Ransomware: incident response playbook

First 15 minutes

1. Disconnect affected devices from the network (unplug or disable Wi-Fi). Do not switch them off.
2. Disable remote access and VPN accounts that may be compromised.
3. Protect backups: take them offline or confirm they are immutable.
4. Call the incident lead and escalate to SEV1.

Set the severity and download a first-response checklist

What the full playbook covers

• Contain (3 steps)
• Eradicate (2)
• Recover (2)
• Who to notify
• Evidence to keep

The full playbook is in the Incident Response & Business Continuity Kit with 8 more, the IR plan, a BCP/DR plan and 6 tabletop exercises.

Other playbooks

• Phishing and business email compromise
• Lost or stolen device
• Data sent to the wrong person or exposed
• Compromised account or cloud admin access
• Malware on a device
• Major outage or denial of service
• Supplier or third-party breach
• AI tool data leak or misuse