Run a tabletop exercise for a cyber incident

Design a tabletop exercise to test our incident response. Scenario type: [e.g. "ransomware", "vendor breach exposing our customer data", "CEO email compromise and wire fraud", "cloud outage"] Participants: [roles - IT, security, legal, comms, executives, finance] Length: [e.g. 90 minutes] What we want to test: [e.g. "decision to shut down systems", "who talks to customers", "backup restore assumptions"] Our current plan or playbook: [summary, or "we don't have one yet"] Create: 1. Objectives: 3-4 things we want to learn, in measurable terms. 2. Ground rules: no-fault, decisions in real time, assume the playbook is all we have. 3. The scenario in 4-6 timed injects, each escalating: what participants learn, the time elapsed in the story, and a curveball (e.g. key person unreachable, backups also encrypted, a journalist calls). 4. For each inject: 3-5 discussion questions aimed at specific roles, and the decisions we expect them to make. 5. A facilitator guide: timing, how to keep it moving, what to do if a group gets stuck. 6. An observer scoring sheet: decision made, time taken, who owned it, gaps found. 7. A hot-wash agenda and an after-action report template with action items, owners, and deadlines. Keep the scenario realistic for our size and environment; avoid movie-style attacks. Do not include real organization or person names in the scenario.