domains / families / security / recovering-from-ransomware-attack

recovering-from-ransomware-attack

separate

'Executes structured ransomware incident recovery following NIST/CISA

When to use

• After ransomware has encrypted production systems and the decision has been made to recover from backups
• When building or validating a ransomware recovery runbook before an actual incident
• After receiving a decryption key (paid ransom or law enforcement provided) and needing to safely decrypt
• When partial recovery is needed alongside decryption of remaining systems
• Conducting a recovery drill to validate RTO commitments

When not to use

• before completing containment and forensic scoping

Skill page

Source