/hubfs/Quote%20Icon%20Right.%20MIGHTY%20GRC.png?width=25&height=19&name=Quote%20Icon%20Right.%20MIGHTY%20GRC.png) For example: If your team discovers that vendor banking changes aren't independently verified, you may need to update your accounts payable procedures. If employees don't know how to report suspicious emails, your Information Security Policy or Incident Response Plan may need clarification. If nobody knows who to contact during a security incident, your Incident Response Plan should include clear responsibilities and current emergency contact information. The goal isn't to create more documentation. It's to make sure your team has clear, practical instructions they can easily follow when they really need them. #### 4. Assign ownership and follow through. Before ending the exercise, identify your highest-priority improvements, assign someone to each action, and agree on target completion dates. You don't need to solve every problem during the tabletop exercise. You do need a plan for addressing the problems you've identified. Schedule a follow-up review to check progress, remove roadblocks, and confirm completed improvements are working as intended. #### 5. Practice again. Once you've made meaningful improvements, revisit the scenario or conduct another tabletop exercise. ![Small businesses need strong compliance and policies for risk management.](https://mightygrc.com/hs-fs/hubfs/Small%20Business%20Compliance%20Software%20for%20Risk%20Management.%20MIGHTY%20GRC.png?width=600&height=300&name=Small%20Business%20Compliance%20Software%20for%20Risk%20Management.%20MIGHTY%20GRC.png)Can your team make decisions more confidently? Are responsibilities clearer? Can employees locate and follow the procedures they need? That's how you'll know your business is making progress.   --- ![Progress beats perfection when improving the cybersecurity posture of your small business. ](https://mightygrc.com/hubfs/MIGHTY%20Mindset%20Letter%20Icon%20from%20MIGHTY%20GRC.png "Progress beats perfection when improving the cybersecurity posture of your small business. ") ### Progress beats perfection. #### You don't need to fix every security gap overnight. > Start with the risks that matter most, assign clear responsibilities, and make steady improvements. > > A good **Security Improvement Roadmap** turns what you've learned into a plan. Following that plan is what makes your business more resilient. [Explore the benefits of cybersecurity roadmap planning](https://mightygrc.com/mighty-blog/cybersecurity-roadmap-benefits?hsLang=en) ## Part 5: The 30-day resiliency plan ### 30 days to a stronger, more resilient small business Completing a tabletop exercise is a useful first step. Acting on the findings is what actually makes your business more resilient. #### Days 1–3 **Address immediate risks** Confirm emergency contacts, clarify who can stop payments, and establish a reliable method for verifying banking changes. #### Days 4–14 **Document and communicate procedures** Update payment approvals, incident response responsibilities, and email security procedures. Make sure the right people know how to use them. #### Days 15–30 **Verify and improve** Test the new verification procedure with a simulated request, review remaining gaps, and confirm that assigned improvements were completed. ![30 day plan to business resilience after a tabletop exercise with MIGHTY GRC.](https://mightygrc.com/hs-fs/hubfs/Business%20Growth%20and%20Resilience%20in%2030%20days%20icon.%20MIGHTY%20GRC.png?width=500&height=333&name=Business%20Growth%20and%20Resilience%20in%2030%20days%20icon.%20MIGHTY%20GRC.png "30 day plan to business resilience after a tabletop exercise with MIGHTY GRC.") #### ![MIGHTY GRC Quote for Small Business: People dedicated to clear goals using consistent processes make any business more resilient. ](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   Acting on the findings is what actually makes your business more resilient.  ![MIGHTY GRC Quote Icon](https://mightygrc.com/hs-fs/hubfs/Quote%20Icon%20Right.%20MIGHTY%20GRC.png?width=25&height=19&name=Quote%20Icon%20Right.%20MIGHTY%20GRC.png) ***These are suggested planning windows, not deadlines for incident response and [disaster recovery plans](https://mightygrc.com/mighty-blog/small-business-disaster-recovery-plan?hsLang=en).*** ***Urgent vulnerabilities should be addressed as soon as possible.*** --- ![Progress beats perfection when improving the cybersecurity posture of your small business. ](https://mightygrc.com/hubfs/MIGHTY%20Mindset%20Letter%20Icon%20from%20MIGHTY%20GRC.png "Progress beats perfection when improving the cybersecurity posture of your small business. ") ### Your small business doesn't need a complicated cybersecurity program. #### The best response plan is one your team can actually follow. > Your business needs clear responsibilities, practical procedures, reliable contacts, and people who know what to do when something doesn't look right. > > Start with the gaps this exercise uncovered. Make improvements you can sustain. Then practice again. > > Because every good decision makes your business a little more resilient. [Explore small business resiliency strategies](https://mightygrc.com/mighty-blog/small-business-resilience-strategies?hsLang=en) ### Turn lessons learned into lasting business resilience Knowing how your business should respond to a security incident is one thing. Making sure those expectations are clearly documented, communicated, and consistently followed is another. That's where practical, well-maintained policies make a difference. With [**PolicyPilot from MIGHTY GRC**](https://mightygrc.com/products/policypilot?hsLang=en), creating and maintaining practical business policies doesn't have to be complicated. From information security and incident response to acceptable use and AI, PolicyPilot helps you build customized policies that reflect how your business actually operates. And with built-in approval workflows and automated review reminders, your policies can stay relevant as your business grows. **The best policies don't just document what your business *should* do. They give your team clear, actionable guidance to *actually get it done*.** ### Ready for resiliency? Still not sure of the next step? **Explore how PolicyPilot can help your team work more independently with clear policies and procedures, make faster and more informed decisions, respond effectively when things go wrong, and build the strong operational foundation your business needs to grow with confidence.** ![PolicyPilot Icon. Tight. MIGHTY GRC](https://mightygrc.com/hs-fs/hubfs/PolicyPilot%20Icon.%20Tight.%20MIGHTY%20GRC.png?width=400&height=69&name=PolicyPilot%20Icon.%20Tight.%20MIGHTY%20GRC.png "PolicyPilot Icon. Tight. MIGHTY GRC") #### Get compliant in just a few clicks. [EXPLORE POLICYPILOT](https://mightygrc.com/products/policypilot?hsLang=en)[GET A FREE DEMO](https://mightygrc.com/policypilot-demo?hsLang=en) ## Frequently Asked Questions Have questions about running a business email compromise tabletop exercise? We've answered some of the most common questions to help you get started, make the most of your exercise, and put what you've learned into practice. Still have a question? [**Reach out to the MIGHTY team.**](https://mightygrc.com/contact?hsLang=en) What is a business email compromise tabletop exercise? A business email compromise tabletop exercise is a discussion-based simulation that helps an organization practice recognizing and responding to email-related fraud. Participants work through a realistic scenario, make decisions, identify weaknesses, and document improvements without affecting real systems or transactions. [***Learn more about business continuity and disaster recovery  \> \>***](https://mightygrc.com/mighty-blog/small-business-continuity-plan?hsLang=en) How long does a business email compromise tabletop exercise take? This exercise is designed to take approximately 45–60 minutes, including scenario discussions and a brief debrief. Additional time may be needed to complete the worksheets, investigate identified gaps, and implement improvements. ***The free MIGHTY tabletop exercise workbook can be downloaded here  \> \>*** Can a small business conduct a tabletop exercise without an IT department? **Yes.** Business owners, managers, and employees can conduct a tabletop exercise without dedicated cybersecurity personnel. An outside IT provider or managed service provider (MSP) can provide additional technical insight, especially when discussing email account containment and evidence preservation. ***Explore the benefits of working with an MSP as a small business  \> \>*** Who should participate in a BEC tabletop exercise? Participants should include people responsible for financial approvals, vendor management, business operations, and incident response. Small businesses can combine roles or complete the exercise with a smaller team. What should a business do if it discovers a fraudulent payment? 1\. Contact the sending financial institution immediately, report the suspected fraud, and request available recovery actions. 2\. Quickly preserve relevant evidence. 3\. Report the incident to the FBI's Internet Crime Complaint Center at [ic3.gov](https://www.ic3.gov?utm_source=chatgpt.com). Prompt action may improve recovery opportunities, but recovery is not guaranteed. [***Learn more about why your small business needs a Disaster Recovery Plan  \> \>***](https://mightygrc.com/mighty-blog/small-business-disaster-recovery-plan?hsLang=en) How often should small businesses conduct tabletop exercises? An annual exercise is a reasonable starting point for many small businesses, with additional exercises after significant process changes, security incidents, or newly identified risks. Businesses with greater financial exposure or more complex operations may benefit from more frequent practice. What should happen after the tabletop exercise? The business should document its findings, prioritize improvements, assign owners and deadlines, and verify completion. The completed worksheets should support actual business procedures rather than remain unused exercise materials. [***Explore how actionable policies and processes can lead to greater team autonomy and productivity  \> \>***](https://mightygrc.com/mighty-blog/small-business-policy-productivity?hsLang=en) #### **Thank you from the MIGHTY team. We are dedicated to offering learning resources for small and midsized businesses that are supportive, actionable, and will actually get used.** **Share your thoughts [HERE](https://mightygrc.com/contact?hsLang=en).** > **This tabletop exercise is provided for educational and informational purposes only.** It is designed to help small businesses practice responding to potential cybersecurity incidents, evaluate their preparedness, and identify opportunities for improvement. It does not constitute legal, financial, cybersecurity, insurance, or other professional advice. > > The scenarios, checklists, readiness assessments, and recommendations are illustrative and may not reflect your organization's specific risks, systems, industry requirements, contractual obligations, or regulatory responsibilities. Exercise results and readiness scores are not formal security assessments, certifications, or guarantees of protection against cyber threats. > > **All exercise activities should be simulated.** Participants should not initiate real financial transactions, modify live systems, or contact external parties as part of the exercise. If an actual security incident is suspected or discovered, stop the simulation and follow your organization's Incident Response Plan, including seeking qualified assistance when appropriate. > > Before implementing changes to your policies, procedures, or security practices, evaluate their suitability for your business and consult qualified professionals when necessary. > > While MIGHTY GRC strives to provide accurate and useful information, cybersecurity threats, laws, regulations, and industry practices evolve. MIGHTY GRC makes no warranties regarding the accuracy, completeness, or applicability of this material to any particular organization. > > **Use this exercise as a practical starting point for improving your organization's security and resilience, not as a substitute for professional guidance or an incident response plan tailored to your business.**   [Learn more about MIGHTY GRC's values and mission](https://mightygrc.com/about-mighty-grc?hsLang=en) ![Screenshot 2026-06-16 at 4.49.38 AM](https://mightygrc.com/hs-fs/hubfs/Screenshot%202026-06-16%20at%204.49.38%20AM.png?width=3244&height=1258&name=Screenshot%202026-06-16%20at%204.49.38%20AM.png) ## MIGHTY GRC MIGHTY is GRC software custom built for small teams to simplify compliance and risk management. Generate policies, assess risk, and stay compliant in one streamlined platform designed for SMBs. - Products - Pricing - Resources - Company - [Blog](https://mightygrc.com/mighty-blog?hsLang=en) - [GET A DEMO](https://mightygrc.com/policypilot-demo?hsLang=en) --- Privacy Policy · Legal · © 2026. All rights reserved.