The idea behind it
A tabletop exercise is a discussion-based rehearsal of an incident. The people who would run the response sit together while a facilitator releases the scenario one development at a time, called an inject, and asks what they would do. Nothing in production is touched. The exercise records what the room does not know: who may stop operations, where the response firm's number is when email is down, whether the backups can be restored and in what order.
Ransomware tests more of the organization than most scenarios, because it reaches operations, backups, identity, legal duties, customers and the media within hours. This kit runs it in eight timed injects over about three hours, ending with a hot wash and an after-action report that gives each gap an owner and a date. The scenario includes a ransom demand; OFAC's 2021 advisory, cited in the kit, sets out the sanctions risk in paying. CISA publishes free tabletop exercise packages, including cyber scenarios that cover ransomware, for organizations that want other scenarios or a longer format.
What's inside
- A facilitator guide: sample objectives, a three-hour agenda, preparation, ground rules, how to run each inject, hot wash questions and follow-up.
- Eleven roles, from executive sponsor and incident commander to scribe and observers, with what each does during the exercise.
- A ransomware scenario at a fictional distributor in eight timed injects, from the first service desk calls to the board briefing four days later.
- Questions for each inject and facilitator notes on what to draw out, including the ransom decision and identity recovery.
- A decision log, an observer sheet and an after-action report template with an improvement plan.
- A worked example: a completed decision log extract and three improvement-plan entries.
- Slides for the room: agenda, ground rules, roles, the scenario, one slide per inject and the hot wash.
Format: PDF (10 pages), Word document and PowerPoint file.
A look inside
Pages 1 and 2 of 10 of the PDF. Select an image to enlarge it.
Who uses it
- CISOs and security leads, to test the incident response plan with the people who would carry it out.
- CIOs and IT operations leads, to test isolation, backup restoration and recovery order under time pressure.
- Executives, counsel and communications leads, to rehearse the decisions only they can make.
- Business continuity and risk managers, to turn the findings into a tracked improvement plan.
When to use it
- The incident response plan has been written or changed but never exercised.
- A cyber insurer, auditor, regulator or board asks for evidence of testing.
- Key roles have changed since the last exercise.
- The organization has not decided in advance how it would respond to a ransom demand.
How to use it
Tailor the scenario to your systems four to six weeks ahead, run it with the people who would act on the day, and track the improvement plan to closure.
- Four to six weeks ahead, agree the objectives with an executive sponsor and replace the scenario's systems with your own.
- Invite the people who would act on the day, send them the plans they would use, and brief the scribe and observers.
- Run the eight injects with the slides, keeping to time, while the scribe fills in the decision log.
- Close with the hot wash questions and collect the decision log and observer sheets.
- Write the after-action report within two weeks and agree the improvement plan with the sponsor.
- Track each improvement to closure and run the next exercise within twelve months.
You leave with: A record of the decisions made under pressure, the gaps in the plan and in decision rights, and an improvement plan with an owner and due date for each issue.
Where it goes wrong
- Sending delegates. The exercise tests the people who would decide on the day.
- Letting the facilitator also play a decision-maker, so nobody runs the clock.
- Fighting the scenario instead of answering it, which uses the time without testing anything.
- Writing the report and not tracking the improvement plan, so the next exercise finds the same gaps.
Get the exercise kit
It is free. Enter your work email and we send the download link.
Questions
How long does a ransomware tabletop exercise take?
This kit is built for about three hours: 15 minutes to open, about two hours and twenty minutes for eight injects, and 25 minutes for the hot wash.
Who should take part?
The people who would act in a real incident: an executive sponsor, the incident commander, IT operations, legal counsel, communications, operations, finance and HR, plus a facilitator, a scribe and observers who do not speak during play.
Does the kit say whether to pay a ransom?
No. Inject 6 asks the room to decide its position and the checks that come first. The facilitator notes cite OFAC's 2021 advisory, which says the U.S. government strongly discourages payment and describes the sanctions risk.