Security
Running a ransomware tabletop exercise with city leadership
A two-hour exercise format that gets department heads and elected officials ready for a bad day.
A tabletop exercise is a structured conversation about a simulated incident. It costs a couple of hours and reveals more about an agency's readiness than any document review. Here is a format that works for cities and counties.
Who should be in the room
The city manager or administrator, the IT director, finance, HR, the city attorney, the public information officer, police and fire representatives, and, for at least part of the session, one or two elected officials. Ransomware is not an IT incident; it is an organizational one.
The scenario, in phases
Phase one, Monday 6 a.m. The IT director receives a call: file servers are encrypted and a ransom note is on screens. What do we do in the first hour? Who is called? What is shut down?
Phase two, Monday noon. Email is down. The utility billing system is unavailable. A reporter calls. Payroll runs Thursday. What do we tell staff, residents, and the press? Who decides?
Phase three, Tuesday. The attackers claim to have stolen personnel and resident data. Cyber insurance has assigned a breach coach. Do we pay? Who decides? What are our notification obligations?
Phase four, two weeks later. Systems are partly restored. What did we learn? What do we need?
What the exercise surfaces
Nobody knows where the incident response plan is. Nobody has the insurer's number. The backup restore has never been tested. Manual processes for payroll and dispatch have not been written down. Decision authority is unclear.
Afterward
Write an after-action report with specific, assigned actions and dates. Schedule the next exercise. Most agencies find that the second exercise, six months later, goes very differently.
We run these as a fixed-scope engagement, and we think every agency should do one annually whether or not they use us.