Most ransomware plans describe what the technical team does, but the decisions that shape the outcome, such as whether to pay, what to disclose and which systems come back first, are made by executives who have rarely practised them together. This template is a ready-to-run, timed ransomware tabletop script that covers the first 72 hours of a double extortion attack, inject by inject, with explicit executive decision points on ransom, disclosure and restore order. It expands scenario 5.1 of the Tabletop Exercise Scenario Pack from a four-inject summary into a full script with facilitator notes, decision records and scoring. It is written for incident managers, CISOs, exercise facilitators and the executive team who will sit in the room. For how to plan a tabletop programme in general, see the Tabletop Exercise Guide; the operational steps being tested live in your Ransomware Playbook Template.
How to use this template
- Replace text in square brackets, such as [Organisation], [CFO] and [critical asset list], with your own names and documents. Bracketed figures are suggestions to make the scenario realistic, not benchmarks.
- The script runs in [3.5 hours] of real time and covers 72 hours of scenario time in six phases (section 5). Each inject has a decision the room must make, the record the scribe captures and what the facilitator listens for.
- Run the technical track and the executive track together for phases 1 and 2, then let technical players brief the executives as they would in a real incident. Section 5.3 lists the decision records the executives must leave with.
- Bring the real documents: incident response plan, ransomware playbook, critical asset and restore priority list, backup architecture, cyber insurance policy, disclosure policy and the out-of-band contact list. Finding them under pressure is part of the test.
- The page summarises payment, sanctions and disclosure considerations for exercise purposes only. It is not legal advice; have counsel confirm the decision criteria in your own plan.
1. Purpose
This exercise tests whether [Organisation] can make, record and defend three executive decisions during a ransomware attack with data theft: the order in which services are restored, whether and how to engage with the extortion demand, and what to disclose, to whom and when. It also tests the hand-offs that feed those decisions: who has authority to isolate the network, how facts reach executives when email and collaboration tools may be compromised, and how the organisation decides that recovery assets can be trusted.
2. Scope
- In scope: escalation and declaration, isolation authority, out-of-band communications, restore prioritisation, backup trust decisions, extortion and payment decision process, sanctions screening, insurer and law enforcement engagement, regulatory and market disclosure, staff and customer communications.
- Out of scope: forensic technique, negotiation tactics with the threat actor and detailed system rebuild steps. Negotiation is covered in the Ransomware Negotiation Guide; rebuild in the Ransomware Response and Recovery Guide.
- Environment: on-premises Windows estate with Active Directory, a virtualisation cluster, file servers, an ERP system and Microsoft 365 or equivalent. Adapt section 4 if your estate is mainly cloud.
3. Roles and exercise rules
| Role | Who | Exercise responsibility |
|---|---|---|
| Facilitator | [IR lead or external facilitator not in the decision chain] | Delivers injects on time, asks probing questions, holds the room to the facts revealed so far. |
| Scribe and timekeeper | [Named person] | Records scenario time, decision, decision maker and stated reason for every decision in section 5.3. |
| Incident manager | [Head of IR or SOC manager] | Runs the technical response and briefs executives; owns the incident log. |
| Crisis lead (accountable executive) | [CEO or COO] | Chairs the executive group; final say on restore order and engagement with the demand, within board delegation. |
| Finance | [CFO] | Business impact figures, insurance, any payment mechanics and sanctions checks. |
| Legal and compliance | [General Counsel], [DPO] | Notification clocks, sanctions and privilege, materiality input. |
| IT operations | [Head of Infrastructure] | Backup status, restore estimates, isolation feasibility. |
| Communications | [Head of Communications] | Holding statements, staff and customer messages, media. |
| Business owners | [Heads of operations, sales, HR] | Real cost of downtime per service; manual workarounds. |
| Observer | [Internal audit or board risk committee member] | Scores the evaluation criteria in section 7. |
Rules: no-fault discussion; players decide on what they know now, not on what they expect the next inject to reveal; "stop the clock" pauses are allowed, but recorded scenario times do not change; any player may say "we would not know that yet", and the facilitator confirms or corrects.
4. Scenario summary
A ransomware affiliate gained access to [Organisation] [three weeks] before the attack using a valid VPN account without multi-factor authentication. It created a new domain administrator account, copied about [400 GB] of HR, finance and customer data to a cloud storage service (ATT&CK T1567 Exfiltration Over Web Service), deleted backup snapshots and shadow copies (T1490 Inhibit System Recovery) and, late on a Saturday, encrypted file servers and the virtualisation cluster (T1486 Data Encrypted for Impact). The ERP system, warehouse management and the customer portal are down. Microsoft 365 is still running, but the identity estate is untrusted. Facts emerge slowly and in the wrong order, and some early assumptions turn out to be wrong.
5. Exercise script
5.1 Timed injects
| Scenario time | Inject | Decision required | Facilitator listens for |
|---|---|---|---|
| Phase 1. T+0 (Sat 23:40) | The on-call engineer cannot reach file servers; the hypervisor console shows a ransom note naming [group]. The SOC sees mass file renames on [n] servers. | Declare a major incident? Who can authorise isolating sites and taking the network offline at switch level? Is corporate email trusted for coordination? | Named isolation authority reachable at night; move to out-of-band channels (phone bridge, pre-agreed secure messaging); evidence preserved before power-off. |
| T+1h (Sun 00:40) | IT asks whether to shut down all hypervisors to stop the spread. Shutting down will lose memory evidence. | Isolate or power down? Who decides the trade-off between evidence and spread? | Isolation preferred over power-down where possible, as CISA advises; decision recorded with reason. |
| Phase 2. T+3h (Sun 02:40) | The backup console shows the last [14 days] of snapshots deleted using a backup administrator account. The immutable copy in [location] is [6 days] old; tape is [10 days] old. | Which backup set is trusted? Is a [6 day] data loss acceptable for each critical service? | Recognition that the attacker was present before the snapshots were deleted; restore point chosen after checking for dropper malware. |
| T+6h (Sun 05:40) | Forensics finds a domain admin account created three weeks ago and an unmanaged remote access tool on [n] hosts. | Is Active Directory trusted? Rebuild the identity tier first, or restore business services onto it? | Identity treated as the first restore dependency; VPN and SSO access paths disabled until reset. |
| Phase 3. T+10h (Sun 09:40) | Executive group convenes. Operations reports [£ / $ amount] lost revenue per day; the warehouse is moving to paper. | Decision A: restore order. Confirm or change the restore priority list (section 5.2). | A pre-agreed list exists and is used; changes are justified by business impact, not by who shouts loudest. |
| T+14h (Sun 13:40) | The insurer's breach line assigns a panel response firm and asks whether law enforcement has been contacted. | Engage the panel firm, or the retained firm? Report to law enforcement and national cyber agency now? | Insurer notified within policy terms; report to law enforcement made early, which OFAC treats as a mitigating factor. |
| Phase 4. T+30h (Mon 05:40) | Staff arrive to a system outage. A message appears on the leak site with sample HR files and a [7 day] countdown. A demand for [amount] in cryptocurrency follows, with a discount if paid in 48 hours. | Decision B: engagement. Make contact (to buy time and assess the claim), refuse, or defer? Who is allowed to communicate with the group? | No one engages ad hoc; contact, if any, goes through the agreed channel; decision record started (section 5.3). |
| T+34h (Mon 09:40) | A journalist calls the press office quoting the leak site. Staff are posting on social media. | Approve a holding statement? What do staff, customers and suppliers hear, and from whom? | Facts only, no speculation on cause or data scope; staff told before the press. |
| Phase 5. T+44h (Mon 19:40) | Analysis of the leaked sample confirms customer personal data and payroll records from [countries]. Legal maps clocks: GDPR 72 hours from awareness, NIS2 early warning within 24 hours if in scope, sector regulator rules, contractual notices to [key customers]. | Decision C: disclosure. Which notifications go now, which in phases? If listed, is the incident material, and when was materiality determined? | Awareness time recorded; regulator notifications not held back pending a payment decision; materiality determination documented. |
| T+50h (Tue 01:40) | The board chair asks whether paying would be faster and cheaper than rebuilding. The panel firm says the group's decryptor is slow and unreliable on virtual disks. | Decision B revisited: payment. Apply the criteria in section 5.3. Is payment lawful for this group? | Sanctions screening owned by named person; payment does not remove notification duties or guarantee deletion; decision stays with the delegated authority. |
| Phase 6. T+60h (Tue 11:40) | The first restored file server shows a scheduled task calling the same remote access tool. | Stop restores? Re-check the restore point? How is "clean" defined and who signs it off? | Restores paused; rebuild from known-good images; signed clean criteria before reconnecting. |
| T+72h (Wed 23:40) | Identity tier and ERP restored in an isolated recovery network. Leak countdown has [4 days] left. Board asks for a written update. | What is reported to the board? What is the plan for the next 72 hours? When is the incident formally closed? | Decision log presented; closure criteria named; owner for each open action. |
5.2 Restore order worksheet (Decision A)
| Tier | Example services | Dependency check | Target |
|---|---|---|---|
| 0. Foundations | Directory and identity provider, privileged access, DNS, DHCP, backup platform, logging | Rebuilt or verified clean; all privileged and service account credentials reset; attacker accounts removed | [T+24h to T+48h] |
| 1. Safety and legal | Safety systems, payroll if due, regulatory reporting systems | Runs on clean tier 0; data from trusted restore point | [T+48h] |
| 2. Revenue critical | ERP, order processing, warehouse management, customer portal | Integrity of restored data checked before reconnection | [T+72h to T+96h] |
| 3. Supporting | File shares, collaboration, reporting, development | Restored in waves from clean images | [Week 2] |
The facilitator should press on two points: the CISA #StopRansomware Guide calls for restoration by a predefined critical asset list, and for removing dropper malware before restoring from backups so that clean systems are not reinfected. If the room has no agreed list, that is the first finding.
5.3 Executive decision records
The scribe completes one record per decision. These records are the main output of the exercise and the input to the Tabletop Exercise After Action Report Template.
| Decision | Who decides | Criteria the room must apply | Evidence to record |
|---|---|---|---|
| A. Restore order | [Crisis lead] on advice of [Head of Infrastructure] | Business impact per day, safety and legal deadlines, identity and backup dependencies, confidence in the restore point | Approved list, changes and reasons, sign-off of clean criteria |
| B. Engagement and payment | [Board delegate or crisis lead] as set in the plan; never one person alone | Can we recover without paying, and how long? Sanctions screening result; insurer position; law enforcement advice; reliability of the decryptor; what payment would and would not achieve (it does not end notification duties or guarantee deletion) | Options considered, advice received, sanctions check, final decision and reason, even if the decision is not to pay |
| C. Disclosure | [General Counsel] recommends, [Crisis lead] approves | Awareness time; personal data and regulator clocks; contractual notices; for listed companies, materiality determination and the Form 8-K Item 1.05 four business day window | Clock start times, notifications sent, materiality reasoning, statements approved |
5.4 Questions for the executive group
- Authority: who could authorise taking every site offline at midnight on a Saturday, and did they know they had that authority?
- Payment: who would sign off a payment, under what delegation, and who checks the recipient against sanctions lists before any transfer?
- Disclosure: which clock started first, and who was tracking it?
- Restore: what would we accept losing: [6 days] of data, [3 days] of revenue or both?
- Communication: if email were unavailable, how did this group reach each other, and how will staff be reached on Monday morning?
6. Reference: the decision points being practised
- Containment: CISA's #StopRansomware Guide advises identifying and isolating impacted systems, taking the network offline at switch level where many systems are affected, using out-of-band communication, and powering down only if disconnection is not possible, because power-down destroys volatile evidence.
- Payment and sanctions (US): OFAC's Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (21 September 2021) says the US government strongly discourages paying, that civil penalties apply on a strict liability basis, and that a prompt self-initiated report to law enforcement and full cooperation are significant mitigating factors. Licence applications are reviewed case by case with a presumption of denial. See the Ransomware Payments and Sanctions Guide and, for other countries, Ransomware Payment and Reporting Laws Compared.
- Market disclosure (US listed): the SEC's 2023 rule requires a Form 8-K Item 1.05 filing generally four business days after the company determines an incident is material, with a delay only where the Attorney General finds a substantial risk to national security or public safety.
- EU incident reporting: entities in scope of NIS2 send an early warning within 24 hours of becoming aware of a significant incident and an incident notification within 72 hours; personal data breaches follow GDPR Article 33. The Data Breach Tabletop Exercise rehearses the GDPR decision in depth.
7. Evaluation
| Criterion | Met when | Score (0 to 2) |
|---|---|---|
| Isolation authority | Named person reached and decision made within [1 hour] of scenario T+0 | [ ] |
| Out-of-band communication | Group moved off corporate email and chat before phase 2 | [ ] |
| Restore order | Decision A taken from a pre-agreed list, with identity as tier 0 | [ ] |
| Backup trust | Restore point chosen with reasons; clean criteria signed before reconnection | [ ] |
| Payment governance | Decision B record complete, including sanctions check and who holds authority | [ ] |
| Disclosure | Decision C record complete; every applicable clock identified with a start time | [ ] |
| Board reporting | Written update at T+72h with decision log and open actions | [ ] |
8. After the exercise
- Hot debrief for 20 minutes immediately afterwards: what surprised players, and which decision felt least supported by the plan.
- Within [5 working days], the facilitator issues the after action report with the decision records and scores attached.
- Each finding gets an owner and a due date, and maps to a change in the incident response plan, ransomware playbook, restore list or delegation of authority.
- Repeat the exercise within [12 months], or sooner after a major change such as a new backup platform or an acquisition, using a variant: cloud estate, a managed service provider as entry point, or an attack timed for a quarter-end close.
Implementation guidance
Preparing the exercise
- Agree objectives and the executive sponsor [6 weeks] out; confirm which decisions will be tested and that the people who own them will attend in person.
- Collect the real restore priority list, backup retention facts and the insurance policy's notification terms, and tune the bracketed values in section 5.1 so the scenario fits the estate.
- Brief the facilitator and scribe on section 5.3; pre-print the decision record forms.
- Run a [30 minute] dry run with the incident manager to check the injects are plausible for your technology.
- Decide in advance whether external advisers (counsel, insurer, response firm) join. Their participation tests real contracts, but may limit candour.
Choosing the format
| Format | Best for | Trade-off |
|---|---|---|
| Executive only (phases 3 to 6) | Boards and leadership teams with limited time | Technical facts arrive as briefings, so isolation and backup decisions are not tested |
| Combined technical and executive | First full run and annual exercise | Needs [3.5 hours] and careful facilitation to stop technical detail swamping executives |
| Split rooms with runners | Larger organisations; tests how information flows between teams | More preparation and two facilitators |
Smaller organisations can compress the script into [90 minutes] by using phases 1, 3, 4 and 5 only, and pair it with the Ransomware Basics for Small Businesses Guide. When the team is ready to move beyond discussion, the Cyber Incident Exercises Beyond Tabletop Guide covers functional and full-scale formats. Free scenario material for comparison is available in CISA's Tabletop Exercise Packages and the NCSC's Exercise in a Box, both of which include ransomware topics.
Where identity fits
The T+6h inject is the hinge of the exercise. If the attacker created privileged accounts and used a backup administrator account, then every restore depends on a trusted identity tier, and every service account and API credential that touched the compromised domain needs rotation before business systems reconnect. Players often underestimate how many non-human identities that is. See Recovering IAM and PAM After Ransomware or Domain Compromise.
Measures that show it is working
- Time from scenario T+0 to a recorded isolation decision, trending down across exercises.
- Percentage of the seven evaluation criteria scored 2.
- Number of decision records completed with reasons out of the three required.
- Percentage of after action findings closed by their due date.
- Gap between the restore time executives assumed and the time IT operations estimated.
Common failure patterns
- Restore list never agreed: executives argue priorities for the first time during the exercise, which is exactly the delay a real attack would suffer.
- Payment discussed before recovery options: the room debates paying before knowing whether clean backups exist and how long a rebuild takes.
- Disclosure held for the payment decision: notification clocks run regardless of whether a ransom is paid.
- Identity assumed clean: business systems are restored onto a directory the attacker still controls, and the T+60h reinfection inject lands hard.
- Scenario too gentle: backups always work and the press never calls, so the exercise confirms the plan instead of testing it.
Framework mapping
| Framework | Reference | Template section |
|---|---|---|
| NIST SP 800-53 Rev. 5 | IR-3 Incident Response Testing; IR-4 Incident Handling; IR-8 Incident Response Plan; CP-4 Contingency Plan Testing; CP-10 System Recovery and Reconstitution | Whole exercise, 5.2 |
| NIST CSF 2.0 | RS.MA-01 (plan executed with third parties); RS.CO-02 (stakeholders notified); RC.RP-03 (backup integrity verified before restoration); ID.IM-02 (improvements from exercises) | 5.1, 5.2, 5.3, 8 |
| MITRE ATT&CK | T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1567 Exfiltration Over Web Service | 4 |
| ISO/IEC 27001:2022 | Annex A 5.24 to 5.27 (incident management); 5.29 (information security during disruption); 8.13 (information backup) | 5, 8 |
Sources
- CISA: #StopRansomware Guide
- US Treasury OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments
- SEC: Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure rules
- CISA: Tabletop Exercise Packages
- NCSC: Exercise in a Box
- EUR-Lex: Directive (EU) 2022/2555 (NIS2)
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
This template summarises payment, sanctions and disclosure considerations for exercise purposes and is not legal advice. Related NHI Mgmt Group resources: Tabletop Exercise Scenario Pack · Tabletop Exercise Guide · Ransomware Playbook Template · Tabletop Exercise After Action Report Template · Ransomware Executive Briefing