Tools · How are we doing

Run a tabletop exercise

Pick one of the 8 scenarios from the exercise pack and run it from this page on a shared screen. Show the room one inject at a time, keep the facilitator's notes hidden from them, and finish with the debrief. Nothing is recorded.

For the facilitator. Do not show this page to participants before the session. The injects only test the plan if the room meets them for the first time.

1. Choose a scenario

Ransomware encryption of core systems Early on a Monday, ransomware encrypts file servers and then the ERP. Orders and dispatch stop. Later that day, the attacker claims to have copied customer data and demands payment. 6 objectives · 9 injects · 180 minutes Critical supplier outage The cloud hosting provider that runs the online ordering service is hit by ransomware. The service is down for five days, and the provider says little. 5 objectives · 8 injects · 180 minutes Insider data exfiltration A sales manager who has resigned to join a competitor copies the customer list to a personal cloud account. HR, Legal, the line manager and security must act together without tipping the person off or breaking the law. 5 objectives · 8 injects · 180 minutes Cloud tenant account takeover In the early hours, an attacker adds a global administrator to the cloud email and office tenant, registers an app that can read every mailbox, and turns off a sign-in policy. 6 objectives · 8 injects · 180 minutes Executive payment fraud On a Friday afternoon, an email from the chief executive's real mailbox asks Accounts Payable for an urgent, confidential payment of €310,000. It is paid. The fraud is found on Monday morning. 6 objectives · 8 injects · 180 minutes Personal data breach against the clock A software release mixes up sessions in the customer portal, and customers see each other's orders. The facts arrive slowly, the Data Protection Officer goes on leave, and the 72-hour clock runs. 5 objectives · 8 injects · 180 minutes Health Data Breach and the 60-Day Clock An analytics vendor that works for us tells us that a storage bucket holding member files was publicly readable for 19 days. It held files for our own health plan members and for the members of a smaller plan we serve as its business associate. The members live in eleven States, and the privacy officer is new. 5 objectives · 8 injects · 180 minutes Is It Material? Four Business Days for a Listed Company On Wednesday 2 September, ransomware stops the claims system of a listed health insurer that is licensed in New York. The attacker says it has copied member records. The disclosure committee must decide whether the incident is material. 5 objectives · 8 injects · 180 minutes

Fill the blanks for your organisation

The deck leaves these for you to set before the session. The defaults are the deck's own examples. What you type stays on this screen and is gone when you close or reload it.

Your core business system

Minutes allowed to decide isolation

Minutes allowed to approve messages

Your recovery order

Ransom demanded (€)

Stop phrase

Opens on the ground rules. Use the arrow keys or the buttons to move on.

Nothing is recorded. This page does not save decisions, ratings, names or notes, and sends nothing anywhere. The scribe and the observers keep their own record on the evaluation sheet in the scenario deck, as the pack's procedure sets out.

The session screen needs JavaScript

The scenario is stepped through in your browser, so that nothing about your exercise is sent to us. Without JavaScript, run it from the scenario's deck, which has the same slides and speaker notes:

8 scenarios, about 3 hours per session
Nothing is recorded, not even in your browser: reloading starts again
If you accepted analytics, we count how far people get through the questions, never what they answer.

How this works, and what it is not

Each scenario is one of the pack's decks, word for word: its objectives, its injects at their scenario time and exercise minute, the decision each forces, the expected good answer, the rule it is judged against, and the prompts to use if the room stalls. The session follows the pack's run of show:

The run of show, 180 minutes
Part	From minute	Minutes	What happens
Pre-brief	0	15	Objectives, ground rules, roles and how the session runs. Participants hear the objectives, never the injects.
Phase 1: first signs and the first hour	15	40	Detection, triage, declaration, first containment.
Break	55	10	Facilitator and observers check timing and which objectives are still untested.
Phase 2: escalation and the big decisions	65	40	Severity, reporting, decision rights, suppliers.
Phase 3: recovery, reporting and communication	105	40	Restoring safely, outside communication, the days after.
Hot debrief	145	30	Round the table, Observers, Agree and close.
Close	175	5	Thanks, what happens next and when the after-action report is due.

What it is not

Not a record of the exercise. It keeps no decisions, ratings, names or notes. The scribe records each decision as it is taken, and the observers rate each objective on the deck's evaluation sheet.
Not a secret. The page is public, so anyone can read every inject. Run it with people who have not opened it, and do not send it to them beforehand.
Not your plan. The expected answers quote the CISO Times incident response pack's rules. Where your own plan differs, judge the room against your plan, and change the blanks and the deck to fit it.
Not a pass mark. Each objective is rated in words, Met, Partly met, Not met or Not tested. Nothing is scored.

Scenarios from: Cyber Incident Exercises & Tabletop Scenario Library, decks P10-A04 to P10-A14
Session from: Exercise Planning & Facilitation Procedure, version 1.3
Runs: In your browser. Nothing you enter is sent or stored

1. Choose a scenario

Fill the blanks for your organisation

2. Run the session

How this works, and what it is not

What it is not