A board and executive tabletop exercise for ransomware: scenario injects, a decision log, insurer and counsel notification and an after-action plan

A mid-size company had an incident response plan, but it was written for the IT team. The board and executives had read it once and had never worked through it together. The client is not named on this page, and this is an illustrative engagement that describes the kind of work our team does; details are composite. The company's cyber insurer had asked whether leadership had ever practiced, and the honest answer was no.

Our team built the exercise from the company's own systems and contracts. The scenario was a Friday-evening ransomware event: file servers encrypted, email offline, a ransom note on a screen. A facilitator ran the session and a scribe kept a decision log, recording each decision, who made it, the time and what was known when it was made. Participants were the board chair, the executives, and the IT, legal and communications leads.

Injects arrived as the clock moved: a customer asking whether its data was exposed, a reporter calling, a finding that some backups had been touched, and a message from the attacker with a deadline. Each inject forced a decision that belongs to leadership, not to IT: whether to shut systems down, when to bring in outside forensics, who speaks to customers and staff, and who may talk to the attacker. Telephone and messaging were part of the test, because the usual channels were down in the scenario.

The group also practiced notice. They found the insurer's notice terms and approved-vendor requirements in the policy, decided when to call outside counsel so the investigation could run under privilege where the law allows it, and listed which regulator, customer and law-enforcement notices could apply. Counsel advised on the legal points; our team does not give legal advice, and the exercise only shows where the decisions sit.

A debrief the same day listed what worked and what stalled. Within two weeks the company had an after-action plan: owners, dates, edits to the response plan, a one-page call tree and a gap list for backups and logging. A shorter follow-up exercise was set for six months later to confirm the fixes. This is the work our team does under cybersecurity and disaster recovery. A rehearsal improves readiness and does not guarantee the outcome of a real incident.