Most ransomware plans fail on decisions, not technology. Here is a short checklist for the first hour and beyond.
First hour
- Confirm the incident and rate its severity.
- Isolate affected systems from the network, and do not power them off until evidence is captured.
- Name an incident lead, a technical lead and a communications lead, each with a backup.
- Preserve logs, ransom notes and disk images.
Notify
- Your cyber insurer and legal counsel.
- The national cyber agency (in Australia, the ACSC).
- Regulators and affected people where notification duties apply.
Recover
- Restore from tested, offline backups before reconnecting anything.
- Reset credentials and review privileged access.
- Run a lessons-learned review and update the plan.
Rehearse the plan at least once a year with a tabletop exercise, because the first real attempt should not be the first time anyone reads it.
Full playbook with roles, reporting duties and recovery steps: https://cybercompliancepro.com/blog/cyber-attack-incident-response-plan-ransomware-playbook/
Top comments (0)