domains / families / security / performing-ransomware-tabletop-exercise

performing-ransomware-tabletop-exercise

separate

'Plans and facilitates tabletop exercises simulating ransomware incidents,

When to use

• Testing organizational ransomware response procedures annually or after major infrastructure changes
• Validating decision-making processes for ransom payment, regulatory notification, and public disclosure
• Training executives, IT, legal, PR, and operations teams on their roles during a ransomware incident
• Meeting cyber insurance policy requirements for documented incident response testing
• Identifying gaps in recovery playbooks, communication plans, and backup procedures

When not to use

• Substitute for technical controls testing
• Technical detection testing
• Technical prevention capability testing

Skill page

Source