Tabletop runbook: Ransomware with data theft
General / cross-industry · Mid-size (250 to 2,500) · Mixed (exec + technical) · 90 minutes from 09:00 · Playbook: Ransomware and extortion
At 06:40 the service desk receives calls that shared drives show renamed files and a text file named README_RESTORE. The overnight backup job failed. A leak-site post names the organisation two hours later.
Objectives
- Decide on isolation, the pay or not-pay question and recovery from backups with the right people and the right evidence.
- Confirm who has authority for each major business decision (shut down systems, pay or not pay, notify, disclose) and who stands in when they are unavailable.
- Test the notification decision process against the deadlines that may apply.
- Confirm evidence is preserved before containment changes systems.
- Test the hand-off between technical responders and leadership: what is briefed, when and in what format.
- Identify gaps in the plan, contacts and authority, and turn each one into an owned, dated action.
Roles
- Facilitator: Runs the clock, reads injects, keeps it no-fault, pauses to probe (“freeze”) and parks rat-holes. Neutral: does not play.
- Scribe / decision recorder: Records each decision with the time, the owner and the reason, plus every gap or assumption.
- Evaluator / observer: Scores against the objectives using the rubric. Does not take part in the discussion.
- Executive sponsor (CEO or delegate): Final business decisions: shutdowns, payments, disclosure.
- CISO or incident lead: Briefs leadership, recommends actions, links the technical and business tracks.
- General counsel / legal: Privilege, notification duties, law enforcement, contracts.
- Communications / PR: Holding statements, media, staff and customer messages.
- CFO or finance lead: Cost, insurance, payments, material impact.
- Operations / business continuity: What the business can run without, for how long.
- Incident commander: Owns the technical response, assigns tasks, sets update cadence.
- SOC / detection lead: Alerts, logs, timeline of attacker activity.
- Forensics / DFIR: Evidence capture, chain of custody, scoping.
- IT infrastructure and identity: Isolation, credential resets, restoration.
- Backup and infrastructure owner: Scenario- or sector-specific role: plays their real decisions.
- Cyber insurance and broker contact: Scenario- or sector-specific role: plays their real decisions.
Usually a small security team plus IT. Confirm deputies for every role, because key people will be on leave.
Rules of play
- No-fault: the exercise tests the plan, the process and the tools, not individuals.
- Respond as you would today, with the people, tools and authority you actually have.
- Decisions are made by the person who would make them for real. If they are absent, their deputy plays.
- The facilitator may pause the room to ask a probing question, then resume the clock.
- Anything off-topic goes in the parking lot and gets an owner at the end.
- Assume the scenario is plausible. Challenging it uses time the exercise needs.
- Phones away except for roles that would use them in the scenario.
Timeline
| Time | Block | Purpose |
|---|---|---|
| 09:00–09:10 | Briefing and scene-setting | Objectives, rules of play, roles and the opening situation. |
| 09:10–09:20 | Detection and first report | How the incident is noticed, reported and escalated. |
| 09:20–09:35 | Triage and scoping | What is affected, what evidence exists and how bad it is. |
| 09:35–09:50 | Escalation and key decisions | Containment, business trade-offs and who has authority. |
| 09:50–10:05 | Communications and notification | Who is told what, when, and which deadlines apply. |
| 10:05–10:15 | Recovery and close-out | Restoring safely, deciding the incident is over, capturing lessons. |
| 10:15–10:30 | Hot wash (immediate debrief) | What worked, what did not, what we change. Owners and dates. |
Injects (master scenario events list)
EDR shows the same process creating encrypted files on 40 servers. Shadow copies were deleted at 03:12.
Facilitator note, what good looks like: Isolate affected segments, keep machines powered on for memory capture, open the ransomware playbook, start the incident log.
Firewall logs show 180 GB sent to a cloud storage provider over the previous two nights.
Facilitator note, what good looks like: Treat as data theft as well as encryption; preserve firewall and proxy logs; begin identifying what data was in the affected shares.
The COO asks when systems will be back. Nobody can give an estimate yet.
Facilitator note, what good looks like: Give the next update time instead of a guess; activate business continuity procedures for the affected services.
The only engineer who knows the backup system is on leave abroad and not answering.
Facilitator note, what good looks like: Named deputy, documented runbook, vendor support contract; single points of failure recorded as findings.
The ransom note demands payment within 72 hours. The CFO asks whether insurance covers it.
Facilitator note, what good looks like: Engage the insurer, outside counsel and law enforcement; sanctions screening before any discussion of payment; decision owned by named executives, not the security team alone.
The backup console shows the most recent two backups were also encrypted.
Facilitator note, what good looks like: Identify the last known-good offline or immutable copy; confirm the attacker’s access is removed before restoring anything.
A reporter emails asking you to confirm you are on a ransomware leak site.
Facilitator note, what good looks like: Use the pre-approved holding statement; route through communications and legal; no speculation on payment.
A journalist asks you to confirm a rumour about the incident within the hour.
Facilitator note, what good looks like: Holding statement approved by legal and communications; one spokesperson; next-update promise.
A restored domain controller shows a scheduled task created two weeks before the encryption.
Facilitator note, what good looks like: Stop restoration, treat as persistence, widen eradication, reset privileged credentials before continuing.
Sales wants the customer portal back today, before the forensic all-clear.
Facilitator note, what good looks like: Restore in priority order agreed with the business, with explicit risk acceptance by an accountable executive if it goes early.
Discussion questions by phase
- Who told you, how, and how long after the first signal? Who else needs to know in the next 30 minutes?
- Which alert or log would have shown this first, and do you keep it long enough to look back?
- Who is allowed to isolate the network segment, and do they need permission first?
- What do we know, what do we believe, and what do we not know yet? Who owns closing each gap?
- What evidence do you capture before changing anything, and where does it go?
- How would you prove whether data left the network, not just whether files were encrypted?
- Who can authorise taking this system offline, and who decides if they cannot be reached?
- What is your containment order, and what breaks if you do it out of order?
- Who makes the pay or not-pay recommendation, and what sanctions checks must happen first?
- Which notification clocks may have started, who decides whether they apply, and when?
- Which facts can the technical team confirm for the first statement, and what must stay out of it?
- What do you tell staff who arrive to find their systems down?
- What can the business run in a degraded mode, and for how long?
- What has to be true before you call a system clean and reconnect it?
- How do you know the backups you restore from are clean?
Scoring rubric
The evaluator scores each criterion from 1 to 4 during the hot wash: 1 = not done or unclear, 2 = partly done, with major gaps, 3 = done, with minor gaps, 4 = done promptly and as planned.
| Criterion | What good looks like | Score |
|---|---|---|
| Decision authority | Every major decision had a named owner who made it at the right time; deputies stepped in when needed. | |
| Use of the plan | The plan and playbook were opened early and followed, or departures were explained. | |
| Notification and legal | Possible clocks were identified, the “aware” time recorded, and the decision made on evidence. | |
| Communications | Staff, customers, regulators and media got consistent, factual messages from the right person. | |
| Detection and triage | Signals were recognised quickly, severity set and the right people woken. | |
| Evidence preservation | Logs, images and memory were preserved before containment changed systems. | |
| Containment order | Containment happened in the right order, persistence and credentials were handled before restore. | |
| Recovery validation | Clear criteria for “clean” were applied before reconnecting systems. | |
| Hand-off between teams | Technical status reached leadership in a usable form at a regular cadence, and decisions flowed back. | |
| Documentation | A timeline, decision log and list of gaps exist at the end without extra work. |
Pre-exercise checklist
- Agree objectives and scope with the executive sponsor 3 to 4 weeks ahead.
- Swap generic system names in the injects for your real ones (keep it believable).
- Send invitations with the date, length and role of each person; do not send the scenario.
- Share the incident response plan and playbooks with participants before the day.
- Book a scribe and, if possible, an evaluator who does not play.
- Print the inject cards and the scoring sheet; prepare a timer and a parking-lot sheet.
- Confirm what is out of scope (for example, no live changes to systems).
After-action report template
- Exercise summary: date, scenario, participants, objectives.
- Objectives met? For each objective: met, partly met or not met, with evidence from the decision log.
- Strengths: what worked and should be kept.
- Gaps found: plan, people, authority, contacts, tools, information.
- Improvement plan: each action with one owner, a due date and a status.
- Plan and playbook updates: which documents change and who signs off.
- Next exercise: date, scenario and what it should test that this one did not.
Educational template, not legal advice. Track the actions in the Post-Incident Review Template.