Most ransomware plans live in a document nobody has opened since the last audit. The fastest way to find out whether yours works is to put six to ten people in a room, hand them a bad morning, and watch what they do. No consultant required, no fancy off-site, no full day blocked on the calendar. You need a scenario, a facilitator, and two hours.
Why Two Hours Is Enough
Long exercises collapse under their own weight. People cancel, attention sags after the second hour, and the conversation drifts. A tight 90-minute run followed by a 30-minute debrief tests the decisions that matter most: who declares an incident, who calls whom, what gets isolated first, and who speaks to customers.
If this is your first attempt, start smaller than feels impressive. A short exercise you repeat twice a year beats an elaborate one you never schedule again. Realism improves with repetition, not with planning.
Before You Start: Scope, People, and Ground Rules
Choose a scenario close to your real risk
Use something plausible for your environment. A phishing email that yields stolen credentials and a locked file share is enough for most organizations. If you run manufacturing, add a stopped production line. If you handle regulated data, add the question of whether personal information was taken, and when that has to be reported. Resist the apocalyptic version — the goal is testing ordinary decisions under pressure, not disaster theatre.
Assign roles before the clock starts
Hand everyone a card with their role. Keep the cast lean:
- Facilitator — runs the clock, reads injects, stays out of the decisions.
- Incident commander — owns priorities and makes the final call.
- Scribe — records every decision, timestamp, and open question.
- Technical lead — speaks for IT and security operations.
- Communications lead — drafts internal and external messages.
- Business representative — argues for the teams losing revenue while systems are down.
- Legal, risk, or insurance liaison — handles notification and policy questions.
- Observers — silent, taking notes for the debrief.
In a small company one person may hold two roles. That is realistic, and worth discovering on a quiet Tuesday rather than during a real incident.
Set three ground rules
No blame. Decisions must be made with the information available at that moment, not with hindsight. And the facilitator may pause the clock at any point to ask, "What are you actually doing right now?" Put those three lines on the wall where everyone can see them.
The 90-Minute Run of Show
Keep the facilitator's script to a single page. A workable shape looks like this:
- 0–10 minutes: briefing. Explain the ground rules, read the opening situation, confirm roles. No discussion of solutions yet.
- 10–25 minutes: first inject. Users report files they cannot open, with a ransom note on a shared drive. The commander must decide whether to declare an incident, who gets woken up, and whether to isolate systems.
- 25–45 minutes: scope widens. A second site or department is affected, and backups are suspected of being tampered with. The team has to weigh containment against keeping a revenue-critical service running.
- 45–60 minutes: data theft surfaces. Someone claims data was copied before encryption. Legal and communications now have real work to do.
- 60–75 minutes: outside pressure. An employee posts on social media; a customer calls the main switchboard; a journalist sends an email asking for comment.
- 75–90 minutes: recovery choices. The team must decide what to restore first, who authorizes payment questions, and what "back to normal" actually means.
Then take a ten-minute break before the debrief. People need a moment to step out of the scenario.
Writing Injects That Test Decisions, Not Trivia
An inject is one fact, delivered at one moment, that forces a choice. Good ones are specific and slightly uncomfortable.
"At 09:40 the finance director forwards a message from your largest customer. They have been told your company suffered a breach and that their data may be involved. Nothing has been confirmed internally."
Five to seven injects is plenty for 90 minutes. Vary them: some create ambiguity, some contradict earlier information, some arrive through a channel nobody is monitoring. If the team dives into log analysis or starts troubleshooting a server, the facilitator should nudge them forward. This is a decision exercise, not an incident response shift. Time compression is normal — an hour of exercise can represent two days of real events, and saying so out loud helps.
The Debrief Is Where the Value Lives
Give the debrief a full 30 minutes and take it seriously. Ask the group to leave laptops closed. Go around the room once so each person speaks before the discussion opens up. Useful questions:
- What was the first decision, and who made it?
- Where did the group get stuck, and why?
- Which contact details, escalation paths, or credentials turned out to be wrong or missing?
- Who was not in the room but should have been?
- What did the scribe record that nobody remembers agreeing to?
- If this happened next Monday, what would you do differently in the first hour?
Capture three things that worked. Then agree no more than five fixes. A list of twenty improvements will be ignored; five with owners will get done.
Mistakes That Waste the Exercise
- Inviting too many people, so the room becomes an audience rather than a team.
- Letting the facilitator also play the incident commander.
- Writing injects that have an obvious correct answer.
- Skipping the debrief because the scenario ran long.
- Recording findings but never assigning a name and a date to them.
Turn Findings Into Fixes Within a Week
Within five working days, send a one-page summary: what was tested, what worked, the five fixes, and who owns each one. Fix the cheap things immediately — an out-of-date call tree, a missing after-hours number, a role nobody had been assigned. Keep a laminated decision card in the incident kit with the names of the commander, the communications lead, and the person authorized to contact insurers and counsel.
Then book the next exercise before everyone forgets. Ninety days is a reasonable gap, and you can reuse the same scenario with new injects. Teams that practise this twice a year stop treating the plan as paperwork and start treating it as something they know how to use. For decisions with legal, financial, or regulatory consequences, bring in qualified counsel or your insurer's incident response contacts — the exercise is a safe place to find out that you need them.
Photo: mwitt1337 / Pixabay
