~/incident $ keep-your-cool
TABLETOP SIMULATION / FIVE DECISIONS
Open for coffee.
Closed by ransomware.
The register is locked. The queue is growing. You're in charge.
SHIFT DEBRIEF
Real incidents aren't a scorecard. Use your response plan and get qualified help.
KEEP THIS HANDY
Your first-response checklist
- Isolate affected devices from networks. Use a clean device to contact your known IT or security provider.
- Record times, symptoms, and actions. Preserve evidence; coordinate restarts, wipes, and recovery with responders.
- Follow a safe offline business-continuity plan. Don't move sensitive data to personal accounts.
- Assess the incident's scope. Coordinate customer notices and reporting obligations with qualified advisers.
- Verify backups, address the entry point, and test recovery before reconnecting systems.
- Review what happened and update the plan, contacts, and backup tests.