Tabletop exercises are a critical tool to help companies consider and prepare for different cyber risks. To guide companies and their counsel through the process, in-house and outside counsel, public relations specialists and cyber forensics experts from Hunton, Joele Frank, Mandiant and News Corp. conducted a mock tabletop exercise during a recent Practising Law Institute program. The exercise focused on the implementation of a hypothetical company’s incident response plan, with advice on the incident’s fallout, in the critical first few days following an attack through the aftermath. This second article in a two-part series covering the key practical details from the presentation addresses events on day two and thereafter. Part one focused on the melee of the first day. See our two-part series on a ransomware tabletop’s 360‑degree incident response view: “Days One to Four” (Jan. 4, 2023), and “Day Five Through Post-Mortem” (Jan. 11, 2023).