Sent on request
Backups worked. The data still left.
A ransomware tabletop you run yourself, with your own leadership team. One brief, four injects on the clock, one held in reserve, and the decision each one forces. This page describes the pack. The file itself goes to a named person.
What it is
Six printed sheets that let somebody inside your company facilitate a 3-hour ransomware exercise for 6 to 12 people, with no preparation beyond reading it once. It is a discussion exercise. Nothing is switched off and no live system is touched.
The scenario is built around a specific failure. The backups are fine and the restore works, and the incident is not over, because the attacker claims to have copied the data out first. In Coalition's 2025 claims data, 70 percent of ransomware claims involved data theft as well as encryption (Coalition, 2026 Cyber Claims Report, 2026). A clean restore ends the outage, not the incident, and rooms that have only ever rehearsed the outage stop at the wrong place. This pack is written so the room reaches the second half.
Every scenario detail is fiction and is meant to be swapped for yours. The servers, the hours, the gigabyte figure and the deadline are all written to be replaced, and sheet 2 says which parts of the shape to keep when you do.
What is inside
| Sheet | What it is | What is on it |
|---|---|---|
| 1 | Cover, and before you run it | What the pack can and cannot do, who reads which sheet and when, and the one rule that keeps a tabletop from turning into a normal IT meeting. |
| 2 | The brief, and the facts pack | The brief you read aloud at fifteen minutes in, then the facilitator’s facts pack: six things that are known, five the room will state as fact anyway, and five nobody can know yet. Sorting those three columns is the whole of the first inject. Held back, not handed out. |
| 3 | Injects one and two | A guess becomes a fact in six minutes, then four days down or stay up and carry it. Each card carries what to push for and what you are listening for in the answer. |
| 4 | Injects three and four | Somebody outside has a screenshot and a deadline, then the incident ends with nothing published and nothing disproved either. The fourth is the one most rooms have never had. |
| 5 | The reserve inject, and the capture sheet | One inject held off the clock for a room that moves fast, with a note on when not to use it. Then the scribe’s capture sheet: four rows, and a column for elapsed time that cannot be reconstructed afterwards. |
| 6 | Facilitating it yourself, and about us | Five ways this goes wrong when somebody inside the company runs it, each with the fix, and one sheet about what we do. |
Four injects means four decisions, and the capture sheet is built around them rather than around the story.
| The decision | What it puts in front of the room |
|---|---|
| 1. Who is running this | A name said out loud, where facts get written down, and what the nine o’clock client is told. |
| 2. Down or up | Four working days of downtime against staying up while it is investigated. Who authorises it, on what basis, and who calls the clients. |
| 3. What we said, to whom | A journalist with a screenshot and your largest client asking directly. Two audiences who do not get the same words, and who approves them. |
| 4. Whether to notify | Systems back, restore clean, and a provider summary saying there is no evidence data left and no evidence it did not. What you owe people when the evidence is absent rather than clear. |
Half the sheets are for the facilitator only. The facts pack, both inject sheets and the reserve are read by one person and nobody else, and the pack says so on every one of them. That is what makes the exercise work: the room is supposed to discover that it cannot tell what it knows from what it has inferred.
When to use it, and when it is the wrong thing to reach for
Use it between whatever formal exercise you run once a year. Quarterly is a reasonable rhythm, and repetition is what makes decisions fast under pressure. It is also a sensible thing to run before a facilitated session, so you walk into that one already knowing your two worst gaps instead of finding them on the day.
It is the wrong thing to reach for if the money has gone out of the door rather than the systems going down. A payment fraud has nobody to negotiate with and the only clock that matters belongs to a bank, so a room that reaches for isolate, restore and contain recovers nothing. The business email compromise pack is the one for that. If the breach is at a supplier and you hold none of the facts, use the third-party breach pack.
It does not produce third-party attestation, and page one of the pack says so. Run this and you will find real gaps, and the write-up is yours to keep. What you cannot write is the page saying an independent facilitator was in the room. Your own account of your own exercise answers the question on a renewal application. It does not evidence it.
Why it is not on this page in full
Because four of the six sheets are the facilitator's, and two of them carry the instruction not to hand them out. The facts pack tells the facilitator which of the things the room is about to state confidently are not actually known. The inject cards tell them what to listen for before the room has said it. Publishing that on a page anyone can read would mean the first person in your company to find it has read the answers, and there is no way to unsee them.
So the pack goes to one person by email, and the rest of the session is theirs to run. One email address, and the file is on the next page rather than in your inbox.