Ransomware readiness

Ransomware Tabletop Exercises

Pressure-test response decisions before an attacker, auditor, customer, or executive deadline does it for you.

RansomwareTabletopIncident Response

Plan a ransomware tabletop See a sample output

When this helps

What this covers

Scenario design that combines technical ambiguity with business disruption.
Decision injects for legal, finance, communications, IT, and executive leadership.
Telemetry and restoration questions that reveal whether evidence is actually usable.
After-action reports with owners, gaps, and prioritized remediation.

A defined starting engagement

Facilitated ransomware tabletop

For leadership and IT teams that need to test who decides, who acts, and what evidence supports recovery.

Scope and output: A scenario for an agreed business service, staged developments, a facilitated discussion, a decision log, and an after-action report with owners and retests.

Illustrative deliverable / not a client result

First page of Ransomware Tabletop Exercise Kit — Ransomware Tabletop Exercise Kit / first-page preview

Recovery depends on an unavailable administrator

Evidence and finding: Illustrative observation: participants can name the backup system but cannot identify an alternate authorized to restore when normal identity access is unavailable.
Owned action: The infrastructure owner documents an approved recovery path and schedules an isolated restore test with the business owner.
Acceptance test: The retest records the recovered data point, elapsed time, access dependencies, failed steps, and business validation. A new procedure alone does not close the action.

Questions and answers

What access and staff time are needed?

Your response plan, recovery dependencies, roles, and an approved contact list. The discussion does not require production credentials or live attack activity. An incident lead, IT or security owner, business decision-maker, and relevant communications, legal, or supplier contacts. Agree attendance and session length during scoping.

How is the work scheduled?

Planning conversation, scenario approval, facilitated session, and findings review. Session dates depend on participant availability; preparation and delivery dates are confirmed in the proposal.

What is outside this engagement?

Live adversary simulation, actual system isolation, restore execution, legal determinations, and guaranteed incident readiness are outside the discussion exercise.

How is the fee determined?

The quote depends on scenario scope, participant groups, number of sessions, and whether a follow-up exercise is needed. You receive an agreed scope and fee before scheduling delivery.