Ransomware Recovery Tabletop Exercise for Executives
Run a ransomware recovery tabletop by asking executives to decide which business service can reopen, what evidence supports that decision, and who can stop the restart. This 60-minute exercise produces a recovery decision record and assigned follow-up actions.
What does a ransomware recovery tabletop test?
A ransomware recovery tabletop rehearses decisions about restoring business operations after an attack. Leaders practice setting priorities, requesting evidence, and approving a limited restart while customer pressure grows.
For a September 24, 2026 offsite, bring the recovery plan, service dependencies, and latest restoration test results currently in use. Date each document so the discussion exposes decisions that depend on outdated assumptions.
The exercise draws on NIST guidance to check backup integrity before restoration and validate restored systems before production use. These are separate checkpoints in the April 2025 publication. [NIST SP 800-61 Rev. 3, recovery guidance](https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r3.pdf#page=42).
Prepare the fictional scenario and roles
Use this fictional brief: ransomware has interrupted a distributor's order processing. IT has restored an isolated copy from a backup, but recent orders need reconciliation and a warehouse connection remains unverified.
A major customer wants a shipping commitment before the next dispatch window. The team must choose an operating mode, state its prerequisites, and agree when to reconsider.
- Operations: identify which orders can be fulfilled and the limits of manual processing.
- IT recovery and security: explain restoration evidence, unresolved dependencies, and conditions that block reconnection.
- Finance: describe the business consequences of delay using explicitly labeled exercise assumptions.
- Customer communications and legal: review what the organization can accurately promise.
- Executive sponsor: approve the operating decision within existing authority.
- Facilitator and observer: release scenario updates and record decisions, assumptions, and unanswered questions.
Compare three recovery choices
Ask participants to select a provisional option and explain what evidence would change it. No option earns points simply for restoring service faster.
| Operating choice | Potential benefit | Constraint to resolve |
|---|---|---|
| Keep automated order processing paused | Allows more time for validation and reconciliation | Backlog grows; name the next review time and the evidence needed |
| Process priority orders manually | Supports selected customers while systems remain isolated | Staff capacity, duplicate orders, and record reconciliation limit throughput |
| Reopen one validated order channel | Restores a bounded portion of normal service | Requires verified dependencies, monitoring, and a workable stop procedure |
Run the 60-minute exercise
The timings below are a suggested facilitation plan. Keep simulated facts consistent: if participants ask for unavailable evidence, record the gap and require a conditional decision.
- Minutes 0–10: read the brief, assign authority, and identify the first service to prioritize.
- Minutes 10–25: choose an operating mode and list the evidence required before it starts.
- Minutes 25–35: reveal that the warehouse connection uses an account still under investigation. Ask whether the proposed restart depends on that connection.
- Minutes 35–45: reveal that manual orders overlap with restored records. Require a reconciliation owner and a customer update that acknowledges uncertainty.
- Minutes 45–60: review the decisions, identify missing evidence, and assign follow-up work.
Leave with a restart decision record
Capture one sentence per field: service and scope; evidence reviewed; unresolved conditions; decision owner; next review time; stop trigger; customer message owner. Keep assumptions visibly separate from verified facts.
For example: reopen the priority order channel only after its dependencies are validated and duplicate orders reconciled; pause it if reconciliation fails or suspicious activity appears. The exercise should identify who verifies each condition and who has authority to stop service.
In the debrief, ask which decision relied on evidence nobody could produce. Assign each gap an owner, a due date, and a concrete deliverable, such as a dependency map or restoration test result.
Frequently asked questions
How is a recovery tabletop different from a ransomware response tabletop?
This recovery exercise starts with operations disrupted and restoration underway. It concentrates on service priorities, restart evidence, and operating restrictions; a broader response tabletop may also cover initial detection, containment, and incident coordination.
Does a tabletop prove that backups can be restored?
No. A tabletop rehearses decisions and can expose missing restoration evidence. A separate technical recovery test is needed to demonstrate that backups and dependent services actually work.
Run this as a real exercise
Team Exercises helps facilitators turn business training topics into AI-powered simulations with team links, decision rounds, analytics, and debrief-ready outcomes.
Start a free scenario