A ransomware tabletop exercise is a structured discussion of a fictional incident. It tests decisions, communication and recovery assumptions without deploying malware or disrupting live systems. Choose a few decisions to practise and finish with assigned improvements.
The Australian government’s Exercise in a Box resources explain the discussion-based format and provide materials. The sample below is illustrative; adapt it to your business and have your security lead review the scenario.
Choose the questions you need answered
For a first exercise, ask who can declare an incident, how the team communicates if email is unavailable and who decides the recovery order. A focused session is easier to assess than a scenario that tries to test every possible threat.
Invite the people who would make those decisions: business leadership, IT or security, operations, customer communications and relevant advisers. Assign a facilitator to release new facts and a separate note-taker to record decisions and gaps.
Set clear boundaries
Tell participants this is a discussion, which systems are assumed affected and which facts are unknown. Use fictional records. Do not send realistic threat messages to uninformed staff or make live account, network or payment changes as part of the exercise.
Keep the incident response plan, contact routes and recovery priorities available. Ask participants to use those resources rather than describing what they hope someone would do.
Release a short sequence of facts
- Initial report: staff cannot open shared files and a fictional ransom message appears. Who receives the report, assesses impact and calls the response team?
- Wider disruption: the normal email service is unavailable. Which trusted channel reaches decision makers and external support?
- Recovery uncertainty: a backup exists, but its latest restore test and one application dependency are unclear. Who obtains evidence and sets the recovery priority?
- External pressure: a customer asks whether information was exposed. Who verifies facts, seeks required advice and approves the response?
Give participants time to discuss each stage. Do not reward quick guesses. If they say “restore the backup,” ask who authorizes it, what must be checked first and which evidence supports the expected recovery time.
Record decisions and unresolved assumptions
For each stage, note the decision, decision maker, information used and what was missing. Keep confirmed capabilities separate from assumptions. “The supplier can help” needs a contact route and an understanding of the actual support agreement.
Questions about ransom demands, reporting and legal obligations belong with the appropriate leadership and specialists. The exercise should reveal who handles them; it should not substitute for a live incident decision.
Turn the discussion into completed work
Finish with a short review of what helped and what blocked decisions. Assign each important gap an owner, due date and way to verify the fix. Schedule separate authorized technical tests if you need to prove backup restoration or recovery performance.
Repeat the relevant part after fixes or major changes. A completed discussion demonstrates that people practised decisions; it does not prove that systems can withstand ransomware or recover within a promised time.