performing-ransomware-tabletop-exercise

Design a multi-phase scenario based on current threat actor TTPs, prepare SITREPs and inject cards, then facilitate 2-4 hours of guided discussion with executives, IT, legal, and PR. Score responses against NIST CSF criteria and produce an after-action report within 5 business days.

Include phases for detection, escalation, decision points, and recovery, with injects covering double extortion, backup destruction, OFAC payment-legality checks, and regulatory notification timelines such as GDPR's 72-hour rule.

Participants should include executive leadership, IT and security, legal counsel, communications/PR, HR, operations, and external counsel. A facilitator independent from the incident response team should lead to ensure objective evaluation.

No. Tabletop exercises validate procedures, decision-making, and communication plans, not technical detection or prevention capabilities. Technical controls require separate testing such as penetration tests or backup restore validation.

The most common failure is producing an after-action report with no follow-up, so identified gaps are never remediated. Other pitfalls include unrealistic scenarios, IT dominating discussion, and never testing out-of-band communication channels.