All tabletop exercises
Ransomware·Starter·Executive audience
Ransomware takes a local council's resident services offline
The prompt — read this to the room
Monday, 07:30. Staff at a county council serving 280,000 residents arrive to find file shares encrypted and the housing benefits, social care case management and parking systems unavailable. Phones still work, but the contact centre cannot see case records. A social worker needs a child's safeguarding history for an emergency court hearing at 11:00. The ransom note demands payment within 72 hours and threatens to publish residents' data. Councillors are already asking questions, and a local reporter has heard that the payments portal is down. What do you prioritise this morning?
Total duration
1 h 30 min
People to involve
7
Best fit
Public
Who to involve
Most important first.
- CEO / Managing director
- CIO / CTO
- CISO / Head of security
- Legal counsel
- Privacy officer / DPO
- Communications / PR
- CFO / Finance
What it tests
- Rank resident-facing services by harm, with safeguarding and vulnerable residents first
- Stand up manual workarounds for priority services within the first day
- Agree the council's ransom position and who has the authority to set it
- Meet data-protection reporting duties and keep councillors and residents informed
Outline of activities
- 1Monday-morning discovery
- 2Service triage by resident harm
- 3Manual workarounds and the 11:00 court hearing
- 4Ransom position and external help
- 5Councillors, residents, press and the regulator
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…