<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Performing Ransomware Tabletop Exercises — API Reference

## CISA Resources

- CISA Tabletop Exercise Packages (CTEP): https://cisa.gov/cisa-tabletop-exercises-packages
- CISA Ransomware Guide: https://cisa.gov/ransomware-guide
- CISA Cyber Storm Exercise Series: https://cisa.gov/cyber-storm

## NIST Exercise Framework

```
NIST SP 800-84 Exercise Types (increasing complexity):
├── Seminar (awareness) — lecture/discussion format
├── Workshop (process development) — build/review plans
├── Tabletop Exercise (decision testing) — scenario discussion ← THIS SKILL
├── Game (strategic exploration) — competitive/cooperative
├── Drill (single procedure) — practice one specific procedure
├── Functional Exercise (multi-function) — simulated operations
└── Full-Scale Exercise (all-hands) — live operational exercise
```

## Exercise Facilitation Tips

```
DO:
- Set ground rules (no blame, focus on process)
- Keep injects time-boxed (15-25 min each)
- Let participants struggle — gaps are the goal
- Document specific quotes and decisions
- Follow up with written report within 2 weeks

DON'T:
- Let one person dominate discussion
- Provide "right answers" during exercise
- Skip uncomfortable topics (payment, notification)
- Forget to include non-technical participants
- Conduct without executive participation
```

## After-Action Report Structure

```markdown
1. Exercise Overview (date, scenario, participants)
2. Executive Summary (3 key findings)
3. Detailed Findings (gap, impact, recommendation, owner)
4. Strengths Observed
5. Metrics (response times, decision clarity)
6. Remediation Plan (tracker with deadlines)
7. Next Exercise Date
```

## Regulatory TTX Requirements

| Regulation | TTX Requirement | Frequency |
|------------|----------------|-----------|
| HIPAA | Security incident procedures test | Annual |
| PCI DSS | IR plan testing (Req 12.10.2) | Annual |
| NIST CSF | Exercise program (PR.IP-10) | As defined |
| SOC 2 | Incident response testing | Annual |
| FFIEC | Cyber resilience exercises | Annual |

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `scenario` | Exercise scenario type | `double_extortion` |
| `duration` | Exercise length | `3 hours` |
| `participants` | Number of participants | `8-12` |
| `frequency` | Exercise cadence | `quarterly` |
