Plan
Response steps
- Whoever sees encrypted files or a ransom note disconnects the device from the network and calls the service desk at once.
- The Incident Coordinator opens an incident, isolates the affected network segments, and disables the accounts involved.
- The Information Security Officer decides with the Management Board whether customers or the Dutch Data Protection Authority must be told, and starts the clock on the notification deadline.
- The systems engineers rebuild affected servers from clean images and restore data from the offsite copy at Harbourlight Offsite Backup, after checking the last good restore point.
- Passwords and keys that the attacker could have seen are replaced before any system returns to production.
- The team writes a short report with the cause and the changes that follow from it.