Incident Response Plan — Ransomware Attack

1. Purpose

This document defines the steps to detect, respond to, contain, and recover from a ransomware attack, minimizing business impact and data loss

2. Detection & Identification

1. Monitor alerts from antivirus, IDS/IPS, SIEM, and endpoint protection tools.

2.Identify signs such as encrypted files, ransom notes, or abnormal system behavior.

3. Confirm ransomware type and affected systems.

3. Containment

1. Immediately isolate infected systems from the network.

2. Disable compromised user accounts.

3 .Block malicious IPs, domains, and file hashes.

4. Eradication

1. Remove ransomware using security tools.
2. Patch vulnerabilities that enabled the attack.
3. Reset credentials for affected users.

5. Recovery

1. Restore systems from clean and verified backups.
2. Monitor systems closely for reinfection. 3.Gradually reconnect systems to the network.

6. Roles & Responsibilities

1. Incident Manager — Coordinates response activities. 2.Security Team — Analyzes attack and mitigates threats.

2. IT Team — Restores systems and services.

3. Management — Approves decisions and communication.

4. Communication

5. Notify internal stakeholders immediately.

6. Inform customers or authorities if required.