Tabletopping ransomware monthly reminders

Overview

Tabletops decay into checkbox fatigue without drumbeat reminders—automate nudges in PSA + security calendar.

Reminder content (email/Teams)

“This month’s scenario: encrypted backups discovered during restore—who decides last known good? Link runbook.” Attach 5-minute pre-read.

Rotation

Alternate technical vs executive emphasis months; include new hire roles quarterly.

Evidence

Sign-in sheet or calendar invite acceptance + AAR one-pager stored in compliance folder.

Metrics

% leaders attending; open actions aging—escalate to CEO if stall.

Integration

Pair with backup restore test month—muscle memory links DR and IR.

Anti-pattern

Reading slides verbatim—inject curveballs: no internet, outside counsel OOO, key admin on PTO.

Tools

Zoom breakouts for larger orgs; war game Slack bot for geographically spread teammates.

Outcome

Faster mean time to detect in the next real incident—that is the metric leadership actually feels.