# Ransomware Tabletop Exercise Scenario Template for Manufacturers

> Source: https://netray.co/tools/ransomware-tabletop-exercise-scenario-template
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Fill in your plant, ERP and OT details and get a facilitator-ready ransomware tabletop scenario with injects, discussion questions and an after-action section.

## Category

industry-templates

## Industry

Discrete Manufacturing

## Audience

- IT security lead
- CISO
- Plant manager
- IT director

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company

**Key:** company

**Type:** text

**Default:** Acme Precision Ltd

#### Site in scope

**Key:** site

**Type:** text

**Default:** Plant 2, Erie PA

#### Exercise date

**Key:** date

**Type:** date

**Default:** 2026-11-12

#### Facilitator

**Key:** facilitator

**Type:** text

**Default:** IT Security Lead

#### ERP in scope

**Key:** erp

**Type:** text

**Default:** Infor SyteLine

#### Shop floor system

**Key:** mes

**Type:** text

**Default:** MES on Windows terminals at each cell

#### Initial access vector

**Key:** entry

**Type:** select

**Options:**

- Phishing email with macro
- Stolen VPN credentials
- Vulnerable edge firewall
- Compromised vendor remote session

**Default:** Stolen VPN credentials

#### Scenario impact

**Key:** impact

**Type:** textarea

**Default:** File servers and the ERP database server are encrypted. The domain controllers are unreachable. Two CNC cells lose their program share. A ransom note demands payment within 72 hours.

**Blocks:**

#### Exercise overview

**Body:** Company: {{company}}
Site: {{site}}
Date: {{date}}
Facilitator: {{facilitator}}

Objective: test decision making, communication and recovery priorities when ransomware hits {{erp}} and {{mes}}. This is a discussion exercise. No production systems are touched.

#### Scenario background

**Body:** Initial access: {{entry}}.

{{impact}}

#### Injects and discussion questions

**Table:**

**Columns:**

- Time
- Inject
- Discussion question
- Owner

**Rows:**

**0:** T+0:00

**1:** Operators report a ransom note on HMI and office screens

**2:** Who is called first and who declares an incident?

**0:** T+0:30

**1:** ERP is unreachable, shipping cannot print labels

**2:** What manual process keeps shipments moving?

**0:** T+1:30

**1:** Attacker claims data was copied and posts a sample

**2:** Who decides on legal, customer and regulator notice?

**0:** T+4:00

**1:** Backup admin finds the backup server also encrypted

**2:** Do we have an offline or immutable copy and has it ever been restored?

**0:** T+24:00

**1:** A key customer asks for delivery status

**2:** Who speaks to customers and what do we say?

**0:** T+72:00

**1:** Ransom deadline passes

**2:** What is the decision path on payment, and who must approve?

#### Recovery priority decisions

**Body:** Record the order in which the group would restore: identity services, network, ERP database, ERP application, MES, engineering file shares, quality systems, email. Note dependencies the group missed.

#### After-action findings

**Table:**

**Columns:**

- Finding
- Gap type (people, process, tool)
- Action
- Owner
- Due

**Rows:**

#### Sign-off

**Signatures:**

- Facilitator
- IT director
- Plant manager

**Notes:** Adjust injects to your own network. Do not run the exercise against live systems. Contact details for law enforcement, insurer and counsel belong in your incident response plan, not here.

## Content

**Intro:** A ransomware tabletop is a facilitated conversation that walks your plant and IT leaders through a realistic attack, one inject at a time. This template builds the scenario sheet, injects table and after-action log so you can run the session in an hour.

**Sections:**

#### How to run the exercise

**Body:** Fill in the fields, export to PDF or Word, and print one copy per participant. Invite IT, plant operations, quality, finance, HR, legal and a senior sponsor. The facilitator reads one inject at a time and lets the group answer before moving on. Capture decisions and disagreements in the findings table as they happen, not afterward.

**Bullets:**

- Keep it to 60 to 90 minutes
- Assign a separate note taker
- Do not defend the current plan, test it
- Invite a plant supervisor who will actually lose their screens

#### Why manufacturers need a different scenario

**Body:** Office ransomware scripts ignore the plant. In a factory the questions are different: can machines run from local programs, can you ship without the ERP, how do you keep traceability records for regulated customers, and who authorizes a line stop. Adjust the injects so they touch ERP, MES, CNC program storage and quality records.

#### Reading the results

**Body:** Group findings into people, process and tool gaps. Typical outputs are an unclear decision owner, no offline contact list, backups never restored at scale, and no manual order and shipping procedure. Convert each finding to an action with an owner and a date, then repeat the exercise within a year with a changed scenario.

#### Common mistakes

**Body:** Making the scenario too technical, letting IT answer for operations, skipping the legal and communication injects, and filing the report without actions. A tabletop that produces no tracked actions is a meeting, not an exercise.

**Cta:** If you want the recovery order for ERP and MES systems mapped against your real dependencies, we can help document it. The template works fully without us.

**Faq:**

#### How long should a ransomware tabletop take?

**Answer:** Plan 60 to 90 minutes for a single scenario with five or six injects. Longer sessions lose attention. Reserve the last 15 minutes for findings and owners, and send the after-action list within a week.

#### Who should attend a manufacturing tabletop?

**Answer:** IT security, infrastructure, ERP admin, plant manager, a shift supervisor, quality, finance, HR, legal or outside counsel, and an executive sponsor. The plant voices matter most because they own manual fallback procedures.

#### How often should we repeat it?

**Answer:** At least once a year and after major changes such as an ERP upgrade, a new plant, or a switch of backup platform. Vary the entry point and the systems affected each time so people do not rehearse one script.

#### Does this replace a technical recovery test?

**Answer:** No. A tabletop tests decisions and communication. You still need technical restore tests of backups and a check that critical systems come back in the order you planned. Use both.

## Search terms

ransomware tabletop exercise template, tabletop exercise scenario manufacturing, cyber tabletop exercise plant, incident response tabletop template, ransomware exercise injects, OT ransomware tabletop, tabletop exercise after action report, cyber tabletop exercise word template

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json