Ransomware response playbook

Ransomware is a business crisis with a technical core. The teams that recover well had working backups, practiced the playbook and made the hard decisions before the pressure.

EDRimmutable backupsnetwork segmentationActive Directory toolingCISA #StopRansomware guidanceout-of-band communications

What happens

Modern ransomware attacks are usually human-operated. An attacker gets in (stolen credentials, an exposed service, a phishing link), explores, steals data, removes or corrupts backups, and then encrypts as many systems as possible at once, often outside working hours. Many groups also threaten to publish stolen data, so restoring files does not end the incident.

First hours

Isolate affected systems from the network (do not power them off if you can avoid it; memory may hold keys and evidence).
Declare a major incident, open the out-of-band channel, and bring in legal, communications, executives and your insurer or retainer.
Protect backups: disconnect or lock the backup system now, before it is encrypted or wiped.
Identify the scope: which systems, which accounts, which data, and whether domain-level credentials are compromised.
Preserve evidence: ransom note, sample encrypted files, logs, memory and disk images of key systems.
Reset privileged credentials and tokens in a controlled way, from a clean machine.

Recovery

Rebuild from known-good: restore from backups verified as clean and from before the attacker's earliest access.
Recover in priority order: identity infrastructure first, then the services the business needs most.
Do not reconnect restored systems until the entry point is closed and persistence is removed, or you will be encrypted again.
Monitor closely after each system returns: the attacker may still hold a foothold.
Test restores before you need them. A backup that has never been restored is an assumption.

The payment question

Whether to pay is a business and legal decision, not a technical one, and it should be considered with counsel, the insurer and law enforcement. Payment does not guarantee a working decryptor or that stolen data will be deleted, and it may carry legal exposure, such as sanctions on the recipient. Settle your position in advance as policy, so that it is not invented under pressure.

Reduce the odds and the damage

Patch internet-facing systems and remove exposed remote-access services.
Multi-factor authentication for remote access and for every administrative account.
and tiered administration so one stolen credential does not reach everything.
Rehearse the playbook with a , including the decision to take systems offline.

ransomware-readiness.ymlyaml

backups:
  offline_or_immutable_copy: true       # an attacker with admin cannot delete it
  restore_test_frequency: quarterly
  scope: [domain-controllers, databases, file-servers, config-repos]
identity:
  mfa_for_admins_and_remote_access: true
  tiered_admin_accounts: true           # no domain admin logins on workstations
  service_account_review: quarterly
network:
  segmentation: [workstations, servers, backup, management]
  rdp_exposed_to_internet: false
detection:
  edr_coverage: "all servers and endpoints"
  alert_on: [mass_file_rename, shadow_copy_deletion, backup_service_stop]
runbook:
  out_of_band_comms: "phone tree and secondary chat, stored offline"
  decision_owner_for_payment: "CEO with legal counsel"

Least privilegeleast privilegeThe principle of giving each identity only the permissions strictly needed for its function, and nothing more. It is the opposite of 'admin user by default': every extra role is one more path an attacker can use after a compromise.see in glossary →Tabletop exerciseA discussion-based rehearsal of an incident scenario. It tests the plan, the contacts and the decisions without touching production.see in glossary →

connections on the map

Triage, scoping and containmentis specialised forRansomware response playbook

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Reliability at scale: idempotency, retries and backpressuresecengbackups that restore, and recovery in priority order

Study before

Triage, scoping and containment

test what you learned

Loading questions…