- 01An executive tabletop is a different exercise from a SOC tabletop. Technical details are abstracted; decisions are about communications, customer impact, regulatory notification, business continuity, and ransom-payment policy. The exercise that produces value is structured for those decisions.
- 02Decisions executives will face: notify customers now or wait until the picture clears? Take systems offline preemptively or risk continued operation? Engage the regulator early or comply at the deadline? Engage law enforcement and accept the public-attention consequences? Pay the ransom or refuse? Communicate to the workforce — what, when, how?
- 03Pre-decisions: many of these can be partially made in advance — documented stance on ransom payment, documented threshold for proactive customer notification, documented relationship with law enforcement. The exercise tests the pre-decisions and reveals where they need refinement.
- 04Cadence: annual at minimum, plus a 'what would we have done' workshop following any significant industry incident. Cadence matters more than depth — pressure-tested decisions matter more than perfect playbooks.
An executive tabletop is a different exercise from a SOC tabletop. The technical details are abstracted; the decisions are about communications, customer impact, regulatory notification, business continuity, and ransom-payment policy. The exercise that produces value is structured for those decisions.
The decisions executives will face
- 01Notify customers now, or wait until the picture clears?
- 02Take systems offline preemptively, or risk continued operation?
- 03Engage the regulator early, or comply at the deadline?
- 04Engage law enforcement, and accept the consequences of public attention?
- 05Pay the ransom, with all of its implications, or refuse?
- 06Communicate to the workforce — what, when, and how?
The role of pre-decisions
Many of these decisions can be partially made in advance — a documented stance on ransom payment, a documented threshold for proactive customer notification, a documented relationship with law enforcement. The exercise tests the pre-decisions and reveals where they need refinement.
Cadence
Annual at minimum. Following any significant industry incident with a 'what would we have done' workshop. Cadence matters more than depth — pressure-tested decisions matter more than perfect playbooks.