All tabletop exercises
Ransomware·Intermediate·Mixed audience
Ransomware hits payroll two days before payday
The prompt — read this to the room
It is Wednesday morning. Payroll for 2,300 staff must reach the bank by 14:00 Thursday to land on Friday. Overnight, ransomware encrypted the HR and payroll servers and the file share holding timesheets. IT estimates at least four days to restore. Last month's bank file still sits in a finance team member's email. Union representatives have heard rumours and are asking whether people will be paid this week. The CFO asks the room: can we just re-run last month's payroll? What do you decide, and how do you tell 2,300 people?
Total duration
1 h 45 min
People to involve
7
Best fit
Manufacturing, Public, Healthcare
Who to involve
Most important first.
- CFO / Finance
- HR
- CISO / Head of security
- IT operations
- Communications / PR
- Legal counsel
- CEO / Managing director
What it tests
- Choose a payroll continuity option and accept its risks explicitly, with a named owner.
- Identify the legal and contractual consequences of late or inaccurate pay.
- Keep the workforce informed with one consistent message on a channel that works without email.
- Stop the recovery from reintroducing tampered data or attacker access into the payment process.
Outline of activities
- 1Payroll down: what is actually lost and what survives elsewhere
- 2The options on the table and how each one fails
- 3The Thursday 14:00 decision
- 4Telling the workforce and their representatives
- 5Reconciliation after recovery
- 6Hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…