Ransomware: a table-top exercise to clarify who decides in the early stages
Let's discuss your project →A ransomware simulation can expose missing contacts and decisions with no clear owner. Here is a scenario to discuss without touching real systems. According to the UK NCSC, an exercise on ransomware is available in Exercise in a Box. The scenario below is an original Dedaloop editorial proposal: it does not reproduce the official exercise and it does not describe a real incident.
Simulated scenario
On Monday morning, a colleague reports that some shared files will not open. Shortly after, a ransom note appears on one computer. At this stage, we do not know whether other systems are involved or whether data has been taken. In the minutes, that uncertainty must remain explicit.
Bring together the person who coordinates operations, the IT lead, someone from management, and the communications lead. Assign a facilitator and a note-taker. During the simulation, do not run malware, disconnect devices, or change configurations: the purpose is to discuss choices, responsibilities, and authorisations.
Four decisions to test
- Who receives the report and who declares the incident? Have the team find the contact in the plan without prompting them.
- Who can authorise containment, and which services could stop? Leave the technical choice to the appropriate owners, while preserving evidence according to the response plan.
- How do you communicate if company email is unavailable? Verify a pre-agreed fallback channel and the identity of the participants.
- Who decides when service can resume? A backup being available is not enough to show that the return environment is trustworthy.
Making the notes useful
For each decision, record the owner, the information needed, the proposed action, and the open question. Separate simulated facts, assumptions, and checks still to perform. If someone suggests promising a recovery date, ask what evidence supports it.
The expected outcome is a short list of corrections: for example, a missing backup contact, an undefined decision authority, or a recovery test that was never planned. Assign each correction to one person and confirm closure in a second session.
This exercise is meant to prepare coordination; it does not replace a technical plan or incident support. Any notification obligations must be assessed by the appropriate responsible people based on the specific case, without turning the workshop into legal advice.