Run a Cyber Tabletop Exercise: A Practical SME Walkthrough

A cyber tabletop exercise is a facilitated, discussion-based walkthrough of a realistic cyber incident — your team talks through how they’d respond, step by step, while a facilitator throws in complications. No real systems are touched, no production data is at risk. For the price of a couple of hours in a room, it’s the cheapest, highest-value security exercise an SME can run.

Most businesses buy controls and assume they’d cope on the day. A tabletop tests the assumption before an actual attacker does. It exposes the awkward gaps — who decides whether to pay a ransom, where the offline contacts list lives, whether anyone has actually read the cyber insurance policy — while the cost of finding out is a meeting, not a disaster.

What a tabletop exercise actually is

The format is deliberately low-tech. You gather the right people in a room, present a plausible incident, and walk through the response as a guided conversation. The facilitator describes the scenario, reveals new information at intervals (“injects”), and asks decision questions at each turn: What do we do now? Who makes that call? Who do we have to notify, and by when?

Nothing is simulated technically. You’re not unplugging servers or launching a fake phishing campaign — that’s a live or red-team exercise, a different and more expensive thing. A tabletop tests your decisions, your roles, your communications and your documentation. It answers the question that controls alone never do: when something goes wrong at 4:45pm on a Friday, does this team actually know what to do?

That’s why it sits at the top of the value-for-money list. A penetration test tells you whether attackers can get in. A tabletop tells you whether you can respond once they have. We cover the testing side in our piece on penetration testing; this is the other half of the picture.

Why it’s the best-value exercise you can run

Three reasons. First, cost: the only real input is people’s time, usually 90 minutes once or twice a year. No tooling, no consultants required for a first pass. Second, breadth: in one session you stress-test your incident plan, your decision-making, your notification obligations and your backups all at once. Third, it surfaces the failures that genuinely sink SMEs — not technical zero-days, but the human and process gaps. Nobody knew who could authorise a payment hold. The disaster recovery plan referenced a staff member who left in 2022. The “current” backup hadn’t been test-restored in eighteen months.

Those are the things that turn a manageable incident into a week of chaos, and a tabletop finds them in an afternoon.

Who should be in the room

The single biggest mistake is treating a cyber incident as an IT problem and inviting only IT. A real incident is a business event with legal, financial, operational and reputational consequences. The people who’ll actually make the decisions on the day need to be the people in the exercise.

• Owner or managing director — the person who ultimately decides whether to pay, to go public, to pull systems offline. Their absence is the most common reason a tabletop is toothless.
• Operations — they understand what the business can and can’t run without, and what “down for a day” actually costs.
• Finance — for ransom and fraud scenarios especially. They hold the payment controls and know the bank relationships.
• IT or your MSP — to speak to containment, recovery, what’s logged and what can realistically be restored, and how fast.
• Communications or whoever fronts customers — staff, clients, suppliers and possibly media all need handling, and silence is its own decision.

For a small business these might be five people wearing seven hats, and that’s fine. The point is to have every function represented, not to fill seats.

How to run one

1. Pick a realistic scenario

Choose something that could plausibly happen to your business, not a Hollywood cyber-war. The four that matter most for Australian SMEs:

• Ransomware — files encrypted, a ransom note, operations halted.
• Business email compromise (BEC) payment fraud — a supplier’s “updated bank details” email that diverts a real payment.
• A stolen or lost laptop — a device with mailbox and file access gone from a cafe or car.
• Microsoft 365 account takeover — a phished login giving an attacker access to mail, files and Teams.

Rotate the scenario each time. Don’t run ransomware every year and call it covered.

2. Inject complications

The scenario shouldn’t unfold cleanly. Part-way through, the facilitator reveals a twist: the backups are also encrypted; the one person who knows the firewall is on a plane; a journalist has already called. Injects are where comfortable plans fall apart and the real learning happens.

3. Ask decision questions and capture gaps

At each stage, push for specifics. Who makes this call? Who do we legally have to notify, and within what window? Where’s our offline list of contacts if email and Teams are down? The facilitator’s job is to record every “we’re not sure” and “we’d have to check” — those uncertainties are the output. A scribe writing down each gap and unanswered question is what turns the session into something actionable.

A sample 90-minute agenda

A sample scenario you can run

Here’s one a real Melbourne SME could use verbatim. A manufacturing business in Dandenong arrives Monday to find production-planning files won’t open and a ransom note demanding payment in cryptocurrency sits on the shared drive. Staff can’t process orders.

Work through it: Who’s leading the response? Do we shut down the network to contain it? Inject one — IT reports the most recent backup ran successfully but has never been test-restored, so nobody can confirm it works. Inject two — a production supervisor mentions they reused their work password on a personal site that was breached last year. Inject three — a key customer rings asking why their order is late, and a second emails asking if their data is safe.

Now the hard questions. Do we engage our cyber insurer before doing anything, given the policy may require it? Does this trigger the Notifiable Data Breaches scheme, and who assesses that? Who tells staff what they can and can’t say? You’ll likely find at least three things nobody had a confident answer for — which is exactly the point.

Turning findings into actions

A tabletop that ends with a nice discussion and no follow-up was a waste of an afternoon. Before everyone leaves, every gap on the list needs an owner and a date. “Build an offline contact sheet — Ops, two weeks.” “Test-restore the backups quarterly — MSP, ongoing.” “Add a verbal-confirmation rule for any bank-detail change over $5,000 — Finance, this week.” We feed these straight into a remediation plan, and the most valuable ones usually point at controls: multi-factor authentication everywhere, conditional access, tested backups. Those tie into the work we describe in our guides on conditional access in Microsoft 365 and recovery time and recovery point objectives.

The second run, six to twelve months later, should open by checking off the previous list. That closed loop — find, fix, verify — is what separates a business that’s genuinely ready from one that merely owns an incident response plan.

How often to run one

Annually as a baseline, and again after any major change: a new core system, a merger or acquisition, a shift to a new cloud platform, or significant staff turnover in the key roles. A plan written around last year’s team and last year’s systems quietly goes stale. An annual rhythm keeps it current and keeps the muscle memory warm.

How it satisfies insurers and Essential Eight expectations

This isn’t only good practice — it increasingly maps to what insurers and frameworks expect. Cyber insurance applications and renewals now routinely ask whether you have an incident response plan and whether you test it. “Yes, and we run a tabletop annually” is a materially stronger answer than a dusty document, and it can shape both whether you’re covered and what you pay. We unpack this in our cyber insurance guide for Australian SMEs.

On the framework side, the Australian Cyber Security Centre (ACSC) builds the Essential Eight around technical mitigations, but the higher maturity levels and the broader ACSC guidance assume you can actually respond to and recover from an incident — tested backups, a workable plan, and people who know their roles. A tabletop is how you prove the human side of that holds together, not just the technical controls. It’s the rehearsal that makes the documentation real.

Frequently asked questions

How long should a tabletop exercise take?

90 minutes to two hours is the sweet spot for an SME. Long enough to work through a scenario and a few injects properly, short enough that busy decision-makers will actually commit the time. Anything under an hour rarely gets past the obvious; anything over half a day usually means too many people or too broad a scope.

Do we need an external facilitator?

Not for your first one. A capable internal lead or your MSP can run it from a prepared scenario. An independent facilitator earns their keep later, because they ask the uncomfortable questions an internal person might smooth over, and they can play injects without the group seeing them coming.

What’s the difference between a tabletop and a real simulation?

A tabletop is a discussion — you talk through decisions, nothing technical happens. A live simulation or red-team exercise actually executes attacks or recovery steps against real systems. Tabletops are cheaper, lower-risk and where every business should start; simulations come later, once the basics are solid.

Who should facilitate if the MD needs to be a participant?

Whoever facilitates should stay neutral and not be a decision-maker in the scenario, so the MD participates rather than runs the session. That’s a common reason businesses bring in their MSP or an external facilitator — it frees the leadership team to actually make the calls.

Where to start

You don’t need a budget or a consultant to begin. Pick one scenario from this post, block 90 minutes, get the right five people in a room, and walk it through. Capture every gap and assign an owner before you leave. That single session will tell you more about your real readiness than any amount of policy documentation.

If you’d rather have it facilitated properly — a tailored scenario, sharp injects, and a remediation plan you can actually action — that’s part of what we do. TechAssist is a Melbourne-based MSP founded in 2014, with 13 Australian-employed engineers and a 24/7 NOC in Tecoma, and we run tabletop exercises as part of our cybersecurity services. Get in touch and we’ll help you rehearse the bad day before it arrives.

Registered Training Organisations live or die on their data. RTO IT support means keeping your Student Management System, AVETMISS reporting, USI checks and online delivery running and secure — because if your records are wrong or breached, ASQA and your students both notice fast.

We work with vocational training providers across Melbourne, and the pattern is consistent: the compliance burden is enormous, the margins are thin, and the IT is usually held together by one overworked admin and a pile of spreadsheets. This post covers what actually matters for an RTO’s IT — the systems, the obligations, and where things break.

Why RTOs are a different beast to most SMEs

A 30-person consultancy in Hawthorn loses email for a morning and it’s annoying. An RTO loses its Student Management System during a reporting deadline and it’s a regulatory problem. The difference is that almost everything an RTO does — enrolments, results, certificates, funding claims — is data that ASQA, NCVER and state training authorities can audit, and that students are legally entitled to.

That changes how you have to think about IT. It’s not just “keep the laptops working”. It’s records integrity, retention, access control and uptime around fixed reporting windows. Get those wrong and you risk funding clawbacks, audit non-compliance, or a notifiable data breach. Our professional services IT support grew out of exactly this kind of compliance-heavy work, and RTOs sit right in that bracket.

The Student Management System is the heart of everything

Your Student Management System (SMS) is where the real risk lives. Whether you run aXcelerate, VETtrak, Wisenet or JobReady, this is the single system that holds enrolments, competencies, results, certificates and the data that feeds your AVETMISS exports. If it’s down, you can’t enrol. If it’s corrupted, you can’t report. If it’s breached, you’ve got a privacy incident.

Most of these are cloud-hosted (aXcelerate and Wisenet in particular), which removes some infrastructure headaches but introduces others. You’re now dependent on identity, internet reliability and integration plumbing instead of a local server. The IT job shifts from “patch the box in the cupboard” to “make sure the right people can get in, the wrong people can’t, and the integrations don’t silently fail”.

What we actually manage around an SMS

• Access control — who can see and edit student records, and removing access the day a trainer leaves, not three months later.
• Integrations — the SMS talking to your LMS, your USI checks, your CRM and your accounting system. These break quietly; nobody notices until a sync has been failing for a fortnight.
• Browser and device health — cloud SMS platforms are only as reliable as the machines and connections your staff use to reach them.
• Export integrity — making sure AVETMISS files generate cleanly and aren’t being mangled by stale data or duplicate records.

AVETMISS, NCVER and ASQA: the reporting you can’t get wrong

Every RTO has to report training activity in the AVETMISS format — the national standard for VET data, collected by the National Centre for Vocational Education Research (NCVER) and used by ASQA and state authorities. For most providers that means AVETMISS submissions through NCVER’s collection system, with strict validation rules and fixed annual deadlines.

IT’s role here is unglamorous but critical: the export only works if the underlying data is clean. We’ve seen AVETMISS submissions bounce repeatedly because of duplicate student records, mismatched USI data, or a half-finished migration that left two versions of the truth. None of that is a “training” problem — it’s a data hygiene and systems problem, which is squarely IT’s job.

Practical reality: your SMS does most of the AVETMISS heavy lifting, but it can only export what’s in it correctly. The work is keeping the inputs clean — consistent course codes, deduplicated learners, validated USIs — so the file passes NCVER validation the first time instead of eating a week of your compliance manager’s life.

USI integration — small system, big consequences

Every student needs a verified Unique Student Identifier (USI), and you can’t issue a nationally recognised qualification without one. Most SMS platforms integrate directly with the USI Registry to verify identifiers at enrolment. When that integration is configured correctly it’s invisible. When it isn’t, you get a backlog of unverified students and certificates you legally can’t issue.

The integration relies on credentials and certificates that expire. A training provider in Box Hill we work with had USI verification silently stop working for a fortnight because an integration certificate lapsed and nobody owned the renewal. The fix was trivial; the cause was that no one was watching it. That’s the gap managed IT closes — owning the boring renewals and monitoring so they don’t become a crisis.

LMS and online delivery: Moodle, Canvas and uptime that matters

If you deliver online or blended training, your Learning Management System (LMS) is student-facing infrastructure, and outages are immediately visible. Moodle (including hosted Moodle and MoodleCloud) and Canvas are the two we see most. The reliability question depends on how it’s hosted:

Self-hosted Moodle is where most of the avoidable pain lives. It’s cheap to stand up and expensive to neglect — an unpatched Moodle is a genuine security liability, and a slow one during assessment week generates a flood of student complaints. If you run your own Moodle, it needs the same patching and monitoring discipline as any production server. Our managed IT services cover that so it isn’t left to whoever set it up two years ago.

Protecting student PII and the Privacy Act

RTOs hold a lot of sensitive personal information: full names, dates of birth, USIs, government identity documents used for verification, language and disability data, sometimes payment details. Under the Privacy Act 1988 and the Australian Privacy Principles, you’re responsible for protecting it, and a serious breach is notifiable to the Office of the Australian Information Commissioner (OAIC) and to affected students.

The threats are ordinary, not exotic. Phishing that harvests a trainer’s Microsoft 365 password. A shared admin login that never gets rotated. Student records emailed around as unprotected spreadsheets. The controls that stop most of this are well established and align with the Australian Cyber Security Centre’s (ACSC) Essential Eight:

• Multi-factor authentication on every account that touches student data — non-negotiable, and the single highest-value control.
• Conditional access so logins from unexpected locations or unmanaged devices are challenged or blocked. We cover the detail in conditional access policies for Microsoft 365.
• Least-privilege roles in the SMS and LMS so a marketing coordinator can’t export the entire learner database.
• Email security and phishing defence, because that’s still how most breaches start.

If you want a structured path through this, our cybersecurity services are built around the Essential Eight and the kind of identity controls that genuinely reduce breach risk for an RTO.

The Standards for RTOs 2025

The revised Standards for RTOs took effect from 1 July 2025, replacing the 2015 standards. The headline change is a shift toward outcomes and quality, with clearer expectations around governance, the integrity of records and the experience of learners. They don’t prescribe a particular IT stack, but several obligations land directly on your systems.

Specifically, the standards reinforce that you must keep accurate, secure and accessible records of training and assessment, manage learner information responsibly, and be able to produce evidence on request during an ASQA audit. In practice that means: records that are backed up and retrievable, access that’s controlled and logged, and an SMS you can actually report from. If your IT can’t demonstrate those things, you’ve got a compliance exposure regardless of how good your training is.

Backup and records retention

Records retention is one of the most concrete IT obligations an RTO has. You’re required to retain certain student and assessment records for set periods — AVETMISS and learner records for years, and assessment evidence under your standards obligations — and you must be able to produce them years after a student has left.

That’s a retention problem as much as a backup problem. A 30-day backup cycle protects you from accidental deletion last week; it does nothing for a record you need to produce from four years ago. RTOs need a deliberate retention strategy: where long-term records live, how they’re protected, and how they’re retrieved on demand. We design backup with both recovery and retention in mind — see our approach to data backup and recovery.

The other half is recovery speed. If your SMS or self-hosted LMS goes down mid-semester, how long until students and trainers are working again? That’s the RTO and RPO question — how much data you can afford to lose and how long you can be down — which we unpack in RTO vs RPO explained. (Yes, “RTO” means two different things in this world; the recovery one matters here too.)

Identity and access for trainers and students

RTOs have unusually messy identity needs. Trainers come and go, often part-time or contract. Students arrive in cohorts and leave in cohorts. Both groups need access to different systems, and both create risk when access isn’t cleaned up.

The pattern we put in place for training providers is simple to describe and a discipline to maintain:

1. Single sign-on through Microsoft 365 where the SMS and LMS support it, so there’s one identity to manage and revoke, not five.
2. Joiner-mover-leaver processes so a trainer who finishes a contract loses access that day across every system — SMS, LMS, email, shared drives.
3. Separate student and staff identity boundaries so a student LMS account can never reach administrative or AVETMISS data.
4. MFA everywhere on staff accounts, with sensible enrolment for students on systems that hold their PII.

Getting Microsoft 365 configured properly underpins most of this. If your tenancy is the typical “set up once, never reviewed” arrangement, our Microsoft 365 support is usually the first thing we tighten.

Reliable delivery infrastructure

None of the above matters if the basics aren’t reliable. A training room in Dandenong full of students who can’t reach the LMS because the internet dropped is a real cost — wasted trainer time, frustrated learners, and complaints that find their way into your quality data.

Reliable delivery infrastructure for an RTO means business-grade internet with sensible failover, classroom Wi-Fi that actually copes with a full cohort connecting at once, and devices that are patched and managed rather than a random fleet of whatever was on sale. It’s not glamorous, but it’s what keeps delivery running. As a Melbourne MSP founded in 2014 with 13 Australian-employed engineers and same-business-day on-site across the metro, this is the part we do quietly in the background so you never have to think about it.

Frequently asked questions

Does our Student Management System provider handle our IT?

No. aXcelerate, VETtrak, Wisenet and JobReady support their own platform — the software, hosting and platform-level issues. They don’t manage your Microsoft 365, your identity and access, your LMS, your devices, your network, or the integrations between systems. Those are your responsibility and are where most RTO IT problems actually occur.

How long do we have to keep student records?

Retention periods vary by record type and funding arrangement — AVETMISS and learner records run to years, and assessment evidence is governed by your standards obligations. The safe position is a deliberate, documented retention strategy with long-term records backed up and retrievable, rather than relying on a short backup window. Check current ASQA and NCVER guidance for the specific periods that apply to you.

Is MFA really mandatory for an RTO?

It’s not written into the Standards for RTOs as a named requirement, but it’s the single most effective control against the account compromise that causes most breaches of student PII. Given your Privacy Act obligations and the sensitivity of the data you hold, treating MFA as mandatory across all staff accounts is the only defensible position.

What happens to our data if we switch SMS providers?

This is where a clean migration matters. Done badly, you end up with duplicate records, broken USI links and AVETMISS exports that fail validation. Done well, your data is mapped, deduplicated and validated before cutover. We treat SMS migrations as a data integrity project, not a copy-paste exercise.

Where TechAssist fits

RTOs need an IT partner who understands that the compliance and the technology are the same conversation. We support training providers and other compliance-heavy organisations across Melbourne with fixed per-user pricing, sub-15-minute response on critical issues, and engineers who actually understand AVETMISS reporting, USI integration and the privacy obligations that come with holding student data.

If your SMS, LMS or Microsoft 365 setup is held together with goodwill and you’d rather it was held together with proper monitoring, backups and access control, get in touch. We’ll start with an honest look at where your real risks are — usually identity, retention and the integrations nobody’s watching — and tell you straight what needs fixing first.

Unlocking Business Growth through Cloud Solutions Adoption

The rapid expansion of cloud solutions has revolutionized the way businesses operate, fueling sustainable growth. With the right approach, businesses of all sizes can leverage the cloud’s immense potential to enhance productivity, streamline processes, and reduce costs. TechAssist, as a professional, knowledgeable, and customer-focused partner, plays a crucial role in helping businesses successfully adopt cloud solutions, ensuring a smooth operation of their IT infrastructure while reaping the maximum benefits.

Understanding Cloud Solutions and Their Components

Cloud computing is an innovative approach to storing, accessing, and processing data through a network of remote servers hosted on the internet, rather than on local servers or personal computers. This powerful technology enables businesses to harness a flexible, scalable, and cost-effective infrastructure that is fundamental to their growth and competitiveness.There are three primary types of cloud solutions: public, private, and hybrid. Public clouds offer services and resources on a shared platform, managed by third-party providers. Private clouds, on the other hand, are exclusively designed for a single organisation, offering greater control and security. Hybrid clouds combine the best of both public and private solutions, providing a tailored approach that meets the unique requirements of each business.The key components of cloud infrastructure include storage, compute, and networking. Storage refers to the capacity to hold data in various formats, such as files, databases, or data lakes. Compute entails the processing power needed to run applications and workloads, while networking represents the connectivity between different cloud services, users, and devices. These components work together seamlessly, empowering businesses to adopt and benefit from cloud solutions that drive their growth.

Exploring the Benefits of Cloud Solutions for Business Growth

Cloud solutions provide a myriad of advantages that can significantly contribute to a business’s growth. These benefits range from cost savings and increased operational efficiency to enhanced collaboration and improved security.One of the most compelling reasons to adopt cloud solutions is the potential for cost savings. By leveraging cloud services, businesses can reduce hardware and infrastructure expenses, as well as lower energy consumption and maintenance costs. Furthermore, the pay-as-you-go pricing models offered by cloud providers allow for better cost management and resource allocation.Scalability and flexibility are also critical advantages of cloud solutions. Growing businesses can easily and quickly allocate resources as needed, ensuring they have the capacity to meet increasing demands. On-demand access to resources and applications ensures that businesses can adapt to changing circumstances, while customizable solutions cater to the specific needs of each organisation.Cloud solutions also enhance collaboration and mobility within a business. Employees can remotely access data and applications, promoting a more agile and productive workforce. Real-time collaboration capabilities foster seamless communication and teamwork, while support for Bring Your Own Device (BYOD) policies facilitates increased employee engagement and satisfaction.Security and compliance are other vital benefits offered by cloud solutions. Providers invest in advanced data protection and encryption methods to safeguard sensitive information. Regular security updates and patches help businesses stay ahead of potential threats, and compliance with industry-specific regulations ensures that organisations maintain high standards of data privacy and integrity.Finally, cloud solutions can drive increased operational efficiency. Automation of repetitive tasks frees up valuable time and resources, while streamlined workflows and processes enhance productivity. Faster deployment of applications and services ensures that businesses can quickly capitalize on new opportunities, further fueling their growth.

Navigating the Cloud Adoption Process for Business Growth

Successfully adopting cloud solutions for business growth requires a strategic approach that encompasses several key steps. The first step involves assessing your current IT infrastructure and requirements, which allows you to identify areas that could benefit from the capabilities offered by the cloud. This evaluation will help you determine the most appropriate cloud services and solutions for your organisation’s needs.Choosing the right cloud service provider and solution is a critical decision that will significantly impact your business’s growth potential. Careful consideration should be given to factors such as performance, security, compliance, and pricing. Additionally, it’s essential to evaluate the provider’s reputation, customer support, and track record of success.Planning and executing a smooth transition to the cloud is vital to minimise disruption and ensure a positive outcome. This process may include migrating data, applications, and workloads, as well as training staff on new systems and processes. It’s crucial to develop a detailed plan and timeline, with clear objectives and milestones, to keep the project on track and manage expectations.Continuous monitoring and optimisation of cloud usage are necessary to maximise the benefits of your cloud solutions. This includes analysing performance metrics, identifying potential issues, and implementing improvements to enhance efficiency and cost-effectiveness. Regularly reviewing and adjusting your cloud strategy will help your business stay agile and responsive to evolving needs and opportunities, driving sustainable growth.

How TechAssist Supports Cloud Adoption for Sustainable Business Growth

As a professional, knowledgeable, and customer-focused partner, TechAssist plays a crucial role in supporting businesses through their cloud adoption journey, ensuring they can harness the full potential of cloud solutions for growth. Our team of experts offers advice and consultation on cloud strategy, helping organisations identify the most suitable cloud services and solutions to meet their needs.TechAssist ensures a seamless implementation and integration of cloud solutions by working closely with businesses to develop a detailed plan and timeline, migrate data and applications, and train staff on new systems and processes. Our commitment to providing ongoing support and management for cloud infrastructure ensures that businesses can focus on their core activities while trusting that their IT systems are in capable hands.To deliver optimal performance and security, TechAssist continuously monitors and optimizes cloud systems, analysing performance metrics and implementing improvements as needed. This proactive approach helps businesses stay agile, responsive, and competitive in an ever-changing landscape. By partnering with TechAssist, organisations can confidently embark on their cloud adoption journey, unlocking the benefits of cloud solutions for sustainable business growth.

Empower Your Business with Cloud Solutions and TechAssist

Adopting cloud solutions for business growth presents numerous advantages, including cost savings, scalability, flexibility, enhanced collaboration, and improved security. To fully leverage these benefits, partnering with a knowledgeable and reliable IT provider like TechAssist is crucial. Our team offers expert advice, seamless implementation, and ongoing support for cloud infrastructure, ensuring optimal performance and security. We encourage businesses to explore cloud solutions as a key component of their growth strategy. With TechAssist by your side, you can confidently navigate the cloud adoption process and unlock the full potential of this transformative technology. Learn more about how TechAssist can support your business growth with cloud solutions.