Ransomware recovery plan

Response steps

1. Whoever sees encrypted files or a ransom note disconnects the device from the network and calls the service desk at once.
2. The Incident Coordinator opens an incident, isolates the affected network segments, and disables the accounts involved.
3. The Information Security Officer decides with the Management Board whether customers or the Dutch Data Protection Authority must be told, and starts the clock on the notification deadline.
4. The systems engineers rebuild affected servers from clean images and restore data from the offsite copy at Harbourlight Offsite Backup, after checking the last good restore point.
5. Passwords and keys that the attacker could have seen are replaced before any system returns to production.
6. The team writes a short report with the cause and the changes that follow from it.