Ransomware Response Playbook Template

This template is for incident response leads, IT operations, business continuity owners, and executives. Fill in the bracketed fields with your own names, numbers, and systems before you need them; during an attack there is no time to work out who to call. It follows the CISA #StopRansomware Guide and NIST SP 800-61 Rev. 3, which aligns incident response with the NIST Cybersecurity Framework 2.0.

How to use this template

1. Complete every bracketed field and assign an owner to each section.
2. Keep an offline or printed copy. Email, chat, and file shares may be encrypted or untrustworthy during an incident.
3. Exercise the playbook with a tabletop at least once a year and after major infrastructure changes.

1. Preparation

• □ Keep offline or immutable backups of critical systems and identity infrastructure, protected by separate credentials that are not domain-joined. Attackers target backups first.
• □ Test restores on a schedule, including a full restore of at least one critical system, timed against its RTO.
• □ Define RTO and RPO for each critical business service: [service], [RTO], [RPO].
• □ Document the restore order and dependencies, starting with identity and core network services.
• □ Maintain an IR team roster and an out-of-band communication channel: [channel], [roster location].
• □ Pre-arrange contacts: IR retainer [ ], legal counsel [ ], cyber insurer [ ], law enforcement [ ], and regulators [ ].
• □ Close common initial access paths: phishing-resistant MFA on remote access and admin accounts, and prompt patching of internet-facing systems.
• □ Agree a decision process for ransom demands with legal, executives, and the insurer, including sanctions screening.

2. Detection and analysis

1. Confirm the incident, declare severity, and activate the IR team.
2. Identify affected systems, the ransomware variant from the ransom note or binaries, and the likely initial access vector.
3. Determine whether data was exfiltrated before encryption by reviewing egress logs and cloud storage activity.

3. Containment

1. Isolate affected systems from the network. CISA advises powering devices down only if you cannot disconnect them, because shutdown destroys volatile evidence.
2. Disable compromised accounts and reset credentials, prioritizing privileged and service accounts.
3. Confirm backups are intact and isolated before they are touched.

4. Eradication and recovery

1. Preserve evidence (disk images, memory, logs) before rebuilding.
2. Rebuild from known-good images and restore data from verified clean backups in the documented order.
3. Close the initial access vector before reconnecting restored systems.
4. Monitor closely for signs of reinfection or persistence.

5. Communication and lessons learned

• □ Legal confirms notification deadlines for regulators, customers, and partners.
• □ Use pre-approved templates for staff, customer, and media communications.
• □ Hold a lessons-learned review within [ ] weeks and update this playbook.

Common pitfalls

• Backups reachable with domain admin credentials, which get encrypted along with everything else.
• Untested restores. Recovery time is unknown until you have done it.
• A playbook stored only on the network being encrypted.
• Restoring before closing the entry point, which invites a second attack.