Free response plan

Ransomware first-hour plan

A plan to fill in and print: who to call, what to disconnect and who decides, for the hour after a ransom note appears.

What's inside

• Numbers to call
• First ten minutes: stop the spread
• Ten to thirty minutes: make the calls
• Thirty to sixty minutes: record what you know
• Where things are

Related: Backup and recovery