The Algerian DFIR Tabletop Exercise Guide: Running a Two-Hour Ransomware Drill

Why Tabletop Exercises Became Non-Negotiable

A digital forensics and incident response (DFIR) tabletop exercise is a facilitated, discussion-based simulation of a cyber incident. No computers are attacked. No systems are touched. A facilitator walks the leadership team through a realistic scenario, forcing them to decide — in real time, under time pressure — what they would actually do.

Two developments make this mandatory hygiene for Algerian organizations in 2026.

First, regulatory posture. CISA now publishes Tabletop Exercise Packages (CTEPs) that any organization can use for free, and the UK NCSC's Exercise in a Box provides sector-tailored templates. The Counter Ransomware Initiative, which Algeria tracks through its participation in international cybersecurity forums, published an after-action report making tabletops a baseline expectation across member jurisdictions.

Second, insurance and audit. Cyber-insurance underwriters now ask whether the insured has run a tabletop in the last 12 months. Regulators mandating cybersecurity units under Algeria's Presidential Decree 26-07 will, realistically, soon ask the same question.

The good news: a well-run tabletop costs a room, a facilitator, and two hours. There is no tooling gap.

The Two-Hour Scenario: "Qilin Has Posted You on Their Leak Site"

This scenario is designed for an Algerian bank, telecom, ministry, or mid-sized enterprise. It is realistic because Qilin and DragonForce currently dominate global ransomware activity, per Ransom-DB weekly trend reports. Swap in a different operator if your threat intel team prefers.

Participants (8–12 people): CEO, COO, CISO, IT infrastructure lead, legal counsel, head of communications, head of HR, head of finance, customer support lead, and an optional external observer (MSSP partner, auditor, board member).

Facilitator: a single person outside the direct reporting chain of the CEO — ideally the CISO or an external consultant. They drive the clock and introduce injects.

Time budget: 15 minutes setup, 90 minutes scenario, 15 minutes debrief. Total: two hours.

Scenario opening (T+0)

It is 08:15 on a Monday. The SOC on-call receives an email from a journalist asking for comment on "the security incident at your organization." Attached is a screenshot of your company logo on the Qilin leak-site countdown, claiming 400 GB of data will be published in 72 hours.

Facilitator: "What do you do in the first 30 minutes?"

Expected decisions: activate incident response, call the CEO, contact legal, decide whether to alert the SOC MSSP, decide whether to take external-facing systems offline.

Inject 1 — T+20 minutes

The IT infrastructure lead confirms: three domain controllers are unreachable. Backups on the primary Veeam repository are encrypted. The offsite backup, cloud-based, appears intact but has not been tested in four months.

Facilitator: "Can you restore? How long? Do you trust the offsite? Who authorizes restoring over the production environment?"

Inject 2 — T+40 minutes

A customer-support flood starts: customers report their login credentials are being used to access accounts. The SOC confirms credentials were exfiltrated before the encryption phase.

Facilitator: "Do you force a password reset for all customers? When? Who communicates it? Do you involve ARPCE or the data-protection authority under the Algerian personal data protection framework?"

Inject 3 — T+60 minutes

The Qilin operator contacts the CEO's public email with a ransom demand: 3 million USD, 48 hours, with a proof-of-life sample of 2 GB of sensitive customer data already published on a Tor site.

Facilitator: "Do you engage? Who makes the pay/no-pay decision? Is there a policy? What is legal counsel's position? Are there international sanctions implications?"

Inject 4 — T+80 minutes

A journalist from El Watan and a TSA reporter publish stories based on the leaked sample. Social media lights up. A screenshot of an internal email is circulating on Twitter.

Facilitator: "Who speaks? What do you say? Do you issue a formal statement? Do you brief the minister? Do you activate crisis communications?"

Debrief — T+90 to T+105 minutes

Every participant answers three questions in turn: "What worked?" "What did not work?" "What is the single most important thing we need to fix before the next tabletop?" The facilitator captures these verbatim.

What a Good After-Action Report Looks Like

The facilitator produces a one-page after-action report within 48 hours. It has exactly three sections.

• Confirmed capabilities. Things the organization would clearly do correctly — for example, "IT has a tested process to revoke all Active Directory credentials in under 30 minutes."
• Identified gaps. Things the organization could not answer or would clearly get wrong — for example, "No documented ransom-payment policy; pay/no-pay decision unclear between CEO and board."
• Named owners for fixes. Each gap has one owner, one deliverable, one date. No anonymous "IT will look into it" entries.

The AlertMedia ransomware tabletop guide and the Cyber Management Alliance guide to 2026 tabletops both converge on this format.

Adapting the Exercise for Algerian Realities

Three local adjustments matter.

• Regulatory touchpoints. Substitute Algerian institutions into the inject script: the Banque d'Algérie for a financial incident, ARPCE for a telecom or data-sharing issue, the national CERT (DZ-CERT) for technical escalation, the ANPDP for personal data implications under the Algerian data-protection framework. Participants need to know whose phone number to dial, not just "call the regulator."
• Language. Run the exercise in the language of the leadership team — often a mix of Algerian dialect, French, and occasional MSA. A bilingual facilitator is more important than a written-English script.
• Three-sector consideration. Algerian leadership teams often include the ministry liaison or public shareholder representative. Include them. Crisis decisions around payment, disclosure, and media response are almost never purely private decisions in Algeria's institutional context.

What to Do After the First Tabletop

Organizations that run their first tabletop almost always conclude the same three things: backups are not as recoverable as assumed, the pay/no-pay decision has no written policy, and communications does not have a draft holding statement on file. Those three fixes, done properly, measurably improve incident outcomes.

Run a second tabletop six months later with a different scenario — a third-party SaaS breach, a destructive wiper, or a supply-chain compromise like a Shai-Hulud-type npm worm. The second exercise reveals whether the fixes from the first one stuck.

Where This Leaves Algerian CISOs

A DFIR tabletop exercise is the cheapest, highest-leverage readiness investment an Algerian organization can make in 2026. The templates are free. The facilitator can be internal. The participants are already on the org chart. Running one a year is the bar that regulators, insurers, and boards increasingly expect, and the first run will surface more useful fixes than any six-figure consulting engagement. The harder part is getting the CEO's calendar; everything after that is execution.

Sources & Further Reading

• CISA Tabletop Exercise Packages
• UK NCSC Exercise in a Box — Tabletop Exercises
• Counter Ransomware Initiative Tabletop After-Action Report — Institute for Security and Technology
• How to Run a Ransomware Tabletop Exercise — AlertMedia
• The Ultimate Guide to a Cyber Tabletop Exercise in 2026 — Cyber Management Alliance
• Weekly Ransomware Trends April 2026: Qilin & DragonForce — Ransom-DB
• Algeria Orders Cybersecurity Units in Public Sector — Ecofin Agency
• Shai-Hulud 2.0: Guidance for Detecting, Investigating, and Defending — Microsoft Security Blog