Responding to ransomware
The first six hours, decision by decision
The scenario that has become the reference for every exercise. This course walks through the real chronology of a response: detection, disconnection decision, containment, evidence preservation, restoration trade-offs, and rebuilding a trusted foundation.
Learning objectives
- Run the first six hours
- Arbitrate between disconnection and evidence preservation
- Choose a restoration point
- Coordinate regulatory notification and communication
Intended audience
- SOC and CSIRT
- Crisis teams
- Operations
- Executives
Prerequisites
- Cyber Resilience Fundamentals
Detailed curriculum
Module 1
Six hours
The chronology and the trade-offs that punctuate it.
Module 2
After the six hours
Negotiation, notification, and the gradual return to normal.
Assessment method
Self-check questions throughout the lessons, with no recorded score. Where an associated track leads to a certification, that certification has a separate exam.
Document issued
This course does not, on its own, lead to a certificate. A track certification, where one exists, is issued after its exam is passed.
Continuity & Resilience editorial team