CISO Tabletop Exercise — User Guide
Introduction
This system is a tabletop exercise tool for experiencing ransomware incident response.
Participants play the role of a CISO (Chief Information Security Officer). For each phase, you write and submit a status report, and the AI evaluates it from the perspective of each stakeholder (CEO, CFO, CIO, etc.) and provides feedback.
1. Getting Started
How to Join the Exercise
Your facilitator will provide an Exercise ID (8-character alphanumeric code).
Steps
- Open the top page in your browser
http://<server-address>/en
- Enter the Exercise ID in the "Join Exercise" bar at the top of the page
- Click the "Join →" button
- You will be automatically redirected to the exercise screen
Types of Exercise IDs
| Type |
Capabilities |
| Representative ID |
Enter/submit reports, access all features |
| Member ID |
View only — see the representative's inputs and evaluation results |
For group participation:
Each group has one representative. The person with the Representative ID operates the system; members follow along using their Member IDs and participate in discussion.
Direct URL access:
If your facilitator provides a direct URL, you can access the exercise by clicking that link.
2. Overall Exercise Flow
① Set your CISO name
↓
② Repeat Phases 1–4
┌──────────────────────────────────────────┐
│ Read the situation briefing │
│ ↓ │
│ Fill in the status report │
│ ↓ │
│ Click "Register" │
│ ↓ │
│ Click "Consult Stakeholders" (AI eval.) │
│ ↓ │
│ Review results & discuss │
│ ↓ (optional) │
│ Check hints & attacker's perspective │
│ ↓ │
│ Click "Next Phase" │
└──────────────────────────────────────────┘
↓
③ Final evaluation & PDF download
3. Screen Layout
┌────────────────────────────────────────────────────────┐
│ Navigation bar (exercise name · group name) │
├────────────────────┬───────────────────────────────────┤
│ Sidebar │ │
│ · Company Profile │ Main Area │
│ · Section links │ · Situation briefing │
│ · Stakeholders │ · Mission │
│ · CISO name setup │ · Report input form │
│ │ · Register button │
│ │ · "Consult Stakeholders" button │
│ │ · Evaluation results │
│ │ · Hint button │
│ │ · Attacker's perspective button │
│ │ · Response status check │
│ │ │
└────────────────────┴───────────────────────────────────┘
4. Step-by-Step Instructions
Step 1 — Set Your CISO Name
In the "CISO Settings" field on the left sidebar, enter your name (or the CISO's name) and click "Update".
This name will be used in the AI's feedback.
Step 2 — Read the Situation Briefing and Mission
Each phase begins with a "Situation Briefing" and a "Mission."
Read these alongside the facilitator materials and discuss as a group.
Step 3 — Fill In the Status Report
There are two input methods, selectable via tabs.
📋 Form Input Tab (Recommended)
Each field is displayed as an input element. Fill in each item.
- Includes text fields, single-choice (radio buttons), and multiple-choice (checkboxes).
- Automatically converted to Markdown format upon submission.
📝 Text Input Tab
Enter free-form text directly.
Useful when pasting a report created in another tool.
Step 4 — Click "Register"
After filling in the report, click the "Register" button.
- Your input is saved and the "Consult Stakeholders" button becomes active.
- The reminder message "Please register before consulting stakeholders…" will turn grey once registered.
- You cannot run "Consult Stakeholders" without clicking "Register" first.
If you change your stakeholder selection, do so before clicking "Register."
Clicking "Register" saves both the report content and the checkbox selections.
Step 5 — Click "Consult Stakeholders" (AI Evaluation)
Click the "Consult Stakeholders" button (Phase 4: "Hold Press Conference") to have the AI evaluate your report from each stakeholder's perspective.
- Evaluation may take 30 seconds to 2 minutes.
- The button will be greyed out during processing. Please wait.
- Once complete, each stakeholder's comments will appear in the "✅ Evaluation Results" section.
Selecting Evaluation Stakeholders
In the sidebar under "Evaluation Stakeholders," you can choose which stakeholders will evaluate your report.
- Scenario-assigned (default): The stakeholders recommended for this scenario are pre-selected.
- Others: Additional stakeholders can be selected.
- If you change your selection, click "Register" again.
Step 6 — Review Evaluation Results
Stakeholder comments are organized in tabs.
Each stakeholder's feedback covers three aspects:
| Aspect |
Content |
| Report Evaluation |
Appropriateness of content, missing perspectives |
| Instructions to Department |
Actions the stakeholder directs to their own team |
| Requests to CISO |
What the stakeholder expects from the CISO |
Share the feedback within your group and discuss before moving to the next phase.
Step 7 — Request a Hint (Optional)
Below the evaluation results, you will find the "💡 Request a Hint from the Incident Response Expert (Optional)" button.
- Provides hints and improvement suggestions from an incident response expert's perspective.
- This is optional — the exercise proceeds without it.
- Make sure to register your report before requesting a hint.
Step 8 — Check the Attacker's Perspective (Optional)
Click the "🎯 Check Attacker's Perspective (Optional)" button next to the hint button. A rival attacker (0xShadow) will analyze the situation from an attacker's point of view in a modal window.
- Points out weaknesses in the defender's response from a "how I would attack the same target" perspective.
- Analysis incorporates the phase situation, submitted report, and stakeholder comments.
- This is optional — the exercise proceeds without it.
Step 9 — Check Response Status (Optional)
The "📊 Response Status Check" section shows how your response compares to the stakeholder matrix.
| Button |
Content |
| Check response status (cumulative, all phases) |
Analyzes response coverage across all phases |
- Results are shown as ○ Addressed / △ Partial / × Not addressed.
- This is also optional.
Step 10 — Click "Next Phase"
Once review and discussion are complete, click "Next Phase" to proceed.
Note: Clicking "Next Phase" finalizes your input for the current phase and advances to the next.
You cannot return to a previous phase.
Step 11 — Final Evaluation (After All Phases)
After completing all phases, the "Go to Evaluation" button will appear.
On the final evaluation screen:
- An overall evaluation report is generated by the incident response expert across all phases
- You can download the evaluation report (PDF) and response status matrix (PDF)
5. Additional Features
🏢 View Company Profile
Click the "View Company Profile" button in the sidebar to see the company information and stakeholder list assumed in this exercise.
📄 View Submitted Reports
The "Submitted Reports" section in the sidebar shows links to reports submitted (finalized by clicking "Next Phase") in previous phases.
- Clicking a link opens the report content in Markdown format in a new tab.
- Useful for reviewing what you wrote in previous phases.
- Form markers (e.g.,
(#TEXT,...)) are removed from the display.
💬 Consult the Consultant
During each phase, you can consult a security and risk consultant.
Ask questions in chat format and receive answers informed by reference materials.
🔄 Update Button
To reflect your draft input in real time on member screens, click the "Update" button.
6. For Members (View Only)
When accessing via a Member URL:
- You cannot enter or submit reports
- Content entered and updated by the representative is reflected on your screen in real time
- Evaluation results, hints, and response status check results are also displayed automatically
- PDF downloads are available
If the "Member" badge is shown in the top-left corner, you are correctly in member mode.
7. Frequently Asked Questions
Q. Is there a correct answer for the status report?
A. There is no single correct answer. Fill in the report based on the phase situation and discuss as a group. Use the AI feedback as a reference.
Q. The "Consult Stakeholders" button stays greyed out
A. Click "Register" first. You cannot run the evaluation without registering.
Q. The AI evaluation is not returning / an error appeared
A. Wait a moment and try clicking the button again. If the problem persists, contact your facilitator.
Q. I want to go back to a previous phase
A. Moving back to a previous phase is not supported.
Q. I accidentally closed the page
A. Return to the top page, enter the same Exercise ID, and rejoin. Your input and evaluation results will be restored.
Q. Member screen is not reflecting the representative's input
A. The representative should click the "Update" button for immediate reflection. Otherwise, wait for the automatic update (approximately every 30 seconds).
8. Phase Overview
| Phase |
Title |
Main Mission |
| Phase 1 |
Ransomware Infection on an Endpoint |
Initial response decisions and status report |
| Phase 2 |
Critical System Outage |
Responding to major system shutdown |
| Phase 3 |
Recovery and Post-Incident Actions |
Recovery planning and recurrence prevention |
| Phase 4 |
Press Conference |
Public disclosure and position paper preparation |
The number of phases and content may vary depending on the exercise type.
If you have any questions, please contact your facilitator.