Who should attend a ransomware tabletop exercise?

The people who would have to decide, which is not the same as the people who understand ransomware. Between 6 and 12 in the room, never fewer than 5. Pick seats by what each person can authorise without asking anybody, not by job title, and you will get most of it right.

What does the requirement actually say?

Where incident response testing is mandated, the wording is about people and nothing else.

New York’s financial services rule requires covered entities to test their incident response and recovery plans periodically, but at a minimum annually, and specifies who has to be there: with all staff and management critical to the response (NYDFS, 23 NYCRR 500.16(d), 2023).

Critical to the response. Not the security team, not the people who know most about ransomware. The people without whom the response does not happen.

That rule almost certainly does not bind you, and it is the clearest published statement of who an exercise is supposed to involve. It also happens to be the same list an after-action report records by role, which is what an auditor or an underwriter reads.

The seats, and what each one is there to decide

Somebody who can spend money without asking. Every ransomware scenario reaches a point where an outside firm has to be engaged at short notice. If nobody in the room can commit funds, the exercise stalls on a question that has no answer.

Whoever owns the technical response. One person, not the whole team. They tell the room what is knowable and when, which is usually less and later than everyone assumes.

Somebody who speaks for the business to customers. The person who would sign off on what gets said, not the person who would write it.

Legal, or whoever calls legal. Internal counsel if you have it, and the person who would pick up the phone to external counsel if you do not.

Finance, if the scenario involves payment. A ransom conversation without finance in the room is theatre.

Whoever actually answers the phone at 2am. Frequently not the person the plan names, and finding that out is worth the three hours on its own.

The pair the room falls back on

Watch what happens when a scenario turns towards disclosure.

Technical and executive participants both defer to the same pair: legal counsel and communications, together. Not separately. The room wants to know what it is obliged to say and how it will land, and it treats those as one question.

If neither is present, the exercise stalls at exactly the point it was built to reach. If one is present without the other, you get half an answer and the room knows it.

A breach coach in the room changes the exercise materially. Decisions get faster and more specific, because somebody present has done this before.

Who should not be in the room

More people than you would think.

Anybody who cannot decide anything. Observers dilute a room: with twelve seats and four spectators, the eight who can decide start performing for the audience.

The whole IT team. One technical owner is enough.

And anybody so senior that their presence stops people disagreeing. That one is worth thinking about honestly, because the disagreements are the exercise.

Below 5 people, the opposite problem: nobody present holds a different instinct from whoever speaks first, and you get consensus without testing anything.

When the list arrives before the scenario

Worth recognising, because it usually means the request came from compliance rather than from security.

When a compliance function drives it, the ask tends to specify who must be in the room instead of what must be tested. Somebody has read a control, worked out which roles it implicates, and written the names down.

That is not wrong. The requirement genuinely is about participation, and participation by role is exactly what the report records. It does mean the scenario becomes an afterthought, so it is fair to ask what control the exercise is evidencing. The answer shapes the scenario, and a well-chosen scenario with the same people in the room produces a much better document.