Industry TemplatesFree templatePDF, Excel, Word exportDiscrete Manufacturing

Ransomware Tabletop Exercise Scenario Template for Manufacturers

A ransomware tabletop is a facilitated conversation that walks your plant and IT leaders through a realistic attack, one inject at a time. This template builds the scenario sheet, injects table and after-action log so you can run the session in an hour.

Fill in

Company

Site in scope

Exercise date

Facilitator

ERP in scope

Shop floor system

Initial access vector

Scenario impact

Live preview

Download:

Ransomware Tabletop Exercise Scenario Template

Exercise overview

Company: Acme Precision Ltd Site: Plant 2, Erie PA Date: 2026-11-12 Facilitator: IT Security Lead

Objective: test decision making, communication and recovery priorities when ransomware hits Infor SyteLine and MES on Windows terminals at each cell. This is a discussion exercise. No production systems are touched.

Scenario background

Initial access: Stolen VPN credentials.

File servers and the ERP database server are encrypted. The domain controllers are unreachable. Two CNC cells lose their program share. A ransom note demands payment within 72 hours.

Injects and discussion questions

Time	Inject	Discussion question
T+0:00	Operators report a ransom note on HMI and office screens	Who is called first and who declares an incident?
T+0:30	ERP is unreachable, shipping cannot print labels	What manual process keeps shipments moving?
T+1:30	Attacker claims data was copied and posts a sample	Who decides on legal, customer and regulator notice?
T+4:00	Backup admin finds the backup server also encrypted	Do we have an offline or immutable copy and has it ever been restored?
T+24:00	A key customer asks for delivery status	Who speaks to customers and what do we say?
T+72:00	Ransom deadline passes	What is the decision path on payment, and who must approve?

Recovery priority decisions

Record the order in which the group would restore: identity services, network, ERP database, ERP application, MES, engineering file shares, quality systems, email. Note dependencies the group missed.

After-action findings

Finding	Gap type (people, process, tool)	Action	Owner	Due

Sign-off

Facilitator / Date

IT director / Date

Plant manager / Date

Adjust injects to your own network. Do not run the exercise against live systems. Contact details for law enforcement, insurer and counsel belong in your incident response plan, not here.

Map your recovery order to real ERP dependencies

Optional expert review of which systems must come back first and what they depend on.

Optional. The tool and every export work without this. No spam.

How to run the exercise

Fill in the fields, export to PDF or Word, and print one copy per participant. Invite IT, plant operations, quality, finance, HR, legal and a senior sponsor. The facilitator reads one inject at a time and lets the group answer before moving on. Capture decisions and disagreements in the findings table as they happen, not afterward.

Keep it to 60 to 90 minutes
Assign a separate note taker
Do not defend the current plan, test it
Invite a plant supervisor who will actually lose their screens

Why manufacturers need a different scenario

Office ransomware scripts ignore the plant. In a factory the questions are different: can machines run from local programs, can you ship without the ERP, how do you keep traceability records for regulated customers, and who authorizes a line stop. Adjust the injects so they touch ERP, MES, CNC program storage and quality records.

Reading the results

Group findings into people, process and tool gaps. Typical outputs are an unclear decision owner, no offline contact list, backups never restored at scale, and no manual order and shipping procedure. Convert each finding to an action with an owner and a date, then repeat the exercise within a year with a changed scenario.

Common mistakes

Making the scenario too technical, letting IT answer for operations, skipping the legal and communication injects, and filing the report without actions. A tabletop that produces no tracked actions is a meeting, not an exercise.

Frequently Asked Questions

How long should a ransomware tabletop take?

Plan 60 to 90 minutes for a single scenario with five or six injects. Longer sessions lose attention. Reserve the last 15 minutes for findings and owners, and send the after-action list within a week.

Who should attend a manufacturing tabletop?

IT security, infrastructure, ERP admin, plant manager, a shift supervisor, quality, finance, HR, legal or outside counsel, and an executive sponsor. The plant voices matter most because they own manual fallback procedures.

How often should we repeat it?

At least once a year and after major changes such as an ERP upgrade, a new plant, or a switch of backup platform. Vary the entry point and the systems affected each time so people do not rehearse one script.

Does this replace a technical recovery test?

No. A tabletop tests decisions and communication. You still need technical restore tests of backups and a check that critical systems come back in the order you planned. Use both.

If you want the recovery order for ERP and MES systems mapped against your real dependencies, we can help document it. The template works fully without us.

Talk to an Expert Explore More Free Tools

Related Tools

Compliance & Contracts

More Industry Templates tools

See all

Back to All Tools