Manufacturing & Industrial
Outlining a tabletop cyberattack drill scenario
A tabletop drill tests decisions rather than technology. This guide shows how to outline one for a drilling operation, with a worked example and three choices that keep the session focused and useful.
01
Step one: pick a believable trigger
Choose a single event that could plausibly disrupt operations, and write it as a short briefing card. Example: at 02:10 on night shift, the rig's remote monitoring screens freeze and a message demands payment. Name the systems involved, the people on duty and what they can see. Avoid dramatic detail that invites argument about realism. Decide in advance what the facilitator knows that participants do not, such as whether safety instrumentation is affected. A narrow, concrete trigger produces concrete answers about who calls whom, what gets isolated and when the driller pauses work.
02
Step two: stage the injects and decisions
Plan three or four timed updates that force choices. In the example, inject one reveals that the vendor remote-access link was recently used. Inject two says the onshore operations center cannot confirm sensor readings. Inject three adds a media inquiry or a regulator call. Each update should end with a question: continue drilling, switch to manual procedures, or stand down? Include both operations and security staff so each sees the other's constraints. Record every decision and the reasoning given, because the reasoning, not the answer, usually exposes missing authority, unclear contacts or outdated procedures.
03
Step three: debrief into owned actions
End with a structured review while memory is fresh. List what worked, where people hesitated and which assumptions proved wrong. Convert each gap into an action with one owner and a date, such as updating the call tree, defining who may disconnect vendor access, or printing manual fallback checklists. In the example, the group might discover nobody was authorized to isolate the remote link at night. Keep the written summary to one page, schedule a repeat with a different trigger, and compare results so improvement is visible rather than assumed.