The Ransomware Tabletop That Went Off Script
Cobalt Ridge Retail has a documented incident response plan and a business continuity plan last exercised three years ago. A tabletop exercise is run with the executive team. The scenario: ransomware encrypts the order-management system at 02:00 on a Saturday, three weeks before peak trading. Within 20 minutes the exercise exposes three problems. First, the plan's contact list names a head of infrastructure who left eight months ago. Second, the plan assumes backups are restorable in four hours, but the backup administrator says a full restore of the order system has never been tested and he estimates 'two to three days, maybe more'. Third, the plan assigns decision authority to the CIO, who is on a flight and unreachable, and no delegate is named. The CEO ends the exercise early, saying it is 'hypothetical' and that the team should focus on peak trading readiness.
1. Assess the significance of each of the three findings and explain which is most serious.
Read the worked answer
All three are serious, but they fail in different ways and the ranking matters for where effort goes first.
The stale contact list is a maintenance failure. It is embarrassing and will slow the first hour, but it is cheap and quick to fix: a named owner, a quarterly review, and a rule that leavers trigger an update. Low effort, low residual risk once fixed.
The untested restore estimate is the most serious finding. The plan's recovery time objective is implicitly built on a four-hour assumption that nobody has validated. If a real restore takes two to three days, then every downstream commitment - service levels, customer communication, regulatory notification timing, peak-trading continuity - is built on a false premise. Worse, the administrator's estimate is itself a guess. The organisation does not know its true recovery capability, which means it cannot honestly state its recovery objective or decide how much resilience to buy. This is a capability gap disguised as a documentation gap, and it is the one that would turn an incident into a crisis.
The absent delegate is a governance failure with immediate operational effect. Decisions during a ransomware event - isolate or contain, pay or not, notify or wait - are time-critical. An unreachable decision-maker with no named alternate means decisions stall or get made by whoever is loudest. This is arguably as dangerous as the backup gap, but it is fixable in a day by naming a delegate and a decision matrix, whereas the backup gap needs engineering and testing over weeks.
Ranking: fix the delegate immediately (cheap, high impact), commission a real restore test next (highest unknown risk), and clean the contact list as routine hygiene.
2. The CEO dismisses the exercise as hypothetical. How should the security lead respond, and what should happen next?
Read the worked answer
Arguing about whether the scenario is realistic is a losing frame. The security lead should concede the scenario is hypothetical and redirect to the findings, which are not. The departed contact, the untested restore, and the missing delegate are facts about the organisation today, independent of any scenario. That reframing moves the conversation from speculation to evidence.
Second, connect the findings to the CEO's own priority: peak trading. The CEO ended the exercise to focus on peak readiness, so show that the gaps directly threaten it. An order system that takes three days to restore, arriving three weeks before peak, is a peak-trading risk. A decision vacuum on a Saturday in December is a peak-trading risk. This is not security asking for attention; it is continuity of revenue.
Third, propose a bounded, concrete next step rather than another exercise. Commit to a tested restore of the order system by a named date, with the result reported to the executive team. Name a delegate for incident decision authority and get it minuted. Refresh the contact list. Each is small, dated, and visible.
Finally, capture the CEO's decision formally. If the executive team chooses to defer, record that as an accepted risk with an owner and a review date, so the choice is documented rather than forgotten. And schedule the next exercise with a realistic scenario the CEO will engage with - a supplier outage or a peak-season system failure often lands better than ransomware - and report the corrective actions from this one as closed before it runs.