Ransomware Tabletop Exercises for Boards: How to Run One

Start with the answer: run a ransomware tabletop for your board as a 90 minute, scenario-driven discussion with a neutral facilitator. Use a CISA tabletop exercise package as the base, adapt the scenario to your business, and focus on decisions the board must make or approve. Finish with a written list of gaps, owners and dates. Do it once a year, and again after any major change.

Why boards need their own exercise

Technical teams practice restoring systems. Boards face a different set of problems under pressure: who has authority to act, whether to pay, when to tell regulators, customers and insurers, and how to speak about it publicly. These decisions are made in hours, often by people who have never discussed them. A tabletop lets them practice when mistakes are cheap.

What CISA provides

CISA Tabletop Exercise Packages, known as CTEPs, are a set of resources for organizations that want to run their own exercises. According to CISA, each package is customizable and includes template exercise objectives, scenarios and discussion questions, along with references and resources. The collection covers many threat scenarios, including ransomware. Start there instead of writing from scratch, and adjust the language to your industry and size.

Set up the exercise

• Pick the objectives. For a board, good ones are: confirm who can declare an incident, test the decision path for a ransom demand, and check the notification plan.
• Choose a facilitator who is not responsible for the answers. An outside party is ideal, because it removes the pressure to look good.
• Invite the right people: directors, the CEO, the finance lead, legal counsel, the head of IT or security, communications and, if you have one, a representative of your insurer or response firm.
• Share a short briefing in advance, including the rules: this is practice, no one is graded, and the goal is to find gaps.
• Name a note taker to record decisions, disagreements and questions nobody could answer.

A 90 minute agenda

• 10 minutes: objectives, ground rules and how the scenario will unfold.
• 15 minutes, phase one: detection. Staff report that files are locked and a ransom note has appeared. Who is called? Who leads?
• 20 minutes, phase two: containment and impact. Several systems are down, backups may be affected, and the attacker claims to have stolen data. What operations stop? What do you tell customers?
• 25 minutes, phase three: decisions. A ransom demand arrives with a deadline. Who decides, with what advice, and what rules apply? What are the notice duties to regulators, clients and insurers?
• 15 minutes: recovery and communication. How is the restore ordered, and what do you say publicly and to staff?
• 5 minutes: review of actions.

Questions that expose gaps

• Who has the authority to shut systems down, and does the board know?
• Is there a retainer with a response firm, and does the insurer need to approve it first?
• Do you have a policy on ransom payments, including how sanctions rules and law enforcement contact would be handled? Counsel should lead on this.
• Where is the call list stored, and can you reach it if email and the network are down?
• How long can the business run without core systems, and what is the manual fallback?
• Which backups are offline or immutable, and when was the last full restore test?
• Who speaks to staff, clients and the press, and what is the first message?

Make it realistic, not theatrical

Use a scenario that fits the business. A law firm worries about client files and privilege. A clinic worries about patient care and health information. A manufacturer worries about the plant floor. Add small surprises, such as the response lead being unreachable, to see whether the plan survives. Avoid trick questions and blame.

After the session

Within a week, write a short report with what worked, what was unclear and a prioritized action list. Give each action an owner and a date, and report progress to the board at the next meeting. Update the incident response plan, call lists and decision rights. Then schedule the next exercise, perhaps a technical one for IT staff, so the two groups practice together.

Our team can facilitate a board tabletop, tailor a CISA package to your business and help you close the gaps it finds.

Sources

• CISA, CISA Tabletop Exercise Packages
• CISA, #StopRansomware Guide

This article is general information, not legal advice. Standards and vendor documentation change; confirm current requirements with your regulator, counsel and IT provider. Last reviewed November 9, 2026.

Keep reading

Next · SoftwareAPI Security: Broken Object-Level Authorization ExplainedBroken object-level authorization, listed first in the OWASP API Security Top 10 for 2023, happens when an API checks who you are but not whether you may access the specific record you asked for. This article explains how the flaw works, how to find it and how to prevent it.5 min read

• What a Code and Endpoint Security Review Finds in the First 24 Hours7 min
• Before Anyone Scans Your Website: Verification and Written Authorization7 min