# Ransomware tabletop exercise for executive teams https://en.kinlevi.com/resources/ransomware-tabletop-exercise Use this original scenario to examine coordination under uncertainty. The goal is to expose missing authority, unsupported assumptions and recovery dependencies. Agreement around the table is evidence of a discussion; it does not demonstrate that a technical control or restoration process works. ## Prepare the session - Choose a facilitator who releases the scenario updates and an observer who records what participants actually do. Include incident coordination, security, platform operations, business ownership and communication responsibilities. - Select one service and the response-plan version being exercised. Bring the decision matrix, a contact list and a dependency map. Use fictional names and materials. - Reserve about 90 minutes as a planning suggestion: 10 to agree scope, 60 for four discussion rounds and 20 for the debrief. Adjust the pace to your objectives; do not score participants on speed alone. ## Exercise boundaries and stop conditions - This is a discussion exercise. Do not change live access, execute binaries, send external messages or use real customer records to act out the scenario. - Any participant may pause if a proposed action reaches a live system or exceeds the agreed scope. Resolve the boundary before continuing. - If a real operational incident occurs, stop the exercise and use the actual response process. Clearly mark exercise notes and simulated messages. ## Fictional starting situation A B2B supplier relies on an order-confirmation service during its busiest delivery period. Customers report failures and staff cannot tell which orders were accepted. The cause and affected scope are unknown. All updates below are fictional materials introduced by the facilitator, not observations about a real organization. ## Service, participants and exercise scope Record the service, plan version, facilitator, observer, participating roles and agreed boundaries. [Complete during the exercise] ## Release the updates in sequence Open one round at a time. Each 15-minute slot is a facilitation aid, not a response deadline. Record a choice, its authority, the evidence available and the next verification before moving on. ### 00 min — Service disruption The order service is unavailable. Support has three customer reports, but there is no reliable count of affected orders. The normal incident lead cannot be reached. - Who declares the incident, takes coordination and activates the alternate? - What must be learned before choosing a manual order process or suspending new orders? #### Decision, authority and reasoning What was chosen, by which authorized role, with what alternatives and customer consequences? Identify the person responsible for the next action. [Complete during the exercise] #### Evidence gaps and next verification Separate supplied facts, participant assumptions and missing evidence. Record what will be checked, by whom and before which next decision. [Complete during the exercise] ### 15 min — An unverified extortion claim The facilitator introduces a simulated ransom note and a report of an unusual privileged session. No evidence yet establishes data theft or the full scope of access. - Which containment is authorized, and what evidence could that action remove? - Who evaluates the claim and keeps customer communication accurate while its validity remains unknown? #### Decision, authority and reasoning What was chosen, by which authorized role, with what alternatives and customer consequences? Identify the person responsible for the next action. [Complete during the exercise] #### Evidence gaps and next verification Separate supplied facts, participant assumptions and missing evidence. Record what will be checked, by whom and before which next decision. [Complete during the exercise] ### 30 min — A recovery dependency A backup inventory lists a recent copy, but its restoration has not been demonstrated in this exercise. Recovery also requires an identity service whose trust is being questioned. Operations asks for a rapid restart. - What evidence is required before restoring identity, data and service? - Who accepts restricted operation, and what monitoring or rollback condition would stop it? #### Decision, authority and reasoning What was chosen, by which authorized role, with what alternatives and customer consequences? Identify the person responsible for the next action. [Complete during the exercise] #### Evidence gaps and next verification Separate supplied facts, participant assumptions and missing evidence. Record what will be checked, by whom and before which next decision. [Complete during the exercise] ### 45 min — Pressure to communicate A major customer asks for a restoration time and a journalist references an unverified screenshot. The next shift is arriving with an incomplete decision record. - Who approves an update that states impact and uncertainty without unsupported promises? - What decisions, commitments and evidence must pass to the next shift and executive owner? #### Decision, authority and reasoning What was chosen, by which authorized role, with what alternatives and customer consequences? Identify the person responsible for the next action. [Complete during the exercise] #### Evidence gaps and next verification Separate supplied facts, participant assumptions and missing evidence. Record what will be checked, by whom and before which next decision. [Complete during the exercise] ## Turn the debrief into follow-up work ### Observed strengths and gaps Label what was demonstrated in discussion, merely stated or not addressed. Cite a decision record or observed action; avoid assigning an unsupported readiness score. [Complete during the exercise] ### Corrective actions and verification For each gap, record an owner, next action, deadline and the evidence required to verify completion. Keep unresolved dependencies visible. [Complete during the exercise] ### Retest condition Define which change or completed action triggers another exercise and what that exercise must demonstrate. Agree who follows up. [Complete during the exercise] Discussion findings do not prove that recovery, detection or communications will work during a real incident. Verify technical claims separately through authorized tests. Keep the downloaded record and review corrective actions before declaring them complete. ## Method and references An original scenario and worksheet informed by primary exercise references. It is not an official CISA or NIST exercise package. - [CISA — Tabletop Exercise Package Documents](https://www.cisa.gov/resources-tools/resources/ctep-package-documents) - [NIST SP 800-84 — Test, Training, and Exercise Programs](https://csrc.nist.gov/pubs/sp/800/84/final) - [NIST SP 800-61 Rev. 3 — Incident Response Recommendations](https://csrc.nist.gov/pubs/sp/800/61/r3/final)