CISO Tabletop Exercise — User Guide

Introduction

This system is a tabletop exercise tool for experiencing ransomware incident response. Participants play the role of a CISO (Chief Information Security Officer). For each phase, you write and submit a status report, and the AI evaluates it from the perspective of each stakeholder (CEO, CFO, CIO, etc.) and provides feedback.

1. Getting Started

How to Join the Exercise

Your facilitator will provide an Exercise ID (8-character alphanumeric code).

Steps

Open the top page in your browser http://<server-address>/en
Enter the Exercise ID in the "Join Exercise" bar at the top of the page
Click the "Join →" button
You will be automatically redirected to the exercise screen

Types of Exercise IDs

Type	Capabilities
Representative ID	Enter/submit reports, access all features
Member ID	View only — see the representative's inputs and evaluation results

For group participation: Each group has one representative. The person with the Representative ID operates the system; members follow along using their Member IDs and participate in discussion.

Direct URL access: If your facilitator provides a direct URL, you can access the exercise by clicking that link.

2. Overall Exercise Flow

① Set your CISO name
        ↓
② Repeat Phases 1–4
   ┌──────────────────────────────────────────┐
   │ Read the situation briefing              │
   │ ↓                                        │
   │ Fill in the status report               │
   │ ↓                                        │
   │ Click "Register"                        │
   │ ↓                                        │
   │ Click "Consult Stakeholders" (AI eval.) │
   │ ↓                                        │
   │ Review results & discuss                │
   │ ↓ (optional)                            │
   │ Check hints & attacker's perspective    │
   │ ↓                                        │
   │ Click "Next Phase"                      │
   └──────────────────────────────────────────┘
        ↓
③ Final evaluation & PDF download

3. Screen Layout

┌────────────────────────────────────────────────────────┐
│ Navigation bar (exercise name · group name)            │
├────────────────────┬───────────────────────────────────┤
│ Sidebar            │                                   │
│  · Company Profile │  Main Area                        │
│  · Section links   │  · Situation briefing             │
│  · Stakeholders    │  · Mission                        │
│  · CISO name setup │  · Report input form              │
│                    │  · Register button                │
│                    │  · "Consult Stakeholders" button  │
│                    │  · Evaluation results             │
│                    │  · Hint button                    │
│                    │  · Attacker's perspective button  │
│                    │  · Response status check          │
│                    │                                   │
└────────────────────┴───────────────────────────────────┘

4. Step-by-Step Instructions

Step 1 — Set Your CISO Name

In the "CISO Settings" field on the left sidebar, enter your name (or the CISO's name) and click "Update". This name will be used in the AI's feedback.

Step 2 — Read the Situation Briefing and Mission

Each phase begins with a "Situation Briefing" and a "Mission." Read these alongside the facilitator materials and discuss as a group.

Step 3 — Fill In the Status Report

There are two input methods, selectable via tabs.

📋 Form Input Tab (Recommended)

Each field is displayed as an input element. Fill in each item.

Includes text fields, single-choice (radio buttons), and multiple-choice (checkboxes).
Automatically converted to Markdown format upon submission.

📝 Text Input Tab

Enter free-form text directly. Useful when pasting a report created in another tool.

Step 4 — Click "Register"

After filling in the report, click the "Register" button.

Your input is saved and the "Consult Stakeholders" button becomes active.
The reminder message "Please register before consulting stakeholders…" will turn grey once registered.
You cannot run "Consult Stakeholders" without clicking "Register" first.

If you change your stakeholder selection, do so before clicking "Register." Clicking "Register" saves both the report content and the checkbox selections.

Step 5 — Click "Consult Stakeholders" (AI Evaluation)

Click the "Consult Stakeholders" button (Phase 4: "Hold Press Conference") to have the AI evaluate your report from each stakeholder's perspective.

Evaluation may take 30 seconds to 2 minutes.
The button will be greyed out during processing. Please wait.
Once complete, each stakeholder's comments will appear in the "✅ Evaluation Results" section.

Selecting Evaluation Stakeholders

In the sidebar under "Evaluation Stakeholders," you can choose which stakeholders will evaluate your report.

Scenario-assigned (default): The stakeholders recommended for this scenario are pre-selected.
Others: Additional stakeholders can be selected.
If you change your selection, click "Register" again.

Step 6 — Review Evaluation Results

Stakeholder comments are organized in tabs.

Each stakeholder's feedback covers three aspects:

Aspect	Content
Report Evaluation	Appropriateness of content, missing perspectives
Instructions to Department	Actions the stakeholder directs to their own team
Requests to CISO	What the stakeholder expects from the CISO

Share the feedback within your group and discuss before moving to the next phase.

Step 7 — Request a Hint (Optional)

Below the evaluation results, you will find the "💡 Request a Hint from the Incident Response Expert (Optional)" button.

Provides hints and improvement suggestions from an incident response expert's perspective.
This is optional — the exercise proceeds without it.
Make sure to register your report before requesting a hint.

Step 8 — Check the Attacker's Perspective (Optional)

Click the "🎯 Check Attacker's Perspective (Optional)" button next to the hint button. A rival attacker (0xShadow) will analyze the situation from an attacker's point of view in a modal window.

Points out weaknesses in the defender's response from a "how I would attack the same target" perspective.
Analysis incorporates the phase situation, submitted report, and stakeholder comments.
This is optional — the exercise proceeds without it.

Step 9 — Check Response Status (Optional)

The "📊 Response Status Check" section shows how your response compares to the stakeholder matrix.

Button	Content
Check response status (cumulative, all phases)	Analyzes response coverage across all phases

Results are shown as ○ Addressed / △ Partial / × Not addressed.
This is also optional.

Step 10 — Click "Next Phase"

Once review and discussion are complete, click "Next Phase" to proceed.

Note: Clicking "Next Phase" finalizes your input for the current phase and advances to the next. You cannot return to a previous phase.

Step 11 — Final Evaluation (After All Phases)

After completing all phases, the "Go to Evaluation" button will appear.

On the final evaluation screen:

An overall evaluation report is generated by the incident response expert across all phases
You can download the evaluation report (PDF) and response status matrix (PDF)

5. Additional Features

🏢 View Company Profile

Click the "View Company Profile" button in the sidebar to see the company information and stakeholder list assumed in this exercise.

📄 View Submitted Reports

The "Submitted Reports" section in the sidebar shows links to reports submitted (finalized by clicking "Next Phase") in previous phases.

Clicking a link opens the report content in Markdown format in a new tab.
Useful for reviewing what you wrote in previous phases.
Form markers (e.g., (#TEXT,...)) are removed from the display.

💬 Consult the Consultant

During each phase, you can consult a security and risk consultant. Ask questions in chat format and receive answers informed by reference materials.

🔄 Update Button

To reflect your draft input in real time on member screens, click the "Update" button.

6. For Members (View Only)

When accessing via a Member URL:

You cannot enter or submit reports
Content entered and updated by the representative is reflected on your screen in real time
Evaluation results, hints, and response status check results are also displayed automatically
PDF downloads are available

If the "Member" badge is shown in the top-left corner, you are correctly in member mode.

7. Frequently Asked Questions

Q. Is there a correct answer for the status report? A. There is no single correct answer. Fill in the report based on the phase situation and discuss as a group. Use the AI feedback as a reference.

Q. The "Consult Stakeholders" button stays greyed out A. Click "Register" first. You cannot run the evaluation without registering.

Q. The AI evaluation is not returning / an error appeared A. Wait a moment and try clicking the button again. If the problem persists, contact your facilitator.

Q. I want to go back to a previous phase A. Moving back to a previous phase is not supported.

Q. I accidentally closed the page A. Return to the top page, enter the same Exercise ID, and rejoin. Your input and evaluation results will be restored.

Q. Member screen is not reflecting the representative's input A. The representative should click the "Update" button for immediate reflection. Otherwise, wait for the automatic update (approximately every 30 seconds).

8. Phase Overview

Phase	Title	Main Mission
Phase 1	Ransomware Infection on an Endpoint	Initial response decisions and status report
Phase 2	Critical System Outage	Responding to major system shutdown
Phase 3	Recovery and Post-Incident Actions	Recovery planning and recurrence prevention
Phase 4	Press Conference	Public disclosure and position paper preparation

The number of phases and content may vary depending on the exercise type.

If you have any questions, please contact your facilitator.