Tabletop Incident Runner

TTX-2026-07Ransomware continuity decision exerciseValidate containment, continuity, customer communication, and executive decision timing.

NOT STARTED00exercise minute

01Objective

INJ-01Inject

0Decisions

2Evidence

1 openActions

INJ-01

Ransomware payment clock

Decide whether to isolate affected systems before payment discussion.

Executive sponsorMinute 0Queued

DECISIONS0

OBSERVATIONS2

OPEN ACTIONS1

LATE / SKIPPED0

objective-driven setup

Exercise Charter & Injects

3 injects / 4 participants

Inject inventory

facilitator control and decision trace

Live Exercise Console

not started / minute 0

Inject timeline

0 checked

Selected inject decision

Role Decision owner Decision Rationale Skip reason

objective evidence before recommendations

Evaluator Worksheet

2 observations / 1 accepted gap

owned work through verification

Corrective Action Tracker

1 open / 0 verified

Selected action verification

Implementation evidence Verifier Verification or reopen note

one synchronized evidence packet

After-Action Report / Improvement Plan

Generate the AAR/IP after reviewing inject state, decisions, evaluator evidence, and corrective actions.

local continuity and audit trace

Saved Exercise Workspace

Ready

Exercise event history

1 event