← Courses
CY-201Cyber resiliencePractitioner

Responding to ransomware

The first six hours, decision by decision

The scenario that has become the reference for every exercise. This course walks through the real chronology of a response: detection, disconnection decision, containment, evidence preservation, restoration trade-offs, and rebuilding a trusted foundation.

Learning objectives

  • Run the first six hours
  • Arbitrate between disconnection and evidence preservation
  • Choose a restoration point
  • Coordinate regulatory notification and communication

Intended audience

  • SOC and CSIRT
  • Crisis teams
  • Operations
  • Executives

Prerequisites

  • Cyber Resilience Fundamentals

Detailed curriculum

Module 1

Six hours

The chronology and the trade-offs that punctuate it.

Module 2

After the six hours

Negotiation, notification, and the gradual return to normal.