Define a realistic scenario
Choose a critical service and map identity, endpoints, backups, networks, vendors and staff dependencies. Establish the exercise boundaries and authorized participants. Include the loss of normal administrative access so the exercise does not assume unavailable recovery paths.
Test response decisions
Walk through detection, triage, containment, communications and escalation using the institution's approved playbooks. Verify contact methods and authority to isolate affected services. Record where information is missing or responsibilities conflict, without conducting disruptive testing outside the agreed scope.
Verify recovery evidence
Review backup integrity, restoration access, service dependencies and reconciliation requirements. Where authorized, test restoration in an isolated environment and compare observed behavior with recovery objectives. Cicrim can prepare the exercise, document findings and help organize a remediation backlog for accountable owners.
Plan the next working session
Bring the current process, the accountable business and control owners, and the questions your team needs to resolve. Cicrim can help define a focused scope, expected working outputs and acceptance criteria before delivery begins.
Discuss ransomware readiness validation