Colonial Pipeline Tabletop Exercise: The Shutdown Decision Your Board Should Rehearse

Ransomware hits your business systems. Your operations are untouched. Do you shut down operations anyway?

In May 2021, Colonial Pipeline faced exactly that question, and the answer took fuel off the US East Coast for days. It's one of the best cases there is for a leadership tabletop exercise, because the hardest calls were business calls, not technical ones.

This post is part of our Boardroom Drill series: one real incident, three leadership dilemmas, and a way to rehearse them before it's your turn.

What happened

On 7 May 2021, the DarkSide ransomware group encrypted parts of Colonial Pipeline's IT network. The company runs roughly 5,500 miles of pipeline and carries about 45% of the fuel used on the US East Coast.

The attackers got in through a VPN account that no longer had an active user and wasn't protected by multi-factor authentication. They never reached the systems that control the pipeline itself. Even so, Colonial halted the entire pipeline as a precaution. Flow restarted on 12 May, after panic buying and fuel shortages across several states.

Colonial paid a ransom of 75 bitcoin, about $4.4 million at the time. A month later, the US Department of Justice recovered about $2.3 million of it.

Dilemma 1: Stop operations you can still run?

The pipeline controls were not hit. So why stop?

• You can't be sure the attacker isn't one hop away from operational systems.
• Your billing and scheduling systems are down, so you may not be able to track or charge for what you deliver.
• Stopping is reversible. A safety incident in the physical world is not.

On the other side: every hour of shutdown has real costs for customers, the public, and your relationship with the government.

Discussion question: Who in your organisation has the authority to stop operations that are still working, and on what evidence?

Dilemma 2: Pay the ransom?

Colonial's CEO later told the US Senate he authorised the payment because the company didn't know how long recovery would take without the attackers' decryption tool. Arguments your board will hear:

• For: speed. Every day of shutdown costs more than the ransom.
• Against: no guarantee the tool works (Colonial's reportedly ran slowly), it funds the next attack, and some groups are sanctioned, which can make paying illegal.
• Practical: who actually moves the money, who talks to the insurer, and who checks sanctions lists at 2 a.m.?

Discussion question: Have you decided, before an incident, under what conditions you would or would not pay?

Dilemma 3: Who tells whom, and in what order?

Within hours, the story was national news. Leadership had to talk to the FBI and federal agencies, the White House, customers, regulators and the public, while the facts were still moving.

• Say too little, and the vacuum fills with speculation (and panic buying).
• Say too much, and you lock yourself into facts that may turn out wrong.
• Someone has to own the order: government first, customers first, or one statement for everyone?

Discussion question: Is there a named person who approves every external statement during a crisis? See Crisis Management Team roles for how to assign it.

What changed afterwards

The incident led the US Transportation Security Administration to issue its first mandatory cybersecurity directives for pipeline operators, including incident reporting and contingency planning. For every regulated industry, the lesson was the same: governments now expect leadership to have rehearsed this decision.

How to run this as a 45-minute tabletop

1. Set the scene (5 min). It's Friday morning. IT reports ransomware on billing and office systems. Operational systems look clean.
2. Inject 1 (10 min). IT can't confirm the attacker is out of the network. Stop operations or keep running?
3. Inject 2 (10 min). A ransom note demands $4.4 million in bitcoin. The insurer asks if you plan to pay.
4. Inject 3 (10 min). A journalist calls. Social media shows queues at fuel stations. What's your first statement, and who gives it?
5. Debrief (10 min). Where did the room disagree? Who had the authority, and who just had opinions?

Want it ready-made? You can build this branching scenario in the builder in about 15 minutes, or play our SolarWinds boardroom drill right now without signing up to see the format.

Related Reading

• Ransomware Tabletop Exercise Scenario: Complete Walkthrough — the technical side of the same type of incident.
• Executive Cyber Crisis Drill: Board-Ready Simulation Guide — how to structure drills for leadership teams.
• 10 Cyber Crisis Scenarios Every CISO Should Practice — more scenarios for your exercise calendar.