Step-by-step guide
How to run a ransomware tabletop exercise
A two-hour exercise format that tests an agency's decision-making, communications, and recovery assumptions with the people who would actually respond.
A tabletop exercise is a structured discussion of a simulated incident. It costs a couple of hours and reveals more about readiness than any document review, because it surfaces the decisions nobody has made yet.
Ransomware at a public agency is not an IT incident. It is an organizational one, so the room needs more than IT.
Steps
1Assemble the right room
The chief executive or administrator, IT, finance, human resources, legal counsel, the public information officer, and representatives from the operating departments that would be affected. Invite one or two elected officials for at least part of the session.
2Set the ground rules
No blame, no need to solve everything, and honest answers about what does not exist. Assign a facilitator who is not the IT director and a note taker who records decisions, gaps, and questions.
3Open with the first hour
Present the scenario: file servers encrypted, a ransom note on screens, discovered early on a Monday. Ask who is called, in what order, what gets disconnected, and who has authority to shut systems down.
4Advance to the first day
Email is unavailable, a resident-facing system is down, a reporter has called, and payroll runs Thursday. Work through communications to staff, residents, and the press, and through the manual processes each department would fall back to.
5Introduce the data theft complication
The attackers claim to have exfiltrated personnel and resident data. Cover the insurer and breach counsel, the notification obligations, the decision authority on payment, and who speaks publicly.
6Jump to recovery
Two weeks later, systems are partly restored. Discuss the order of restoration, how the agency verifies systems are clean, what was lost, and what the backlog looks like for each department.
7Capture gaps as you go
The note taker records every "we would need to check that" and "nobody has that number" as a specific action item with an owner.
8Write the after-action report within a week
List what worked, what did not, and the assigned actions with dates. Keep it short enough that leadership reads it.
9Schedule the next one
Put the follow-up exercise on the calendar before the room clears, and test the actions from this one in it.
What you end up with
A short list of assigned, dated actions, and a leadership team that has now made its hardest decisions once before it had to. Most agencies find the second exercise goes very differently from the first.