First hour: containment
- Isolate affected systems from the network; do not power off unless actively spreading
- Disable the compromised accounts you can identify, but preserve their logs
- Block outbound traffic to known command-and-control destinations
Ransomware Recovery Playbook
Ransomware recovery differs from ordinary disaster recovery in one decisive way: the environment you restore into may still be compromised. This playbook sequences containment and credential reset before restoration, so you do not recover twice.
What you get
- A first-hour containment sequence that preserves evidence rather than destroying it
- A scope assessment covering backups, identity, and lateral movement
- A staged recovery that rebuilds into a known-clean environment
- Decision records for the questions leadership will ask under pressure
How to use this template
- 1
Isolate without powering off. Disconnect from the network but leave systems running where you can. Powering off destroys memory-resident evidence including encryption keys that occasionally allow recovery without backups, and it can trigger destructive routines on some variants.
- 2
Assume identity is compromised. Most ransomware arrives through credential theft and privilege escalation. Reset the identity tier (domain admin, cloud root, service accounts, API keys) before restoring anything, or you restore into an environment the attacker still holds.
- 3
Verify backups before trusting them. Check whether backups were encrypted, deleted, or quietly corrupted, and establish the last known-clean restore point. Dwell time is often weeks, so the most recent backup may already contain the attacker's foothold.
- 4
Rebuild rather than clean. Restore data into rebuilt systems. Cleaning a compromised host leaves persistence mechanisms you did not find, and reinfection partway through recovery is both common and demoralising.
What's inside
Here's a preview. Unlock the free download to get all 5 sections (4 more below).
Related templates
More free templates IT teams use alongside this one.
Backup & Continuity
Get templateIT Disaster Recovery Plan
Most DR plans are written to satisfy an auditor and are unusable in an actual disaster: too long, structured by system rather than by sequence, and assuming the authors are available. This one is ordered the way the event unfolds.
Incident Response
Get templateTabletop Exercise Facilitator Pack
Tabletop exercises fail when they become a presentation about the plan. The value comes from injects that invalidate assumptions mid-exercise and force the group to decide with incomplete information.
Backup & Continuity
Get templateBackup Policy Template
Most backup policies describe a schedule and stop. The clauses that decide whether you recover from ransomware are the ones usually missing: an immutable copy, an offline or logically-separated copy, and a stated obligation to test restores.
Frequently asked questions
Should you power off systems during a ransomware attack?
+
Generally no. Isolate from the network instead. Powering off destroys memory-resident evidence, including encryption keys that occasionally permit recovery, and some variants respond destructively to shutdown. Power off only if encryption is actively spreading and isolation is not possible.
Can you restore from backup after ransomware?
+
Only after resetting the identity tier and rebuilding into a clean environment, and only from a restore point predating the intrusion. Given typical dwell times, recent backups may already contain the attacker's foothold, so the last clean point is often older than the latest backup.
What should be done in the first hour of a ransomware incident?
+
Isolate affected systems from the network, protect and disconnect backup infrastructure, preserve evidence including logs and the ransom note, notify your cyber insurer before taking irreversible action, and engage legal counsel and your incident response provider.