Run a ransomware tabletop exercise
You need to test your incident response plan (800-171 requirement 3.6.3) without a consultant or a full day.
- You get
- A facilitated 60-minute exercise in five injects, then an after-action report you can keep as evidence.
- Works in
- ChatGPT
- Claude
- Copilot
- Gemini
Fill in the blanks
A few words each is enough. Leave a blank empty and the assistant will ask you or assume.
Describe, don't paste: no CUI, personal data, hostnames, IP addresses or credentials. What you type stays on this page until you copy it or open it in an assistant.
Your prompt0 of 4 filled
Run a 60-minute ransomware tabletop exercise for our team. We're a [Company size, e.g. 200-person] [Industry, e.g. defense contractor]. - Key systems: [What the business runs on, e.g. ERP, file shares, Microsoft 365] - Participants: [Roles, e.g. IT director, security lead, CFO, comms, legal] Act as the facilitator. Present the scenario in five injects, one at a time, starting with a help-desk call on a Friday evening about files that won't open. After each inject, ask each role what they do and wait for our answers before moving on. Include a point where the backups turn out to be affected, a point where email and Teams are unavailable, and a decision on DFARS 252.204-7012 72-hour reporting. At the end, write an after-action report we can keep as evidence for requirement 3.6.3: date, participants, scenario, what went well, gaps, and corrective actions with owners and due dates. Some details above are still in square brackets. Ask me for them before you answer, rather than guessing.
Before you paste
Paste each person's answer back in as you go; the report is only as good as what you give it.
Then check the answer
Cleanroom recovery
Where you'd actually recover to
More incident response prompts
All 28 promptsWant a person to check the answer?
AI gets you a first draft. A KELYN engineer can tell you whether it would hold up in an assessment or a real recovery.