# Ransomware tabletop for a small IT team

Kaitiaki Security | 30-minute starter exercise

Use a fictional case. Assign a facilitator, an incident lead and a note-taker.

1. Minutes 0-10: Falcon flags suspicious encryption on a device used for a critical process. Decide who receives the escalation, starts the log and confirms the affected devices.
2. Minutes 10-20: A second device is affected and the usual approver is unavailable. Decide who can authorise isolation, what business interruption is acceptable and who updates leadership.
3. Minutes 20-30: The team wants to restore service. Agree who signs off, what evidence is needed and which internal or external notifications to assess.

Debrief: Record each gap, the person responsible for fixing it and a due date. Update the response plan and schedule a retest.