All tabletop exercises
Ransomware·Starter·Executive audience
Ransomware: the first hour for executives
The prompt — read this to the room
At 07:30 on Monday the head of IT calls the CEO. Most office systems show a ransom note, email is down, and only the phones work. Staff are arriving and asking what to do. The note gives an email address and says the price doubles in 48 hours. Your cyber insurance policy sits in a shared folder that is now encrypted. Nobody is sure who should be in the room or who decides. In one hour the first customer calls will start. What happens in that hour?
Total duration
1 h
People to involve
5
Best fit
Any sector
Who to involve
Most important first.
- CEO / Managing director
- CISO / Head of security
- CFO / Finance
- Communications / PR
- Legal counsel
What it tests
- Establish who leads the incident and who decides, including when the CEO is unavailable.
- Identify the first external calls: insurer, incident response firm, outside counsel and law enforcement.
- Agree what staff and customers are told in the first hour.
- Recognise the decisions that should not be made in the first hour, such as paying or naming a culprit.
Outline of activities
- 1The phone call: who is in charge
- 2First calls and how to reach them with systems down
- 3What staff and customers hear
- 4What we deliberately do not decide yet
- 5Hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…