Lab Guide — Ransomware Tabletop
Facilitated exercise · 45 minutes · Fictional organisation, timed pressure
What this lab is
A facilitated ransomware tabletop for a fictional organisation. Working against the clock, your group walks the kill-chain, decides containment and communications, and settles a pay/no-pay stance. Nothing technical is performed; the exercise is the decision-making under pressure.
The scenario
Brief
On a Friday evening, systems across the organisation begin locking. A note demands payment and claims a large volume of sensitive data has already been stolen. Backups exist but have not been restore-tested in a year. The press has not yet called.
Part A — Contain & convene (15 min)
The first hour
- What do you order first? Who is on the crisis team and who has authority?
- How do you balance containment against preserving evidence?
Part B — Communicate (15 min)
Who hears what, when
- Which stakeholders, regulators, and partners must be told, and in what order?
- What do you say publicly — and what do you not say yet?
Part C — Pay or not (15 min)
The decision
State your pay/no-pay stance and the three facts that drive it. Identify the legal and sanctions checks required before any payment could even be considered.
✓ Self-check: your group directed rather than did, balanced containment with evidence, communicated by plan, and grounded the pay/no-pay call in policy, backups, and legal position — not the ransom amount.