Ransomware Tabletop: Questions Leaders Must Resolve Before the Crisis

A ransomware tabletop that ends with “we would escalate to leadership” has tested nothing. Leadership is the part of the response that has not been rehearsed, and it is where the expensive decisions sit: whether to shut down a revenue system, who talks to the attacker, what the regulator is told and when, and which business process comes back first.

This note lists the questions executives and board members should be able to answer before an incident. Use them to design the exercise or as a pre-read. The goal is not to produce correct answers on the day. It is to find out which questions nobody currently owns.

Authority

• Who may declare a cyber crisis, and what is the threshold?

• Who can order a shutdown of a customer-facing or revenue-generating system, and how fast can that person be reached at any hour?

• Who leads the response, who leads communications, and who is the single point for decisions? If the CEO is unreachable, who deputizes?

• What is the board told, by whom, and at what point?

Payment and the law

A statement such as “we do not pay” is a position, not a decision process. Before any payment is discussed, leaders need to know who must be consulted and in what order. At minimum that means legal counsel, law enforcement, the insurer and whoever runs sanctions compliance.

The sanctions risk is concrete. OFAC’s advisory on ransomware payments states that civil penalties can be imposed on a strict-liability basis, so a person subject to US jurisdiction can be liable even without knowing a recipient was sanctioned. The advisory treats prompt reporting to law enforcement, full cooperation and sound cybersecurity practices, such as offline backups and tested response plans, as significant mitigating factors. CISA’s response checklist does not advise on whether to pay. It points to consulting federal law enforcement about possible decryptors. Your own jurisdiction may impose different rules, and counsel should confirm them.

• Who decides whether a payment conversation starts at all?

• Who is authorized to communicate with the attacker, and who vets that person’s statements?

• Assume a payment buys a promise from a criminal that you cannot verify. What does the plan look like if the promise fails?

Disclosure and regulators

• Which regulators, customers and contractual counterparties must be notified, and what are their clocks? Build the list before the incident.

• Who makes the materiality determination if you are a listed company, on what inputs, and how is it recorded? Under the SEC’s rules a registrant must make that determination without unreasonable delay after discovery, and Form 8-K Item 1.05 is due four business days after the determination.

• If law enforcement asks for a delay, who handles that conversation and how does it interact with your obligations?

Operations

• Which business processes can run manually, and for how long before the cost exceeds the cost of staying down?

• Who decides restoration order when two business units each say theirs comes first?

• Are backups offline or immutable, and has a full restore ever been timed? CISA’s checklist directs recovery from offline, encrypted backups, and cautions against reinfecting clean systems.

Data extortion

Many ransomware events involve stolen data as well as encrypted systems. Plan for both.

• If the attacker threatens to publish stolen data, what is the agreed position, and who is told first?

• Who determines which data was taken, and how will you know?

• What do you tell customers and employees whose data may be involved, before the forensic picture is complete?

Communications

• How do leaders communicate if corporate email and chat are unavailable? Who has the out-of-band channel details?

• Who approves the holding statement, and is it drafted already?

• Who handles employees, customers, media and partners, and is each audience assigned a single voice?

Running the room

Use a short sequence of injects. The scenario below is hypothetical, built only to force decisions.

CISA’s tabletop exercise packages include a ransomware scenario, with template objectives, discussion questions and an After Action Report, and can serve as scaffolding. Replace generic details with your own systems, your own regulators and your own people.

How to tell the exercise worked

• Every decision has a recorded owner and a recorded input. “Leadership” is not an owner.

• The list of unanswered questions is the main output. Each item becomes an action with a named person and a date, and the exercise is repeated to confirm it closed.

• The people who attended could explain afterward what they decided and why.

The pattern to watch for is agreement that sounds like progress. If everyone nods at “we would involve legal and consider our options,” the question was not answered. Ask who, how and by when until it is.

Next step

**** Pick the three questions above that no one in your leadership team can currently answer, and put them on the agenda of the next executive meeting. Cybrilliant advises executive teams on crisis management and can design and facilitate a ransomware exercise around your own decision structure.

Sources

1. CISA, Tabletop Exercise Packages. https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages

2. CISA, #StopRansomware Guide. https://www.cisa.gov/stopransomware/ransomware-guide

3. U.S. Department of the Treasury, OFAC, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments. https://ofac.treasury.gov/media/912981/download?inline

4. U.S. Securities and Exchange Commission, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure: Fact Sheet. https://www.sec.gov/files/33-11216-fact-sheet.pdf