Seven steps, in the order you will do them

1. 01

   Set up your organisation and your dates

   Name, size, sector, which standards are in scope, and three dates: your certification or surveillance visit, your insurance renewal, and your last exercise if you have had one. Then the people who will take part, with roles and email addresses.

   Those dates are what drive everything afterwards, including when you get told an exercise is due.

2. 02

   Pick a scenario

   Six to choose from, each with a duration, a one-line premise and the topics it relates to. One is suggested from what you told us about your sector and your standards. If you have run one before, the scenario you ran last time is marked so you do not repeat it by accident.

   Suggested60 min

   Ransomware in the warehouse management system

   Depot staff arrive to find the WMS locked and a ransom note on the shared drive. Deliveries are already loading.

   Relevant to A.5.24Relevant to A.5.30Relevant to A.6.3Insurer questionnaire

   Topic references only. Running a scenario does not implement or certify these controls. Illustrative, not a complete list.

3. 03

   Send the organiser pack

   This is the step that decides whether the exercise happens. Five documents are drafted against your named colleagues, in your words, and you edit them before anything is sent. They go from your inbox, not ours.

   Pre-brief email

   Editable

   We are running a tabletop exercise on a ransomware incident. Nothing is being tested about you personally and no preparation is needed.

   Also in the pack: calendar invite text, a timed agenda, a role sheet against your names, and a note for your exec sponsor.

4. 04

   Run the session on one screen

   One screen, in a room or shared on a video call. Injects arrive on a timeline. You read them out and the team talks.

   There is very little to click during a live session, because you are also trying to take part in the conversation.

   The pressure call

   Partway through, someone rings the team and presses for answers, often a reporter. You play the caller and read their lines aloud. In Ransomware in the WMS, a reporter asks whether customer records were taken. Press Push once more and they push harder: "You haven't answered the records question. Were customer records taken, yes or no?" The team answers there and then, as on a real call, without looking anything up.

   Logging

   As the team talks, type a short line and tag it. A decision is something the team chose to do, an action is something someone has to do afterwards, and an open question is something nobody could answer. The time is added for you.

5. 05

   Review and correct the record

   Nothing exports until you have read it. Six sections, one at a time, each confirmed by you. Findings are drafted from your logged entries as gaps and open questions, and every one shows which entries it came from, so reviewing is checking rather than writing.

   Why this step is mandatory

   A record nobody checked is worth very little to the person reading it, and your name is on this one. Drillroom will not draft a statement that part of your response worked. If something did work, you write that sentence yourself and it appears as your observation.
6. 06

   Export the evidence pack

   A dated PDF with a reference number, topic references in the margin, and a plain first-page statement of what the document is and what it is not. It carries the timestamp it was generated and the name of the person who reviewed it.

   Yours to keep, whether or not you renew.

   Structured around the incident-response topics standards and questionnaires cover

   Ransomware affecting the warehouse management system, run as a discussion-based tabletop exercise over 60 minutes. No live systems were touched and no production data was used.

   This document is a record of an exercise that took place on the date shown. It does not certify compliance with any standard and it does not confirm that any control is adequate or effective.

7. 07

   Next year, it remembers

   Open actions from this year are carried into next year's exercise and surfaced in the session, so somebody is asked about them rather than the operator having to remember. Next year's pack reports what closed, what is still open and what moved.

   A second pack that shows progress against the first is a different kind of document from two unconnected write-ups. Drillroom also tells you when your pack is going stale, measured against the dates you gave it.

   Out-of-hours contacts for the hosting providerClosed

   Who authorises a payment decision during an incidentOpen

Control references indicate the ISO/IEC 27001:2022 Annex A topics a scenario relates to. Drillroom is not a certification body or auditor. Running a scenario does not certify compliance, does not implement a control, and does not confirm that any control is adequate or effective. Your auditor decides what evidence they accept.