A ransomware tabletop exercise is a facilitated discussion in which executives and responders work through a scripted ransomware scenario and talk through the decisions they would make, without deploying equipment or other resources. As of October 2026, the main free building blocks are CISA’s Tabletop Exercise Packages (including a ransomware situation manual), NIST SP 800-84, FEMA’s HSEEP doctrine and the UK NCSC’s Exercise in a Box; this guide turns them into a plan, a fictional five-inject scenario and an after-action process.
Related backup and resilience coverage is listed in Enterprise Techie’s topic index.
In this guide
Key facts
| Resource | Publisher and date | Use it for |
|---|---|---|
| CISA Tabletop Exercise Packages (CTEP) | CISA; Ransomware situation manual dated September 2023 | Customizable scenario, objectives and questions; handbooks; after-action template |
| SP 800-84, Guide to Test, Training, and Exercise Programs | NIST; September 2006 | Exercise types, facilitator and data collector roles, after action report |
| HSEEP doctrine | FEMA; 2020 revision | SMART objectives, hotwash, After-Action Report/Improvement Plan |
| Exercise in a Box | UK NCSC; free online tool | Ready-made tabletops, including two ransomware scenarios |
| Cross-Sector Cybersecurity Performance Goals 2.0 | CISA; report revised December 11, 2025 | Voluntary goal to drill incident response plans at least annually |
| DORA, Regulation (EU) 2022/2554 | EU; applies from January 17, 2025 | Yearly testing of response and recovery plans at financial entities |
Why start with a tabletop
NIST SP 800-84 describes a tabletop as a discussion in which a facilitator presents a scenario and asks questions that start a discussion of “roles, responsibilities, coordination, and decision-making.” It calls tabletops cost-effective tools for validating plans such as incident response plans. The NCSC considers cyber exercising one of the most cost-effective ways to test incident response.
That suits ransomware, where many of the hardest calls are decisions: who can disconnect systems, when counsel and the insurer are called, what to say in public, who decides on payment. A tabletop doesn’t show that backups restore or how long recovery takes; that needs a technical test, covered in Enterprise Techie’s backup restore testing guide.
The plan has to exist first. The NCSC’s exercise creation guidance says that without response plans “you have nothing to test,” and SP 800-84 suggests a training event first if participants haven’t been trained on their roles. If the plan isn’t written, start with the ransomware recovery plan runbook and the disaster recovery plan template.
Planning the exercise
CISA’s Exercise Planner Handbook assumes planning starts at least three months out; SP 800-84 says planning typically starts at least one month ahead, or three months for large, complex exercises.
- Objectives. FEMA’s HSEEP doctrine asks for specific, measurable, achievable, relevant and time-bound (SMART) objectives. SP 800-84 says a tabletop should validate the plan’s content, roles and interdependencies. The NCSC suggests tying the exercise to the organization’s greatest cyber risks. Example: confirm who can authorize isolating production systems, and how that order travels if email can’t be trusted.
- Audience and length. SP 800-84 recommends separate senior-level and operational-level tabletops at first, then a combined session. It puts senior sessions at two to four hours and operational sessions at two to eight; CISA’s templates assume about four hours. CISA’s scenario library includes an Executives and Senior Leadership situation manual.
- Players. CISA says players should have the authority to speak for the function they represent: here, an executive decision-maker, IT and security, the backup owner, legal counsel, communications and the owner of the cyber insurance relationship. CISA’s #StopRansomware Guide lists the cyber insurance company among stakeholders to engage under the notification plan and advises consulting legal counsel on breach notification.
- Facilitator. CPG 2.0 lists table-top exercises among the validation exercises it suggests engaging third-party experts to run, an option when nobody inside can facilitate neutrally.
Roles in the room
- Facilitator: presents the scenario, asks the questions and keeps discussion on the objectives and the clock.
- Players: the people whose roles appear in the plan; they say what they would do and answer questions.
- Observers: in CISA’s description, they don’t generally take part but may ask questions or offer expertise when the facilitator calls on them.
- Data collector or note-taker: SP 800-84’s data collector records what happens; HSEEP’s note taker frees the facilitator to ask follow-ups. CISA’s Facilitator/Evaluator Handbook has evaluators record who decided, what, why and how, and tells them not to prompt players.
Sample ransomware tabletop exercise scenario
Fictional scenario. The organization, systems and events below are invented and do not describe any real company or incident. Following NCSC guidance, start every exercise message with “EXERCISE, EXERCISE, EXERCISE” and the exercise name, here Exercise STILL WATER. Setting: a fictional regional distributor with on-premises virtual servers, a directory service, cloud email and a separate backup platform.
| Inject | Simulated time | What players learn | Decision under test |
|---|---|---|---|
| 1. Detection | Day 1, 07:10 | Renamed files and a ransom note on shared drives; endpoint alerts on several servers | Isolate or wait |
| 2. Escalation | Day 1, 10:30 | A new privileged account and signs of data staged for transfer; the note threatens publication | Who declares; when to call counsel and the insurer |
| 3. Backups | Day 1, 15:00 | The compromised account reached the backup console and recent restore points are gone; an offline copy has never been used to rebuild the directory | Whether backups can be trusted |
| 4. Pressure | Day 2, 09:00 | A journalist and a major customer ask about stolen data; email is down | External communications |
| 5. Demand | Day 2, 16:00 | A payment deadline arrives; a board member asks whether paying would end the outage sooner | The ransom question |
Inject 1: detection
- Who has written authority to take systems offline, and who covers when that person is unreachable?
- How is the order given? CISA’s guide recommends out-of-band methods such as phone calls so attackers watching internal channels aren’t tipped off.
- What evidence is preserved? CISA treats powering devices down as a last resort because volatile memory evidence is lost. Compare answers with the runbook’s first-hours section.
Inject 2: escalation
- Who declares a major incident, and is that person in the room?
- When are outside counsel and the insurer notified, and what does the policy require before outside firms are hired?
- Who reports to law enforcement, CISA or the NCSC, and to regulators?
Inject 3: backups
- What evidence would show the offline copy is clean, and who signs off? See the runbook’s scoping section and Enterprise Techie’s air-gapped backup guide.
- Has the directory ever been rebuilt from backup, and who would do it?
- What comes back first, and does that match the runbook’s rebuild order?
Inject 4: pressure
- Is there a pre-drafted holding statement, and who can release it? CISA’s guide asks for holding statement templates in the communications plan.
- How are staff, customers and partners reached without email?
- Who decides whether breach notification duties apply?
Inject 5: demand
- Who can approve or refuse a payment, and is that authority written down?
- Has counsel assessed sanctions exposure? OFAC’s 2021 advisory says the US government “strongly discourages” paying and that civil penalties for sanctions violations can apply on a strict liability basis; the runbook’s payment section covers the OFAC and NCSC positions.
- Given inject 3, would a restore beat a decryptor?
Running the session
Open with scope, roles and ground rules. HSEEP says participants should be reminded they are deciding in a no-fault environment. The NCSC adds two rules: don’t “fight the scenario,” and expect to decide on incomplete information, as in the early stages of a real incident.
Release one inject at a time. CISA suggests preparing about half a dozen extra questions in case a module runs ahead. Keep the scenario short: SP 800-84 warns that with long, detailed scenarios, participants often spend more time dissecting the scenario than meeting the objectives.
Close with a hotwash straight after play. CISA’s handbook suggests asking whether the objectives were met, what the major gaps are and what the next steps should be; facilitators and evaluators then debrief separately to agree on three strengths and three areas for improvement.
The after-action report and improvement plan
SP 800-84 says the after action report should cover the exercise’s purpose, objectives, participants and scenario, the facilitator’s and data collector’s observations, and recommended plan changes, against evaluation criteria written before the exercise. HSEEP’s After-Action Report/Improvement Plan (AAR/IP) sorts observations into strengths and areas for improvement and includes a list of corrective actions. CISA says evaluators must find the root cause of each objective not met as expected: if nobody knew who could take the network offline, ask whether that authority was written down and whether people knew where to find it.
- HSEEP’s after-action meeting agrees corrective actions, deadlines and owners; corrective actions should be SMART and tracked until complete.
- CISA’s timeline: draft the AAR/IP within three to four weeks, meet five to six weeks after the exercise, finalize within two weeks of that meeting.
- The NCSC says to implement recommendations before the next exercise.
How often to run one
No source below sets a frequency for ransomware tabletops specifically. Some set one for exercising or testing response plans in general.
| Source | What it says | Applies to |
|---|---|---|
| CISA CPG 2.0, goal 1.C | Incident response plans “reviewed and drilled, at a minimum, on an annual basis” | Voluntary |
| DORA, Article 11(6) | Test ICT business continuity and response and recovery plans at least yearly and after substantive changes; test crisis communication plans | EU financial entities |
| 23 NYCRR 500.16(d) | Test incident response and BCDR plans with all staff and management critical to the response, at a minimum annually | New York DFS covered entities |
| NIST SP 800-84 | No fixed interval: periodically, and after organizational changes, plan updates or new guidance | Guidance |
| FEMA HSEEP; UK NCSC | No interval | Guidance |
Two of these rules also require technical testing that a discussion can’t provide. DORA says testing plans at financial entities other than microenterprises must include cyber-attack scenarios and switchovers to backups and redundant facilities, and the New York rule requires testing restores of critical data and systems from backups. Enterprise Techie’s DR testing cadence guide covers DORA’s wider testing program.
Checklist
- Written incident response and communications plans exist, and players know their roles.
- A senior sponsor has approved SMART objectives mapped to the plan.
- Players cover the executive decision, IT and security, backups, legal, communications and insurance.
- Facilitator, data collector and observers are briefed; evaluation criteria are written.
- The scenario is labeled fictional and every message starts with “EXERCISE, EXERCISE, EXERCISE.”
- Every corrective action in the AAR/IP has an owner and a deadline.
- A technical restore test is scheduled to check what the tabletop assumed.
Bottom line
- Put the owners of the hard decisions in the room: isolation, counsel, insurer, communications and payment.
- Judge the exercise by the corrective actions it produces and whether they close before the next one.
- Treat any regulatory frequency as a floor, and follow the tabletop with a restore test.
Frequently asked questions
What is a ransomware tabletop exercise?
A facilitated session in which the people named in an incident response plan talk through a ransomware scenario and the decisions it forces. NIST SP 800-84 and FEMA’s HSEEP both classify tabletops as discussion-based exercises, and SP 800-84 adds that no equipment is deployed.
Where can I find a free cybersecurity tabletop exercise template?
CISA’s Tabletop Exercise Packages include a Ransomware situation manual, handbooks and an AAR/IP template. The NCSC’s Exercise in a Box has two ransomware tabletops, and NIST SP 800-84’s Appendix A has sample tabletop documents.
How often should you run a ransomware tabletop exercise?
No source sets a ransomware-specific interval. CISA’s CPG 2.0, DORA and New York’s 23 NYCRR 500.16 each call for drilling or testing response plans at least annually for the organizations they cover; NIST SP 800-84 sets no fixed interval.
What is an inject in a tabletop exercise?
Information released to players during the exercise, written or verbal, that moves the scenario on. The NCSC advises being clear about what each inject is meant to do and the actions it should prompt.
Sources
- CISA: Tabletop Exercise Packages (CTEP)
- CISA: Cybersecurity Scenarios (CTEP situation manuals)
- CISA: CTEP Package Documents
- CISA: CTEP Exercise Planner Handbook (PDF)
- CISA: CTEP Facilitator/Evaluator Handbook (PDF)
- NIST SP 800-84: Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities
- FEMA: Homeland Security Exercise and Evaluation Program (HSEEP)
- NCSC: Exercise in a Box
- NCSC: Effective steps to cyber exercise creation
- CISA, FBI, NSA and MS-ISAC: #StopRansomware Guide
- CISA: Cross-Sector Cybersecurity Performance Goals 2.0
- Regulation (EU) 2022/2554 (DORA)
- New York DFS: Second Amendment to 23 NYCRR 500 (PDF)
- US Treasury OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (PDF)
Last checked: October 2026. Guidance changes; check each source before you rely on it.
Buying? Start from RFPhub’s free Immutable Backup and Cyber Recovery Vault RFP template.