Ransomware Response Playbook

T-01

A ransom note

A message on screen, a new text or web file in many folders, or a changed desktop background, demanding payment to unlock files or to keep stolen data from being published.

Any user; the IT service desk

T-02

Files renamed or unreadable in bulk

Many files suddenly carrying a new, unfamiliar ending to their name, or files that will not open; an alert from the security monitoring provider about mass file changes or encryption activity.

Users; the security monitoring provider

T-03

Backups deleted or failing

Backup jobs deleted, switched off or all failing at once; backup copies or snapshots removed; how long backups are kept changed without a change request.

The backup provider; IT operations

T-04

An endpoint protection alert

The security software on PCs and servers reports ransomware behaviour, reports that someone tried to switch it off, or finds a tool attackers use to move between systems.

The security monitoring provider

T-05

Unusual administrator activity

New administrator accounts nobody asked for, administrator sign-ins at odd hours or from odd places, or security tools switched off on many devices at once.

The security monitoring provider; IT operations

T-06

A claim that our data has been stolen

An email, call or post saying someone holds our data and will publish it unless paid, with or without any encryption.

Anyone, often a manager or the communications lead

Encryption on one device, isolated quickly, no sign of it on any other device, no core service affected

Severity 2

High

The playbook floor, and Severity 2, Spread: “One system or account compromised with elevated rights, and contained” (ransomware normally runs with elevated rights)

Encryption on more than one device, or signs of it spreading, or an administrator account used by the attacker

Severity 1

Critical

Severity 1, Spread: “Malware or an attacker spreading, or administrator-level access to core systems”

A core customer service stopped, or likely to stop, for more than the matrix's time

Severity 1

Critical

Severity 1, Service: “A core customer service stopped, or likely to stop, for more than [[4 hours]]”

An internal critical service stopped (for example finance, or a site's office systems) with no customer service affected

Severity 2

High

Severity 2, Service: “A core customer service degraded, or an internal critical service stopped”

Data taken or likely taken at scale: a credible claim with samples, or large unexplained transfers out

Severity 1

Critical

Severity 1, Data: “Personal or customer data at scale taken or exposed, or likely to be”

Personal data of a limited number of people taken or locked

Severity 2

High

Severity 2, Data: “Personal data of individuals exposed, lost or altered, in limited numbers”

Likely to be a significant incident (NIS2) or a major ICT-related incident (DORA)

Severity 1

Critical

Severity 1, Legal and regulatory: “Likely a significant incident (NIS2), a major ICT-related incident (DORA), or a breach that individuals must be told of”

Losses from downtime, recovery and lost orders likely above the matrix's upper threshold

Severity 1

Critical

Severity 1, Financial: “Loss likely above [[€1,000,000]]”

1

Open the case

Record the time of the first alert and the time of declaration separately: declaration starts the reporting clocks. Category IC-01. Note which trigger (T-01 to T-06) started it.

Incident manager

2

Set severity and category

At least Severity 2. Severity 1 if it is spreading, a core service is hit or data may have been taken (Severity mapping).

Incident manager

3

Escalate

Severity 1: Incident manager at once; executive incident lead within 30 minutes; crisis team convened within 1 hour; board chair, or equivalent, within 4 hours. Severity 2: Incident manager at once; executive incident lead within 2 hours. Use CT-01 Incident alert to the response team and CT-02 Executive and board briefing.

Incident manager

4

Contain what is spreading

Run containment C1 to C7 below at once. The incident manager may isolate a device, site or account without waiting for an executive, using the least disruptive containment that stops the harm, and brings in the service owner and specialists before any action that would stop a service people depend on for safety or essential operations (decision rights: “Isolate a system, site or account”, incident manager).

Incident manager, with the technical responders

5

Start the reporting screen

NIS2: ransomware on more than one device is usually capable of severe disruption. GDPR: personal data that is encrypted and unavailable is a personal data breach even if nothing was taken. DORA where it applies. Add the insurer (RD-15) and the crime report (RD-16). Complete within 4 hours (IM-06).

Incident manager, with the Data Protection Officer

6

Set the next update

Severity 1: every 2 hours, round the clock until contained. Severity 2: every 4 hours. Agree a way to talk that does not depend on the affected network: [[phone bridge or out-of-band chat]].

Incident manager

C1

Isolate affected devices from the network: unplug or quarantine them through the endpoint protection console. Do not switch them off or restart them.

Technical responders (managed IT service provider)

At once

C2

Isolate the site or network segment if more than one device is affected or the source is unknown: follow the site isolation steps below. Cut it off from the other sites, the hosted services and the internet, keeping only what the responders need and anything S3 keeps running.

Incident manager decides; managed IT service provider does it

At once, if spreading

C3

Stop synchronisation and scheduled backup jobs that touch affected systems, so encrypted files do not overwrite good copies: file synchronisation, replication and backups of the affected systems.

Backup service provider, with the managed IT service provider

Within [[30 minutes]]

C4

Protect the backups. Confirm at least one copy is offline or immutable and cannot be reached from the affected network. Disconnect the backup system from the affected network and from the shared sign-in directory; change the backup console's credentials from a clean device; turn on any second approval for deleting backups.

Backup service provider

Within [[30 minutes]]

C5

Disable accounts the attacker used or may have used, and any administrator account acting unusually. Disable, do not delete: the account is evidence. Do it from a device that is not affected.

Managed IT service provider; Incident manager approves

Within [[1 hour]]

C6

Preserve evidence before anything is wiped (IM-07): photograph the ransom note, keep the first infected device on and isolated, and ask the monitoring provider to preserve and export its logs (Evidence preservation).

Incident manager, with the security monitoring provider

Before any rebuild

C7

Search for the same attack elsewhere. Share what is known (file names, accounts, addresses) with the monitoring provider and the hosting provider, and have them look at every site and hosted service and block what they find.

Security monitoring provider; cloud hosting provider

Within [[1 hour]], then at every update

Warehouse 1 (EXAMPLE)

[[e.g. disable the site's link on the core firewall; or unplug the uplink in the site comms room]]

[[name and number; backup name and number]]

[[e.g. warehouse systems on their separate network; dispatch]]

[[YYYY-MM-DD]]

Warehouse 2 (EXAMPLE)

[[…]]

[[…]]

[[…]]

[[YYYY-MM-DD]]

Warehouse 3 (EXAMPLE)

[[…]]

[[…]]

[[…]]

[[YYYY-MM-DD]]

[[Head office or other site]]

[[…]]

[[…]]

[[…]]

[[YYYY-MM-DD]]

S1

Confirm the order to isolate, and the time, with the incident manager. Note it in the case log.

Managed IT service provider

On the order

S2

Cut the site's office network off from the other sites, the hosted services and the internet at the point in the table. Leave devices on.

Managed IT service provider

Within [[15 minutes]] of the order

S3

Where the site's operational network (for example warehouse systems) is separated from its office network, confirm the separation holds and nothing crosses it. If it is not separated, contain the least disruptive way first: block what crosses between the two, and disable affected accounts. Before cutting off anything people depend on for safety or essential operations, bring in its service owner and specialists, and decide with them how far to go; keep containing meanwhile.

Managed IT service provider; Incident manager decides, with the service owner and specialists

With S2

S4

Keep one managed path in for the responders, if needed, from a clean device only.

Managed IT service provider

With S2

S5

Tell the site manager what has happened and what still works, using the staff holding message (CT-03).

Incident manager

Within [[30 minutes]]

S6

Confirm to the incident manager that the site is isolated, and ask the monitoring provider to confirm no traffic leaves it.

Managed IT service provider; Security monitoring provider

When done

Yes

Severity 1. Widen the isolation, the least disruptive way that stops it: the next site or segment, any shared administrator systems, the link to hosted services. Before stopping anything people depend on for safety or essential operations, bring in its service owner and specialists. Decide whether a customer-facing service must stop to protect it (see Who decides). Ask for outside responders if the technical responders cannot keep up.

No

Confirm it: no new encryption, alerts or attacker activity for [[2 hours]] across every site and hosted service. Record the time of containment: “The incident can no longer spread or cause new harm, even though systems may not yet be restored.”

Not yet known

Treat it as Yes.

Who decides

Isolation: incident manager, at once and least disruptive first. Stopping a customer-facing service: executive incident lead; the incident manager may do it first where waiting would let the harm spread, and reports it at once. Where people depend on the service for safety or essential operations, its service owner and specialists are brought in first.

Yes

Run the Personal Data Breach Response Playbook alongside this one. The GDPR clock (RD-06) runs from awareness. Severity 1 if data was taken at scale. Plan the customer notice (CT-04) and, where individuals are at high risk, the communication to them (CT-08). Record what was taken, for whom, and how you know.

No

Record the evidence that it was not taken: logs of data leaving the network, reviewed for the whole period the attacker was inside. Encrypted personal data that could not be used for a time is still a personal data breach (availability): the Data Protection Officer assesses it and it is always recorded (RD-08).

Not yet known

Treat it as possible until the logs have been reviewed. Signs: a claim with sample files, large transfers out, archive or file transfer tools where they should not be.

Who decides

Incident manager, with the Data Protection Officer

Yes

Restore (D4). Use copies from before the earliest sign of the attacker, not just before the encryption. Check each copy's integrity, and scan it in an isolated place before it goes back on the network.

No

Rebuild from clean images and recover data from other sources (the hosting provider, suppliers, paper records). Tell the executive incident lead at once: recovery will take longer and the restore order (Recovery criteria) matters more. Engage outside responders if needed (decision rights: incident manager, within the [[retainer]]; above it the executive incident lead).

Not yet known

Do not restore until they have been checked. Never restore from a copy that the attacker could have reached without checking it.

Who decides

Backup service provider checks; Incident manager decides

Yes

Restore data onto the patched system, change its credentials, and check it before reconnecting.

No

Rebuild it from a clean image, then restore only data. Where the attacker had administrator rights, rebuild the systems it controlled, starting with the sign-in directory.

Who decides

Managed IT service provider recommends; Incident manager decides; the system owner tests

Yes

Do not reply, and do not contact the attacker. Nobody makes contact except through a channel the board has decided on, [[e.g. a specialist appointed through the insurer and Legal]]. Keep the note, contact details and any deadline as evidence (Evidence preservation). Legal starts the sanctions check. Tell the insurer (RD-15) and report the crime (RD-16). Plan recovery as if nothing will be paid.

No

Continue recovery. A demand can still arrive later, sometimes by email to managers or customers: brief the communications lead and the service desk to pass it straight to the incident manager.

Who decides

Paying a ransom or extortion demand: only the board or its equivalent. Never before legal advice (including sanctions checks), the insurer's view and a report to law enforcement. The plan assumes we do not pay.

Yes

Record the reference numbers in the case log. Follow the insurer's instructions on its panel responders before engaging anyone else, where the policy requires it.

No

Tell the insurer as the policy requires (RD-15: [[as the policy requires, often within 48 hours]]) and report the crime (RD-16: [[as soon as practical for suspected crime]]). Neither waits for the investigation to finish.

Who decides

Executive incident lead; Legal makes the crime report

Incident manager

[[e.g. Information Security Manager, with a named deputy]]

Runs the playbook; decides isolation, least disruptive first, bringing in the service owner and specialists before stopping a service people depend on for safety or essential operations; keeps the case log and the decision log; runs the reporting screen.

Executive incident lead

[[e.g. Chief Operating Officer, with a named deputy]]

Decides on stopping customer services, reports and outside messages; leads the crisis team; takes the ransom question to the board.

Technical responders

[[IT operations, the managed IT provider and the security monitoring provider]]

Isolate, investigate, eradicate, rebuild and restore.

Data Protection Officer

[[or the privacy lead where no DPO is appointed]]

Decides with the incident manager whether data was taken (D2); advises on GDPR reports.

Legal

[[in-house or external counsel]]

Sanctions check; crime report; privilege and contracts; advice to the board on any demand.

Communications lead

[[e.g. Head of Marketing and Communications]]

Staff, customer and media messages from the approved templates only.

Board

[[the board chair, or the equivalent where there is no board]]

The only body that may decide on a ransom; told of Severity 1 within the matrix's time.

Managed IT service provider

(EXAMPLE SUP-001)

Isolates networks and systems, rebuilds devices, restores from backup

[[name; 24-hour incident number; contract reference]]

Security monitoring provider

(EXAMPLE SUP-006)

Detects and alerts around the clock; supplies logs and analysis

[[name; 24-hour incident number; contract reference]]

Backup service provider

(EXAMPLE SUP-011)

Confirms backup integrity and supports restoration

[[name; 24-hour incident number; contract reference]]

Cloud hosting provider

(EXAMPLE SUP-002)

Protects and restores the hosted ordering platform

[[name; 24-hour incident number; contract reference]]

Email and office software provider

(EXAMPLE SUP-005)

Suspends accounts, removes mail rules and supplies mailbox audit logs

[[name; 24-hour incident number; contract reference]]

K1

Keep one list of every affected device, account, site and service, with when it was found and isolated; update it at every update.

Incident manager

From declaration

K2

Ask the hosting provider to check the hosted ordering platform for the same signs, protect it, and take a copy that the attacker cannot reach.

Incident manager; cloud hosting provider

Within [[1 hour]]

K3

Watch every site and hosted service for the indicators found, and raise any new sighting at once.

Security monitoring provider

Round the clock until closure

K4

Decide whether any customer-facing service must stop to protect it or other customers.

Executive incident lead

At each update while D1 is Yes

K5

Brief the crisis team and the executive incident lead (CT-02 Executive and board briefing).

Incident manager

Every update

K6

Send the staff holding message (CT-03 Staff holding message), including: do not discuss the incident outside, and report any contact from the attacker.

Communications lead

When staff notice the effects

K7

List the personal data held on the affected systems, and whose it is, for D2.

Data Protection Officer

Within [[4 hours]]

K8

Start the sanctions check if a demand has been made; agree with the insurer how any contact will be handled.

Legal

On a demand

E1

Find the way in: the phishing email, remote access or unpatched system the attacker used first. Close it. For a phishing email, have it removed from every mailbox and its sender and attachment blocked.

Security monitoring provider; managed IT service provider; email and office software provider for email

Before reconnection

E2

Find and remove what the attacker left behind: new accounts, scheduled tasks, remote access tools, changed settings on the sign-in directory.

Managed IT service provider

Before reconnection

E3

Reset credentials in this order, from clean devices: administrator accounts, service accounts, remote access, backup system, then every user at affected sites. End all signed-in sessions.

Managed IT service provider

Before reconnection

E4

Patch the weakness used, and any other critical weakness on the affected systems.

Managed IT service provider

Before reconnection

E5

Confirm to the incident manager that E1 to E4 are done, with no new attacker activity since containment.

Security monitoring provider

Before recovery starts

V1

Agree the restore order (Recovery criteria) and the target time for each service.

Executive incident lead

When recovery starts

V2

Check each backup's integrity before it is used (IM-10), and record the check.

Backup service provider

Before each restore

V3

Rebuild or restore each system as D4 decides; apply the changed credentials; turn on endpoint protection and monitoring before reconnection.

Managed IT service provider

In restore order

V4

Test the service and confirm in writing that it works.

System owner

Before it returns to users

V5

Reconnect in stages, under closer monitoring, one site or service at a time.

Managed IT service provider; security monitoring provider

After V4

V6

Start the monitoring period (7 days for Severity 1 and Severity 2) and tell staff what is back (CT-03 Staff holding message), customers where affected (CT-04 Customer notice).

Incident manager; communications lead

When the last service returns

V7

At closure, send CT-10 All-clear and thank-you.

Communications lead

At closure

The ransom note

Photograph it on screen with the time visible; copy the note file to a clean, write-protected store. Do not open any link or address in it.

Incident manager

Any clean-up

Sample encrypted files

Copy [[5]] encrypted files, and where possible the same files from backup, to the evidence store. Some can later be decrypted by public tools.

Managed IT service provider

Rebuild

Memory of the first infected device

Where possible, a responder captures memory with a forensic tool while the device is on and isolated. Do not do this without training.

Managed IT service provider or outside responder

Switch-off

The first infected device

Keep it on and isolated, labelled and locked away. If it must be reused, take a full disk image first.

Managed IT service provider

Rebuild

Logs

Export and keep: endpoint protection, firewall, remote access, sign-in directory, email, backup console and hosted services. Extend retention on each source for the incident.

Security monitoring provider

Retention runs out

The attacker's messages

Keep every email, note, chat address and deadline; record, but never follow, links.

Incident manager; Legal

Any contact

The decision log

Every decision, who took it and when, with the reason, in the case log (A09).

Incident manager

Throughout

RD-01

NIS2

Early warning: within 24 hours of awareness

[[CSIRT or competent authority]]

We are an essential or important entity and the ransomware has caused or could cause severe disruption of our services or financial loss (NIS2). Encryption across more than one device or site usually meets this.

RD-02

NIS2

Incident notification: within 72 hours of awareness

[[CSIRT or competent authority]]

As RD-01, updating the early warning with an initial assessment of severity and impact.

RD-04

NIS2

Final report: within one month of the incident notification (a progress report then, and the final report within one month of handling, if still ongoing)

[[CSIRT or competent authority]]

As RD-01; describe the root cause, the measures taken and any effect on other countries.

RD-05

NIS2

Notice to recipients of our services: without undue delay, where appropriate

Customers whose service is likely to be adversely affected

A significant incident likely to affect the services we provide to customers.

RD-06

GDPR

Notification to the supervisory authority: without undue delay and, where feasible, within 72 hours of awareness; later only with reasons for the delay

[[lead supervisory authority]]

Personal data was taken, or was encrypted and unavailable, and the breach is likely to result in a risk to individuals. Both are breaches: confidentiality, and availability.

RD-07

GDPR

Communication to the individuals affected: without undue delay

The data subjects

Personal data was taken and the risk to individuals is high (the Personal Data Breach Response Playbook).

RD-08

GDPR

Breach record: for every personal data breach, notified or not

Kept by us; shown to the authority on request

Every personal data breach, including an availability breach that is not notified.

RD-10

DORA

Initial notification: within 4 hours of classifying the incident as major, and no later than 24 hours after awareness; where it is classified as major only after those 24 hours, within 4 hours of that classification

[[financial competent authority]]

Financial entities only: the incident is classified as major (the screen's DORA question). The intermediate report (RD-11) and final report (RD-12) follow on their own clocks.

RD-13

DORA

Notice to clients: without undue delay

Clients whose financial interests are affected

As RD-10, where clients' financial interests are affected.

RD-14

Contract

Notice to customers under contract: [[as each contract requires]]

[[customers with a notification clause]]

A customer contract requires notice of an incident affecting its service or data.

RD-15

Insurance

Notice to the cyber insurer: [[as the policy requires, often within 48 hours]]

[[insurer or broker incident line]]

Always, where a cyber policy is held. The insurer may require its own responders.

RD-16

Law enforcement

Crime report: [[as soon as practical for suspected crime]]

[[national cybercrime reporting service]]

Always: ransomware and extortion are crimes.

CT-01

Incident alert to the response team

Incident manager, responders, executive incident lead

Incident manager

At declaration, to the response team.

CT-02

Executive and board briefing

Executive incident lead, crisis team, board chair

Incident manager

At each update for Severity 1 and 2, and to the board chair for Severity 1.

CT-03

Staff holding message

All staff, or the affected site or team

Executive incident lead

As soon as staff notice: systems down, PCs taken away. Tell them what to do, what not to say, and to report contact from the attacker.

CT-04

Customer notice

Customers whose service or data is affected

Executive incident lead

When a customer's service or data is affected, or a contract requires it. Say what happened, what it means for them and what we are doing; do not guess.

CT-05

Supplier notice and request for help

Suppliers involved in the incident or the recovery

Incident manager

When a supplier must act (restore, investigate) or be warned because the attacker may reach it through us.

CT-09

Media holding statement

Press and public

Executive incident lead

When the incident is, or is about to be, public, including when the attacker publishes or contacts the press.

CT-10

All-clear and thank-you

Everyone told earlier

Executive incident lead

At closure.

1

The cause is understood well enough that the same route in is closed.

The way in (E1) is closed, what the attacker left (E2) is removed, and the monitoring provider has seen no activity since containment (E5).

Incident manager; security monitoring provider

2

Backups or rebuild images were checked for integrity before they were used.

Each backup copy used dates from before the earliest sign of the attacker, was checked for integrity, and was scanned before use (D3, V2). The check is recorded.

Backup service provider

3

Restored systems are patched, scanned and monitored, with credentials changed where they could have been taken.

Each system is rebuilt or restored as D4 decided, patched, running endpoint protection and monitored. Credentials were reset in the order of E3.

Managed IT service provider

4

The system owner has tested the service and confirms it works.

The system owner has tested the service and confirmed in writing that it works (V4).

System owner

5

The monitoring period has started: [[7]] calendar days of closer watching for Severity 1 and 2 before closure.

The monitoring period of 7 calendar days has started, with the monitoring provider watching for the indicators found.

Incident manager

First

Foundations: network, sign-in directory, backup system, endpoint protection and monitoring

[[your suppliers]]

[[12 hours]] (an estimate) (EXAMPLE)

1

Warehouse dispatch (EXAMPLE)

Managed IT service provider; ERP software provider (hosted); Security monitoring provider; Warehouse management system provider; Network connectivity provider

[[8 hours]]. After an attack about 17 hours: its workaround carries the gap (EXAMPLE)

2

Online ordering (EXAMPLE)

Managed IT service provider; Cloud hosting provider; Security monitoring provider; Backup service provider; Network connectivity provider

[[24 hours]]. After an attack about 108 hours: past its maximum of 48, so it cannot recover in time (EXAMPLE)

3

Customer contact (EXAMPLE)

Email and office software provider

[[24 hours]]. After an attack about 12 hours (EXAMPLE)

4

Payments (EXAMPLE)

Payment service provider

[[24 hours]]. Restored by its provider: no rebuild of ours (EXAMPLE)

5

Finance and payroll (EXAMPLE)

Managed IT service provider; Cloud hosting provider; ERP software provider (hosted); Backup service provider; Payroll bureau

[[48 hours]]. After an attack about 12 hours (EXAMPLE)

Then

Everything else, by business priority

[[target]]

P1

Hold the post-incident review with the Post-Incident Review Template, within 10 working days of closure. Cover: the way in, why it spread, how fast each step of this playbook ran, the backups, and the reports.

Head of Information Security

Within 10 working days of closure

P2

Reassess the risks the incident touched in the Information Security Risk Register (Information Security Risk Management pack), at least R-01 “Ransomware takes online ordering offline for more than 2 days” and R-04 “Ransomware spreads from warehouse office PCs to warehouse systems” in the example. P05 rule RM-10: “A trigger forces reassessment of the risks it touches within [[10]] working days.”

Each risk's owner

Within the RM-10 window

P3

Give every review action an owner and a due date, and track it in the case and action log until done.

Head of Information Security

At the review

P4

Update this playbook: the site isolation steps, contacts, triggers, restore order and anything that was slow.

Incident manager

Within [[30 days]]

P5

Send the NIS2 final report (RD-04) and the DORA final report (RD-12) where they apply; their content comes from the review.

Incident manager

By their deadlines

P6

Exercise this playbook at least once a year, and after every Severity 1 incident review the plan (IM-12).

Head of Information Security

Yearly

What happened

The security monitoring provider alerted on encryption activity on one office PC at Warehouse 2. It had spread to 14 office PCs on that site's office network before the site was cut off. Ordering and dispatch were not affected.

Category and severity

IC-01; Severity 1: it spread to more than one device (Severity 1, Spread: “Malware or an attacker spreading, or administrator-level access to core systems”).

Roles

Incident manager: Information Security Manager. Executive incident lead: Chief Operating Officer. Reported by: Security monitoring provider (SUP-006).

Root cause

A phishing attachment opened by a warehouse office user whose account had local administrator rights. That site's office network was not yet separated, so it spread to 14 PCs.

Screen: NIS2

Significant: capable of severe operational disruption; early warning, notification and final report made

Screen: GDPR

Personal data breach (availability of shipping records on the PCs); restored from backup, no sign of data taken; unlikely to result in a risk, so recorded and not notified

Screen: DORA

Not applicable: not a financial entity

12 Aug, 07:50

35 min before declaration

Monitoring alert: encryption activity on one office PC at Warehouse 2

Security monitoring provider (SUP-006)

Trigger T-02 (encryption activity)

12 Aug, 08:05

20 min before declaration

Triage starts (out of hours: within 60 minutes)

IT service desk

Triage, before the playbook (IM-02)

12 Aug, 08:25

+0:00

Declared Severity 1, category IC-01; reporting clocks start

Incident manager

First hour 1 and 2: case opened, Severity 1 (spreading)

12 Aug, 08:40

+0:15

Executive incident lead told

Incident manager

First hour 3: escalate

12 Aug, 08:55

+0:30

Decision: cut Warehouse 2's office network off from all other networks (the incident manager's decision; the executive incident lead agreed, as it stopped office work at the site)

Incident manager

C2 and D1: isolate the site

12 Aug, 09:10

+0:45

Warehouse 2 office network isolated

Managed IT provider (SUP-001)

C2: site isolation steps

12 Aug, 09:20

+0:55

Crisis team convened

Executive incident lead

First hour 3: escalate

12 Aug, 11:30

+3:05

Reporting screen complete: NIS2 significant; GDPR breach to assess; DORA not applicable

Incident manager, Data Protection Officer

First hour 5: reporting screen (IM-06)

12 Aug, 11:45

+3:20

Cyber insurer told

Executive incident lead

D6: RD-15

12 Aug, 12:20

+3:55

Board chair told

Executive incident lead

First hour 3: escalate

12 Aug, 13:50

+5:25

Contained: 14 PCs isolated, no activity on any other site

Incident manager

D1 answered No: contained

12 Aug, 15:40

+7:15

NIS2 early warning submitted

Incident manager

RD-01

12 Aug, 17:10

+8:45

Crime reported

Legal

D6: RD-16

12 Aug, 19:30

+11:05

Eradicated: the phishing email removed from every mailbox, its sender and attachment blocked, and the affected user's and Warehouse 2 administrator passwords reset

Managed IT provider (SUP-001), email provider (SUP-005)

Eradicate E1 to E3

13 Aug, 14:00

+29:35

Office work resumes on rebuilt PCs; backups checked before restoring

Managed IT provider (SUP-001), backup provider (SUP-011)

D3, D4 and Recover: backups checked, PCs rebuilt

14 Aug, 10:00

+2 days

GDPR assessment: unlikely to result in a risk; recorded, not notified

Data Protection Officer

D2 and RD-06: breach assessed

14 Aug, 14:00

+2 days

NIS2 incident notification submitted

Incident manager

RD-02

21 Aug, 09:00

+9 days

Closed after 7 days' monitoring without recurrence

Incident manager

Recovery criterion 5: monitoring period ended

27 Aug, 10:00

+15 days

Post-incident review held

Head of Information Security

Post-incident actions (IM-11)

11 Sep, 12:00

+30 days

NIS2 final report submitted

Incident manager

RD-04

RD-01

NIS2 early warning

12 Aug 2026, 15:40

13 Aug 2026, 08:25

7 h 15 min

Yes

RD-02

NIS2 incident notification

14 Aug 2026, 14:00

15 Aug 2026, 08:25

2 days

Yes

RD-04

NIS2 final report

11 Sep 2026, 12:00

14 Sep 2026, 23:59

30 days

Yes

RD-15

Insurance: Insurer's incident line; its panel firm was not needed

12 Aug 2026, 11:45

[[as the policy requires, often within 48 hours]]

3 h 20 min

No legal deadline

RD-16

Law enforcement: Reported to [[the national cybercrime reporting service]]

12 Aug 2026, 17:10

[[as soon as practical for suspected crime]]

8 h 45 min

No legal deadline

PIA-01

Remove local administrator rights from all office PCs

Head of IT

31 Oct 2026

In progress

PIA-02

Finish separating the warehouse networks from the office network at all three sites (P05 TA-04; two were still joined on 12 Aug)

Head of IT

11 Sep 2026

Done 11 Sep 2026

PIA-03

Reassess the risk of ransomware spreading to warehouse systems (P05 R-04)

Head of Logistics

26 Aug 2026

Done 20 Aug 2026

PIA-04

Add site isolation steps for each warehouse to the Ransomware Response Playbook

Information Security Manager

25 Sep 2026

Open (past due)

PIA-05

Give the monitoring provider's out-of-hours analysts a direct line to the incident manager

Head of Information Security

15 Sep 2026

Done 10 Sep 2026

ISO/IEC 27001:2022

Annex A 5.26 — Response to information security incidents

First-hour actions, Decision tree, Role actions by phase

ISO/IEC 27001:2022

Annex A 5.28 — Collection of evidence

Section 6: evidence preserved with chain of custody

ISO/IEC 27001:2022

Annex A 5.29 — Information security during disruption

Role actions by phase; Recovery criteria

ISO/IEC 27001:2022

Annex A 8.13 — Information backup

C3, C4, D3 and V2: backups protected and checked

NIST CSF 2.0

RS.MI-01 — “Incidents are contained”

Containment C1 to C7, site isolation steps, D1

NIST CSF 2.0

RS.MI-02 — “Incidents are eradicated”

Eradicate E1 to E5, D4

NIST CSF 2.0

RC.RP-03 — “The integrity of backups and other restoration assets is verified before using them for restoration”

D3 and V2: backups verified before restoration

NIST CSF 2.0

RC.RP-05 — “The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed”

V3 to V5 and recovery criteria 3 and 4

NIST CSF 2.0

RS.AN-07 — “Incident data and metadata are collected, and their integrity and provenance are preserved”

Section 6: incident data collected with integrity and provenance

NIST CSF 2.0

GV.SC-08 — “Relevant suppliers and other third parties are included in incident planning, response, and recovery activities”

Section 5: suppliers in the response

NIST CSF 2.0

RS.CO-02 — “Internal and external stakeholders are notified of incidents”

Section 7: stakeholders notified

NIS2 — Directive (EU) 2022/2555

Article 23(3) — an incident is significant if it “has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned”, or has affected or is capable of affecting others “by causing considerable material or non-material damage”

Section 7: when ransomware is a significant incident

NIS2 — Directive (EU) 2022/2555

Article 23(4) — an early warning within 24 hours of becoming aware of a significant incident; an incident notification within 72 hours; an intermediate report on request; a final report not later than one month after the incident notification (or a progress report, then a final report within one month of handling, if still ongoing)

RD-01 to RD-04

GDPR — Regulation (EU) 2016/679

Article 4(12) — “personal data breach” means “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”

D2: data taken or made unavailable is a personal data breach

GDPR — Regulation (EU) 2016/679

Article 33(1) — notify the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; a later notification gives reasons for the delay

RD-06

DORA — Regulation (EU) 2022/2554

Article 19(4) — an initial notification, an intermediate report, and a final report when the root cause analysis is complete and actual impact figures are available

RD-10 to RD-12 for financial entities

DORA — Delegated Regulation (EU) 2024/1772

Article 8 — an incident is major where it affects critical services and either meets the data-loss threshold in Article 9(5)(b) or meets two or more of the other materiality thresholds

Tailoring notes: classifying a major ICT-related incident

Awareness

The moment the reporting clocks start: the time the incident is declared, as recorded in the case log, unless the record shows we had reasonable certainty earlier, in which case the earlier time.

Clean image

A known-good copy of an operating system and software, kept apart from the network, used to rebuild a device from scratch.

Closure

Recovery criteria met, the monitoring period passed without recurrence, and the case log complete.

Containment

The incident can no longer spread or cause new harm, even though systems may not yet be restored.

Double extortion

Ransomware where the attacker also copies data before encrypting it, and threatens to publish it unless paid.

Endpoint protection

The security software on PCs and servers that detects and blocks malicious behaviour and reports to the monitoring provider.

Incident

An event, declared by the incident manager, that has compromised, or threatens to compromise, the availability, authenticity, integrity or confidentiality of our data or services, and needs a managed response.

Indicators

The traces an attack leaves that can be searched for elsewhere: file names, addresses, accounts, tools.

Isolate

Cut a device, site or network off from every other network while leaving it switched on, so it cannot spread harm and its evidence survives.

Major ICT-related incident

DORA's term, for financial entities only: an ICT-related incident with a high adverse impact on systems that support critical or important functions, as tested by Delegated Regulation (EU) 2024/1772.

Offline or immutable backup

A backup copy that cannot be changed or deleted from the network it protects: disconnected, or locked for a set period by the backup system.

Personal data breach

GDPR's term: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Ransomware

Malicious software that encrypts files or systems so they cannot be used, followed by a demand for payment. Category IC-01 in the matrix.

Rebuild

Wipe a device and install it again from a clean image, then restore only data. Used where the attacker may have changed the system itself.

Restore

Put data or a system back from a backup copy that has been checked for integrity.

Sanctions check

Legal's check that no payment or other dealing would benefit a person, group or country under sanctions.

Significant incident

NIS2's term: an incident that has caused or could cause severe operational disruption or financial loss to us, or considerable damage to others. Reported to the authority on NIS2's clock.