When ransomware hits, the first 30 minutes decide whether you lose one laptop or the whole client. Most small IT teams don't have a plan — they have panic.
Here is the short version we hand to teams (steal it):
Minutes 0-5 — Contain. Disconnect affected machines from the network (pull the cable, don't shut down — shutting down can destroy decryption keys in memory). Kill VPN and Wi-Fi on the segment.
Minutes 5-15 — Freeze and notify. Don't touch backups yet. Snapshot what you can see: ransom note path, encrypted extensions, locked screens. Notify the client contact with facts, not guesses.
Minutes 15-30 — Verify before restore. Check backup integrity OFFLINE. Find the last known-clean restore point. Only then start restore — oldest critical systems first.
The teams that survive ransomware aren't the ones with the fanciest tooling. They're the ones with boring, rehearsed checklists.
If you run a small IT team or MSP:
- Free quick-start IR checklist: https://hive80lab.gumroad.com/l/agent-ops-24-7
- Full Ops Starter Kit ($14 one-time): https://hive80lab.gumroad.com
- We audit your current IR plan ($149, 5 days, prioritized findings): https://hive80lab.gumroad.com/l/agent-ops-24-7
Print the checklist. Tape it under the on-call phone. That's the whole trick.
Top comments (0)