# How Should Hotels Run a Ransomware Tabletop Exercise in 2026?

Cole Henderson · September 29, 2026

> A hotel ransomware tabletop exercise is a structured discussion in which leaders rehearse how the property would respond if attackers encrypted...

A hotel ransomware tabletop exercise is a structured discussion in which leaders rehearse how the property would respond if attackers encrypted systems, stole guest data, disrupted reservations, or interrupted check-in. It is not a technical penetration test, a tabletop video game, or a substitute for an actual business-continuity test. Instead, the exercise exposes conflicting decisions: who can declare an incident, when hotels should stop accepting bookings, how out-of-order systems will be handled, which teams may contact guests, and how executives will continue serving guests when digital tools are unavailable.

The direct answer is to run the exercise before an incident, at least annually and after major operational or technology changes. For a multi-property company, each hotel should participate, while the group should also test its central reservation platform, payment processor, property-management system, identity provider, managed service provider, and corporate crisis team. A useful first session lasts roughly 120 to 180 minutes, although a realistic hotel exercise may require two sessions, a planning week, and a corrective-action period lasting 30 to 90 days. The most valuable output is not a polished scenario story; it is a small set of named decisions, procedures, and deadlines that the hotel can verify in the following weeks.

**Also worth reading:** [How Can Hotels Improve Visibility in AI Search in 2026?](https://mightyrates.com/knowledge/how_can_hotels_improve_visibility_in_ai_search_in_2026-2.php) · [How can hotels accurately track and measure AI direct bookings in 2026?](https://mightyrates.com/knowledge/how_can_hotels_accurately_track_and_measure_ai_direct_bookings_in_2026.php) · [How Should Hotels Build a Direct Booking Strategy for AI Search in 2026?](https://mightyrates.com/knowledge/how_should_hotels_build_a_direct_booking_strategy_for_ai_search_in_2026.php)

Because ransomware is especially disruptive in hospitality, the scenario should include more than encrypted servers. Hotels depend on reservation databases, door-key systems, point-of-sale terminals, payment services, online travel agencies, business centers, Wi-Fi, employee access, physical-security systems, and sometimes building controls. A ransomware event may therefore create simultaneous financial, legal, safety, reputational, and operational pressure. A tabletop exercise gives leaders practice making trade-offs under incomplete information before attackers dictate the timing.

## What Makes a Hotel Ransomware Scenario Realistic?

A credible scenario begins with a plausible compromise rather than an unexplained demand for payment. For example, attackers could enter through an employee account, an exposed remote-access system, a vulnerable internet-facing service, or a supplier with access to the hotel environment. The group should be told that encryption has affected the property-management system, some workstations are unavailable, and a portion of guest or payment data may have been copied. It should not immediately assume that every system is down, that restoration will take a fixed number of hours, or that attackers possess every record.

The facilitator should inject facts at defined intervals. At the start, the general manager may report that check-in has slowed because the property-management system is inaccessible. Twenty minutes later, the incident commander may learn that the identity provider is also impaired, preventing normal multifactor authentication. A later update might say that the cyber insurer has been notified, a forensic firm is available remotely in six hours, and the payment processor requires its own incident-notification process. These updates force participants to revise assumptions without turning the session into an unrealistic disaster simulation.

Hotel exercises should account for physical operations. Front-desk employees need a documented procedure for checking guests in manually, recording room assignments, and reconciling charges later. Security staff need instructions for issuing replacement keys if electronic key issuance fails. Housekeeping and maintenance may need work orders, occupied-room information, and emergency contacts that are available without the normal network. A plausible exercise also considers staff working at different times, language barriers, agency employees, shared workspaces, and the possibility that the general manager is traveling when the first warning arrives.

The scenario should be technically neutral enough to encourage honest discussion. A hotel should not present a supplier, payment network, or internal employee as a confirmed cause unless the purpose is to test a specific evidence-based hypothesis. The purpose is to test decisions and coordination. A post-exercise finding such as “participants did not know who could take the reservation platform offline” is more useful than a dramatic claim that the hotel was “hacked.”

## Who Should Participate and Who Leads the Exercise?

The core group should include the general manager, chief engineer, front-office manager, security manager, human-resources representative, finance controller, food-and-beverage leader, communications contact, and technology or information-security lead. Larger groups should also include the chief operating officer, legal counsel, privacy officer, risk manager, cyber-insurance representative, payment processor, property-management-system provider, managed service provider, and law-enforcement liaison. One person may cover several roles in a small independent hotel, but the exercise should still identify primary and backup decision-makers.

The incident commander should establish authority before the scenario begins. This person decides when to convene the response team, sets priorities, assigns work areas, and determines when to move from investigation to containment. In many hotels, the general manager owns the business decision, while the technology provider may control technical containment. That division must be written down. Otherwise, a delay can occur while staff wait for permission to disconnect a system or when one provider assumes another provider has already isolated an account.

Legal and privacy advice should be available during the exercise, but legal counsel should not be treated as the person who makes every operational decision. Counsel can advise on evidence preservation, notification, contracts, disclosure, and regulatory issues. The general manager and department leaders still need to decide how to welcome arriving guests, protect occupied rooms, maintain food and beverage operations, and communicate with employees. A table-top session that simply asks lawyers to read policy will miss the operating problem.

External participants should be included selectively. Technology suppliers can explain the current restoration sequence, backup dependencies, and escalation contacts. Payment processors can describe limits on accepting cards and the process for replacing terminals. Cyber insurers can clarify the notification window and what information they need. These conversations are valuable, but the hotel must also be able to proceed if a supplier is unreachable during the first hour of an incident. The exercise should test fallback decisions rather than assume that every vendor will join the meeting.

## How Should the 120-Minute Tabletop Run?

A first exercise can use a 30-minute preparation period followed by a 90-minute facilitated discussion. During preparation, the facilitator provides the hotel profile, system map, current policies, and a short list of known constraints. The scenario should be labeled as fictional and should not include real guest information, passwords, unpatched vulnerability details, or unapproved claims about a supplier. Participants should receive role-specific information, such as a front-desk report about slow check-in or a technology report about suspicious account activity.

The session can start with a five-minute statement of objectives, followed by a ten-minute baseline briefing. Participants then work through timed injects in groups rather than listening to a lecture. For each inject, they must record the decision, decision-maker, information required, communication channel, and next update time. The facilitator should ask “what evidence would change this decision?” and “what can the hotel safely do without waiting for the attacker or a vendor?” Those questions are more productive than asking only who is responsible.

A final 20 to 30 minutes should identify the top three to five corrective actions. Each action needs an owner and due date. Examples include completing a manual check-in test, writing a supplier call tree, documenting the payment-outage process, removing dormant administrator accounts, or testing offline access to current guest and room information. “Improve cybersecurity awareness” is too broad to be an action item unless it includes a measurable activity, such as training 120 shift supervisors on a named response procedure and verifying their completion rate.

The exercise should end with a short confidence rating for each major capability. A one-to-five score can provide a simple baseline, but scores should not be treated as a scientific measurement. The record is more useful when it shows why a capability received its rating and what evidence supports it. If a property rates manual check-in as ready, that rating should be backed by a recent walkthrough and a usable offline procedure. If it rates recovery as strong, the hotel should be able to explain how long restoration is expected to take, who authorizes it, and which systems must be restored first.

## What Systems, Alternatives, and Fallbacks Should Hotels Test?

The most important test is not whether a hotel has technology; it is whether it can serve guests and preserve evidence when several systems are unavailable. Hotels should identify which systems are genuinely independent. A backup file on the same network, a cloud console requiring the same compromised identity provider, or a “manual” procedure that depends on an inaccessible server may provide little practical protection. The exercise should reveal these dependencies without pretending that every hotel can build a completely separate environment.

A useful comparison is between a basic discussion exercise and a more advanced resilience program. Both improve awareness, but they answer different questions. The discussion exercise is inexpensive and can uncover governance gaps quickly. A full operational resilience test may expose actual failure in procedures, recovery sequencing, supplier coordination, and staff execution. The more advanced option requires time, facilities, test data, vendor participation, and careful avoidance of production disruption.

| Feature | Basic hotel tabletop | Advanced resilience test |
| --- | --- | --- |
| Duration | About 120–180 minutes | One day to several days |
| Main goal | Test decisions, roles, and communication | Test real procedures, systems, and recovery evidence |
| Participants | Hotel leaders and core department managers | Leaders, staff, suppliers, and operational teams |
| Technology | Mostly discussion and documents | Controlled manual operations and selected system tests |
| Typical cost | Often internal staff time; facilitator optional | Usually higher because of staffing, planning, and supplier testing |
| Best use | Annual baseline and awareness | Validation after major changes or for critical properties |
| Main limitation | Can miss hidden process failures | Can disrupt guests or create avoidable risk |

Other alternatives include a “tabletop-in-a-box” exercise, a board-level discussion, a supplier-led tabletop, a cyber-insurance workshop, and an operational drill focused only on front-desk continuity. Each is valid, but none should be confused with a complete ransomware exercise. A board discussion can improve governance, while a front-desk drill can test manual check-in; neither necessarily tests how technology, legal, finance, and communications leaders coordinate during a broader outage.

## Common Mistakes That Make the Exercise Weak

The most common mistake is treating the exercise as a test of who can explain the policy. Policies are necessary, but they often assume systems are available, managers are present, and suppliers respond within minutes. A tabletop should ask whether staff can actually find the policy, apply it to the scenario, and make a timely decision. Another common error is choosing only an all-encrypt-everything scenario. That is dramatic, but it can distract from credential theft, data exfiltration, supplier compromise, selective encryption, and prolonged restoration.

Hotels also make the mistake of excluding night and department-level staff. A response plan that works for a general manager and chief information security officer may fail at 2 a.m. when the only available person is a duty manager. Participants should include at least one shift-based representative or conduct a separate version for overnight operations. The exercise should also distinguish a cyber incident from a wider business-continuity event. A property may need to operate with reduced technology even if the security investigation remains focused on one system.

Another error is scoring success by how quickly the group agrees to a decision. Speed is not the only measure; the decision must be safe, authorized, and recorded. Teams should not be penalized for identifying missing information, but they should be expected to state what they will do while they wait. A weak exercise ends with generic recommendations such as “review the plan” and “communicate better.” Strong exercises produce named actions, due dates, and verification evidence.

Finally, some organizations turn the tabletop into a vendor sales presentation. That undermines trust and prevents honest discussion. Suppliers can attend as participants or observers, but the facilitator should keep the objective on operational readiness. Hotel leadership should ask what the supplier can commit to, including escalation times, restoration estimates, dependencies, and support during a major event. A verbal assurance without a documented process should be recorded as an unresolved risk.

## When Should a Hotel Act, and What Should It Cost?

A hotel should schedule its first exercise as soon as it has an incident-response plan, especially if it handles payment data, guest identity information, employee records, or connected building systems. Annual repetition is a reasonable baseline, but a hotel should act sooner after acquiring a property, changing its property-management system, moving to a new identity provider, outsourcing critical IT, changing payment processors, adding internet-connected operational technology, or experiencing a significant incident. The exact interval matters less than recognizing that the tested environment has changed.

A small hotel can run a basic session with an internal facilitator and existing policies at little direct cost. The larger cost is staff time, follow-up work, and testing manual processes. A more formal exercise may involve a professional facilitator, cyber-insurance support, forensic participation, or a technical vendor. Pricing varies widely by location, scope, number of properties, and whether the provider supplies software, scenarios, reporting, and remediation assistance; the context does not support a reliable universal dollar figure. Any quoted price should be compared with the number of facilitated sessions, guest or operational disruption, and deliverables, not treated as a certification of effectiveness.

The most important threshold for action is a known critical dependency with no owner. If nobody can answer who authorizes a system shutdown, how the hotel operates without the property-management system, or where current guest and room information is stored, the hotel already has a resilience gap. It should assign owners, draft a usable fallback, and test the result. The same applies when a supplier’s recovery estimate is unknown or when backup restoration has never been checked against the hotel’s actual configuration.

By 29 September 2026, hotels preparing for major international events such as the 2026 FIFA World Cup should also account for crowded communications channels, temporary staffing, intense public scrutiny, and pressure to keep properties open. Coverage of the World Cup’s cyber risks and recent exercises involving hospitals and law enforcement reinforces a broader lesson: preparation depends on tested communication and decision-making, not merely technology purchases. A hotel that has mapped its critical services, practiced manual operations, and established supplier contacts will usually be better positioned than one that has more software but no rehearsed choices.

## What Should Be Done After the Tabletop Exercise?

The exercise is only useful if leadership treats the findings as operational work. Within one week, the facilitator should publish a factual record containing the scenario, decisions made, assumptions, unresolved questions, and agreed actions. The hotel should distinguish actions that improve preparedness from actions that merely describe a desired future state. A finding such as “create a manual check-in procedure” should become a named document, a tested form, a location accessible without the network, and a briefing for relevant shifts.

Owners and due dates should be approved by senior management. Progress should be reviewed at 30, 60, and 90 days, with the responsible manager reporting evidence rather than reassurance. If the hotel claims to have a backup, it should verify that the protected data can be restored into an environment with the required identity, application, network, and vendor dependencies. If it claims to have a contact list, it should confirm that the primary and backup contacts answered or that the failure was documented. If it claims to have a communication plan, it should check message ownership, approval rules, guest accessibility, employee channels, and language needs.

The next exercise should be harder. The second session could introduce a secondary supplier delay, a partial restoration with inconsistent data, a payment outage, a guest complaint, or a rumor that guest data was stolen. This is not about creating chaos. It is about testing whether the hotel can adapt when the first plan is only partly correct. A mature program uses repeated exercises to improve the organization’s speed of learning, not to maintain a comforting score.

A final measure should be a management decision about residual risk. No hotel can eliminate every disruption caused by ransomware or a third party. Leadership must decide which services must remain available, how long a property can operate manually, what guest and employee protections are non-negotiable, and when a property should temporarily stop selling or accepting certain transactions. Those decisions should be incorporated into business continuity, insurance, legal, and vendor-management processes. The best tabletop leaves the hotel with fewer assumptions, clearer authority, and evidence that the people responsible have practiced what happens next.

## Quick answers

### How long should a hotel ransomware tabletop exercise take?

A first session commonly lasts about 120 to 180 minutes, including scenario injects, discussion, and a short debrief. Larger or more technical exercises may need additional planning and a separate operational test lasting several hours or a full day.

### Is a tabletop exercise the same as a disaster-recovery test?

No. A tabletop primarily tests decisions, communication, authority, and assumptions through discussion. A disaster-recovery test attempts to execute selected restoration or continuity procedures, so it can validate more technical behavior but also carries greater operational risk.

### What should a hotel do if its property-management system is encrypted?

The hotel should activate its documented incident and continuity procedures, protect evidence, notify the relevant technology provider and insurer, and move to an approved manual check-in process if it can operate safely. The exact steps should be defined in advance because improvised manual processing can create guest, privacy, payment, and key-management problems.

### How often should hotels repeat ransomware tabletop exercises?

At least once a year is a useful baseline, and a repeat is sensible after major system, supplier, property, staffing, or threat changes. Repetition matters most when the new exercise tests a different dependency rather than simply repeating the same discussion.

### Who should pay for a hotel ransomware exercise?

Usually the hotel or hotel group owns the risk and pays for facilitation, staff time, and follow-up remediation. Cyber insurance, technology providers, or external advisers may contribute where their contracts include incident-readiness support, but the exercise should not depend on free vendor involvement to produce a reliable result.

Canonical: https://mightyrates.com/knowledge/how_should_hotels_run_a_ransomware_tabletop_exercise_in_2026.php
Markdown: https://mightyrates.com/knowledge/how_should_hotels_run_a_ransomware_tabletop_exercise_in_2026.php/index.md