CRISIS TABLETOP ORIGINAL · CYBER INCIDENT RESPONSE
A help-desk compromise gives an attacker privileged access. Critical systems are encrypted, sensitive patient and employee records are stolen, backups become suspect, and the organization must make containment, payment, notification, continuity, and public-communications decisions under escalating pressure.
EXERCISE PURPOSE
A credential-based intrusion develops into ransomware, data extortion, service disruption, and a multi-jurisdiction privacy incident
DECISION PRESSURE
The facilitator releases facts in stages. Participants should identify the decision owner, the authority being used, the information still needed, the immediate action, and the next escalation point.
Who has authority to isolate systems and interrupt critical services?
Can the organization trust its backups and identity environment?
What facts are sufficient to begin notification and disclosure analysis?
Who can authorize negotiation or payment and what external approvals are required?
How will legal, security, operations, customers, regulators, and the board receive consistent updates?
INSIDE THE EXERCISE
The template is already populated with public injects, facilitator-only context, discussion prompts, private role messages, and a final hotwash.
The security team identifies a successful help-desk password reset for a remote employee followed by a new multifactor-authentication enrollment. The employee says they did not request either action.
Investigators find that the compromised account approved an emergency administrator request. The attacker may have accessed virtualization management, directory services, backup consoles, and a cloud file repository.
Cloud logs show bulk downloads from HR, customer-support, and legal repositories. The team cannot yet determine whether files left the environment or were only staged internally.
Users across multiple offices report locked screens and inaccessible file shares. A ransom note demands cryptocurrency within 48 hours and claims that 420 gigabytes of data were stolen.
The backup administrator reports that online recovery points were deleted. Offline copies exist, but the most recent verified clean set is six days old and restoration testing has not covered every critical dependency.
The attacker posts a small sample of employee and patient records and sends a private link containing additional files. The demand increases if payment is not initiated within six hours.
Manual scheduling queues are failing, a regional clinic cannot retrieve current care instructions, and the payroll file due today is unavailable. Department leaders begin using personal email and consumer file-sharing tools.
PARTICIPANTS
Assign people to functions, not titles alone. If one person owns several functions, keep the roles distinct during discussion so conflicts and handoffs remain visible.
REAL-WORLD INCIDENTS
Use these cases during planning or the prebrief. They are factual anchors, not scripts. Adapt the scenario to the organization’s technology, industry, geography, contracts, regulators, and risk profile.
The 2021 attack caused Colonial Pipeline to take systems offline, triggered a ransom decision, and demonstrated the practical value of prompt FBI coordination.
Change Healthcare cyberattack↗UnitedHealth isolated affected Change Healthcare systems. The event became a nationwide continuity, provider-payment, privacy, disclosure, and restoration crisis.
LEGAL, REGULATORY & STANDARDS LENS
Applicability depends on the organization and facts. Use counsel and subject-matter owners to tailor deadlines, thresholds, privileges, preservation, reporting, and communications.
Public companies must assess materiality and disclose material incidents on Form 8-K Item 1.05 within four business days after the materiality determination, subject to the rule’s limited delay process.
CISA #StopRansomware Guide↗Government guidance for prevention, response, evidence preservation, reporting, containment, and recovery.
HHS HIPAA Breach Notification Rule↗Healthcare organizations and business associates should exercise breach analysis, individual and regulator notice, and business-associate coordination.
PRACTITIONER PERSPECTIVES
External perspectives help the design team challenge internal assumptions. They do not replace organization-specific legal or technical advice.
A practitioner discussion of privilege, information sharing, law-enforcement coordination, payment decisions, and scenario-based preparation.
CrowdStrike tabletop exercise guidance↗Security-practitioner guidance emphasizing realistic injects, tailored scenarios, decision-making, communications, and coordination.
EXPECTED OUTPUT