Performing Ransomware Tabletop Exercise

When to Use

• Testing organizational ransomware response procedures annually or after major infrastructure changes
• Validating decision-making processes for ransom payment, regulatory notification, and public disclosure
• Training executives, IT, legal, PR, and operations teams on their roles during a ransomware incident
• Meeting cyber insurance policy requirements for documented incident response testing
• Identifying gaps in recovery playbooks, communication plans, and backup procedures

Do not use as a substitute for technical controls testing. Tabletop exercises validate procedures and decision-making, not technical detection or prevention capabilities.

Prerequisites

• Documented incident response plan (IRP) that participants should have read before the exercise
• Identified exercise participants from: executive leadership, IT/security, legal, communications/PR, HR, operations, and external counsel
• Facilitator who is independent from the IR team (to provide objective evaluation)
• Ransomware scenario designed with injects that escalate over multiple rounds
• Evaluation criteria aligned to NIST CSF Respond/Recover functions
• Conference room or virtual meeting for 2-4 hours with no interruptions

Workflow

Step 1: Design the Exercise Scenario

Build a realistic scenario based on current threat actor TTPs:

Scenario Structure:

Phase 1: Initial Detection (30 min)
  - SOC receives alert for suspicious process execution on file server
  - EDR detects Cobalt Strike beacon on 3 workstations
  - Inject: External threat intel report links C2 IP to LockBit affiliate

Phase 2: Escalation (30 min)
  - Ransomware executes on 40% of servers during overnight hours
  - Ransom note demands $2M in Bitcoin with 72-hour deadline
  - Inject: Attackers contact media claiming data theft of customer PII

Phase 3: Decision Points (45 min)
  - Backup assessment reveals immutable copies are intact but primary backups encrypted
  - Legal advises on breach notification timeline (72 hours GDPR, varies by US state)
  - Inject: Threat actor publishes sample of stolen data on leak site

Phase 4: Recovery and Communication (45 min)
  - Recovery time estimate: 5-7 days from immutable backups
  - Insurance carrier engages negotiation firm
  - Inject: Major customer threatens contract termination without update within 24 hours

Scenario Variables to Customize:

• Threat actor group and known TTPs
• Percentage of infrastructure encrypted
• Whether backups are intact, partially compromised, or fully destroyed
• Type of data exfiltrated (PII, PHI, financial, trade secrets)
• Applicable regulatory frameworks (GDPR, HIPAA, PCI DSS, SEC rules)
• Ransom amount and payment deadline

Step 2: Prepare Exercise Materials

Create the following documents for participants:

1. Exercise Overview Briefing - Ground rules, objectives, scope, and participants
2. Situation Reports (SITREPs) - One per phase, distributed as the exercise progresses
3. Inject Cards - New information introduced at specific times to force decision-making
4. Decision Point Worksheets - Structured forms for documenting group decisions
5. Evaluation Scorecard - Criteria for assessing response quality

Key Decision Points to Include:

• When to activate the incident response team
• Whether to shut down systems or contain selectively
• Whether to engage law enforcement (FBI IC3, CISA)
• Whether to pay the ransom and under what conditions
• When and how to notify regulators, customers, and the public
• How to prioritize system recovery order

Step 3: Facilitate the Exercise

Facilitator Responsibilities:

• Present each phase scenario and distribute SITREPs
• Introduce injects at predetermined times to increase pressure
• Ask probing questions to test decision-making reasoning
• Ensure all participant groups contribute (prevent IT from dominating)
• Document all decisions, rationales, and action items
• Track time management (many teams lose time on early phases)

Probing Questions by Phase:

Phase 1 - Detection:

• Who makes the call to declare an incident? What criteria trigger it?
• How do we determine the scope of compromise from initial alerts?
• Do we have the forensic capability to investigate or do we need external help?

Phase 2 - Escalation:

• What is our communication plan for employees? Do they know not to turn on affected machines?

…