Your ransomware playbook is a documented plan that tells your team who does what and in what order when an attack hits. Organize it around preparation, detection, containment, eradication, recovery and a post incident review. CISA publishes a response checklist you can adapt to your environment. Exercise the plan regularly so your team acts instead of debating. Store one copy offline.
Picture a ransom note on a finance laptop. People call whoever they think is in charge and argue about what to do before anyone confirms what is encrypted. Ransomware playbooks prevent that scene. New to the threat? See what ransomware is and how it works first.
Your playbook replaces improvisation with a rehearsed sequence. It names who leads, who isolates systems and who contacts legal so your team executes instead of debating.
What is a Ransomware Playbook?
Ransomware playbooks are scenario plans for one incident type. They list decisions, roles and the overall flow of your response. Runbooks detail the technical procedure for a single task like isolating a host. Strong playbooks point to the runbooks they rely on.
CISA publishes incident response playbooks for federal civilian agencies to give them a standard set of procedures. NIST SP 800-61 Rev. 3 was published in April 2025 as a Cybersecurity Framework 2.0 community profile for incident response and supersedes Rev. 2.
What should a Ransomware Playbook Include?
- Roles and contacts. Name an incident lead and a deputy for every role. List management, your managed security provider and your cyber insurer. CISA lists those stakeholders in its reporting step.
- Out of band communication. CISA advises phone calls or another separate channel so attackers do not learn that you detected them.
- A critical asset list. CISA says to triage impacted systems for restoration using a predefined critical asset list.
- Protected backups. NCSC lists regular backups, offline or separate copies and tested restores. Microsoft adds protection for restoration procedures, your configuration database and network diagrams.
- A reporting plan. CISA lists reporting to CISA, your local FBI field office, IC3 or your local Secret Service field office.
What are the Stages of a Ransomware Playbook?
The CISA StopRansomware Guide gives a response checklist with four sections. Add a preparation stage before it.
| Stage | Main Goal | Source |
|---|---|---|
| Preparation | Plans, roles, backups and practice before an attack | NCSC and Microsoft |
| Detection and Analysis | Find affected systems and isolate them | CISA checklist |
| Reporting and Notification | Inform stakeholders and authorities | CISA checklist |
| Containment and Eradication | Remove attacker access and rebuild systems | CISA checklist |
| Recovery and Post Incident | Restore data and record lessons | CISA checklist |
Preparation
NCSC lists four actions. Make regular backups, prevent malware from arriving and spreading, prevent malware from executing on devices and prepare for an incident. Preparing includes incident planning, communication strategies and exercising the plan.
Microsoft states that attackers frequently attack backups and recovery documents. Its strongest advice stores backups in online immutable storage or fully offline or off site. See Microsoft ransomware recovery plan.
Detection and Analysis
CISA lists these first steps in order.
- Identify impacted systems and isolate them. Cut network access at the switch when several systems or subnets are affected and isolate critical systems first.
- Power devices down only if you cannot disconnect them. CISA warns that powering down destroys volatile memory evidence.
- Triage impacted systems for restoration with your critical asset list.
- Review detection tools and logs for earlier stage activity including precursor dropper malware. CISA names Bumblebee, Dridex, Emotet, QakBot and Anchor.
- Hunt for new or escalated Active Directory accounts, unusual VPN logins, changes that impair backups, unexpected RMM or PowerShell use, credential dumping and possible data exfiltration.
Reporting and Notification
CISA says to follow your incident response and communications plan for notifications and to update management. Coordinate public communications and follow data breach notification requirements.
Containment and Eradication
Containment stops the spread and eradication removes the attacker. CISA lists these actions.
- Capture system images and memory from sample affected devices when no mitigation is possible and collect logs. Consult federal law enforcement about possible decryptors.
- Disable known ransomware binaries and remove associated registry values and files.
- Identify the systems and accounts involved in the initial breach. CISA notes this can include email accounts.
- Contain systems that could enable continued access including VPNs, remote access servers, single sign on resources and public facing assets.
- Analyze persistence mechanisms from the outside in and from the inside out.
- Rebuild systems by priority using pre configured standard images where possible. Issue password resets for all affected systems.
Your designated IT or security authority then declares the incident over based on criteria you set in advance.
Recovery and Post Incident Activity
CISA says to reconnect systems and restore data from offline, encrypted backups based on a priority list of critical services. Identify dropper malware before you rebuild from backups. Take care not to reinfect clean systems and add only clean systems to a new recovery VLAN.
Active Directory needs one more step. Microsoft says to reset the krbtgt password twice and to wait 10 hours between resets in forest recovery. See Microsoft krbtgt reset guidance.
Finish by documenting lessons learned. CISA also suggests sharing indicators of compromise with CISA or your sector ISAC. Microsoft recommends measuring your mean time to recover in simulations and real operations.
Why Must You Eradicate Before You Restore?
Restoring over an attacker's foothold invites a second attack. CISA warns that dropper malware must be identified before you rebuild from backups to prevent continued compromise.
You are ready to restore when you can explain in writing how the attacker got in and what persistence they left behind.
How Often should You Test the Playbook?
Test it on a schedule. Microsoft recommends regularly exercising your business continuity and disaster recovery plan. NCSC lists exercising the incident plan as part of preparation.
Record what broke in every exercise and fix it before the next one. Decide your own schedule based on your risk and team size.
Should the Playbook Say to Pay the Ransom?
Decide your position with legal counsel and leadership before an incident. NCSC and UK law enforcement do not encourage, endorse or condone payment. Microsoft states that paying does not guarantee restored access. See NCSC ransomware overview.
Protected, tested backups give you a recovery path that does not depend on an attacker.
Frequently Asked Questions
What is a Ransomware Playbook?
A ransomware playbook is a documented plan that tells your team who does what and in what order when ransomware hits. It spans preparation, detection, containment, eradication, recovery and review.
What is the Difference Between a Playbook and a Runbook?
Playbooks are scenario plans for an incident type with decisions and roles. Runbooks are technical procedures for one task like isolating a host. A good playbook points to its runbooks.
What are the Stages of a Ransomware Playbook?
CISA's response checklist has four sections. They are Detection and Analysis then Reporting and Notification then Containment and Eradication then Recovery and Post Incident Activity. Add a preparation stage before them.
Should You Disconnect Everything When You Detect Ransomware?
Isolate affected systems immediately. CISA says to cut network access at the switch when several systems are affected. Power devices down only if you cannot disconnect them because powering down destroys volatile memory evidence.
Why do Organizations Get Hit Twice After Recovery?
Restoring before eradication brings the attacker's access back. CISA warns that dropper malware must be identified before you rebuild from backups to prevent continued compromise.
Are Backups Enough to Survive Ransomware?
Only when attackers cannot reach them. Microsoft states that attackers frequently attack backups. CISA recommends offline, encrypted backups that you test regularly.
Who should You Report Ransomware to?
In the United States CISA lists CISA, your local FBI field office, IC3 and your local Secret Service field office. UK organizations report through gov.uk.
Key Takeaways
- A ransomware playbook is a documented plan for who does what and in what order during an attack.
- CISA's response checklist has four sections and a preparation stage belongs before them.
- Isolate affected systems immediately and power down only when you cannot disconnect.
- Eradicate before you restore because dropper malware and persistence bring attackers back.
- Store the playbook offline and exercise it on a schedule.
Sources and References
This guide draws on official guidance from CISA, NIST, NCSC and Microsoft.
- #StopRansomware Guide (CISA) www.cisa.gov
- Federal Government Cybersecurity Incident and Vulnerability Response Playbooks (CISA) www.cisa.gov
- Incident Response Recommendations and Considerations for Cybersecurity Risk Management (NIST SP 800-61 Rev. 3) csrc.nist.gov
- Mitigating Malware and Ransomware Attacks (NCSC) www.ncsc.gov.uk
- What You Need to Know About Ransomware (NCSC) www.ncsc.gov.uk
- Prepare for Ransomware Attacks With a Backup and Recovery Plan (Microsoft Learn) learn.microsoft.com
- AD Forest Recovery Reset the krbtgt Password (Microsoft Learn) learn.microsoft.com