Global

Ransomware tabletop for managers

A ready-made course you customise for your organisation, with a live session deck and a survey. You only add the 7 details that are specific to your organisation.

See the live deckSee the full outline
Try the coursePreview the survey
Length
60 min
Lessons
3 lessons
Frequency
Annually
Last reviewed
22 Oct 2026
The first hour
What would you do?

Several of your team cannot open files and a note appears on a shared drive

Try it: this is one of 8 interactive activities in the course.

What's included

Three pieces that work together

Copy once, get everything. Learners prepare on their own, you answer questions live, and the survey tells you what stuck.

Self-paced course

Short lessons with real workplace scenarios, not walls of text.

  • 3 lessons, about 60 minutes
  • Process, scenario, sorting activity, flashcards and quizzes
  • 7-question final check, 80% to pass

Live session deck

An AhaSlides presentation to run after the course, in person or online.

  • 13 slides
  • Poll, open-ended, scale, ranking slides
  • A closing slide for your contacts

A feedback survey

Find out what landed and what to change next time.

  • Feedback survey: 10 questions
  • Questions written for this session
  • Results feed your next session

Learning objectives

At the end of this course, learners can

Each objective and the lesson that covers it.

IDObjectiveSourceWhere it's covered
SO 466.1Practise the first-hour decisions in a ransomware incident, as a teamBest practiceWhole course
SO 466.2Find the gaps in who decides, who is told and who speaks for the organisation + your infoOrganisation's incident planWhole course
SO 466.3Leave with a short owner-and-date list of fixesBest practiceWhole course

Your part: what a template can't do for you

  • Your workplace details: fill in the 7 highlighted fields so the course describes your own policies, contacts and locations.
  • Records: record completion in your own LMS or record system.

Course outline

3 lessons, about 60 minutes

Minutes per lesson are an estimate, shared out by page count.

ContentInteractiveVideoYou customise
1

The first hour

3 pages

23 min
Before you beginNoteTextList
What happens firstTextProcessImageButtonYour info
ScenarioScenario
2

Decisions and communication

2 pages

15 min
Who speaks and who decidesTextSorting activityNoteYour infoYour infoYour info
CheckQuiz
3

Backups and fixes

3 pages

22 min
Backups and gapsTextFlashcardsNote
Final checkQuizMulti-select quizYour info
You have finishedKey factAccordionButtonYour infoYour info

Live deck and survey

13 slides to run live, a survey to close the loop

Pink slides are interactive. Every survey question is listed below.

ContentRansomware tabletop
ScaleHow ready do we feel?
ContentMonday, 08:40
PollWhat do you do first?
Open-endedWho needs to know in the first hour?
ContentAn hour later
PollWho speaks for us?
Open-endedWhat do we not yet know that we would need to?
ContentThe backups
PollShould we pay?
RankingWhich gap should we fix first?
Open-endedOne fix, one owner, one date
Closing · customiseFix it before it happens
Feedback survey: 10 questions
  1. Overall, how useful was this session? 5 stars
  2. What was most useful? multiple choice
  3. Before this session, how confident were you about making decisions in the first hour of a cyber incident? 1-5 scale
  4. Now, how confident are you about making decisions in the first hour of a cyber incident? 1-5 scale
  5. Did you know who the incident lead is before today? multiple choice
  6. Which part of the plan felt least clear? multiple choice
  7. How prepared do you feel to lead your team through an incident? 1-5 scale
  8. Managers here would raise a problem early rather than hide it. 1-5 scale
  9. What's one thing we should change or add? open text
  10. How likely are you to recommend this session to a colleague? NPS

Make it yours

7 fields to fill in, and you're ready

Everything else is done. These are the details only your organisation knows; each one is highlighted inside the course.

  • Incident lead contact{{INCIDENT_LEAD_CONTACT}}
  • Escalation path{{ESCALATION_PATH}}
  • Named spokesperson{{NAMED_SPOKESPERSON}}
  • Incident plan link{{INCIDENT_PLAN_LINK}}
  • Security contact{{SECURITY_CONTACT}}
  • Survey 1 URL{{SURVEY_1_URL}}
Show all 7 fields
  • Course URL{{COURSE_URL}}

FAQ

Common questions

Can I run ransomware tabletop for managers training online?

Yes. The course is self-paced and online, and the live deck lets you add a live session in the room or online.

How often is this training needed?

Annually; after a restructure; when an incident plan changes.

Who needs this training?

Managers, team leads and a senior sponsor; run by security, IT or operations.

What records should I keep?

Record completion in your own LMS or record system, so you can show who finished the course and when.

Can I edit the content?

Yes, everything. Change the wording, swap scenarios for ones from your workplace, add your logo, or remove parts that don't apply.

Related templates

Often taught together

All Security Awareness Training templates →
US federalRequired by law

Security awareness essentials

All employees and contractors · Security Awareness Training

35 min
US federal

Phishing & social engineering

All employees · Security Awareness Training

30 min
GlobalHands-on practical

PCI DSS awareness for card-handling staff

Retail cashiers · Security Awareness Training

25 min
CaliforniaRequired by law

California consumer privacy (CCPA/CPRA)

Customer service · Security Awareness Training

35 min
Last reviewed: 22 October 2026Templates are a starting point, not legal advice.

Ready to run it?

Open the live deck to see how the session runs alongside the course and the survey.

See the live deck