A planning guide for executive and technical ransomware exercises that test decisions, communications, recovery and business continuity, not just technical response.
The most useful ransomware exercises test business decisions and recovery, not just the security team's technical response.
Decide what the exercise must test, such as decision rights, recovery priorities or communications, and build a scenario based on how ransomware groups currently operate, including data theft before encryption.
Questions to ask
Ransomware is a business crisis. The people who decide on shutdowns, notifications, public statements and payment questions must be in the room.
Questions to ask
Real incidents arrive with incomplete information. Injects should add pressure: a media enquiry, a ransom note with a deadline, a supplier asking questions, or evidence that backups are affected.
Questions to ask
Many recovery plans assume backups are intact and restoration is fast. The exercise should test whether backups are isolated, how long restoration takes and which services come back first.
Questions to ask
Assign an observer to record each decision, who made it, what information it was based on and what could not be answered.
Questions to ask
An exercise is only valuable if something changes. Convert observations into owned actions with dates, and schedule a follow-up exercise to test the fixes.
Questions to ask
Last reviewed September 24, 2026. This guide is general information, not legal advice. Print or save this page to use it as a workshop handout or pre-engagement checklist.
C3SA can help validate the current state, identify material gaps, define the target state and support implementation, testing and readiness.
