Sophos reports that attackers tried to compromise backups in 94% of attacks it studied. A ransomware playbook turns a broad incident response plan into scenario-specific instructions, decided before the pressure starts.
This guide covers a template bundle you can adapt: preparation, first-hour response, roles, communications, recovery, and post-incident review.
Key Takeaways
- Define triggers, owners, decision rights, evidence rules, and recovery gates before an incident.
- Customize templates to your assets, cloud and on-premises mix, regulations, and tools.
- First priorities: confirm, contain, preserve evidence, secure communications, protect backups.
- Tabletops, restoration drills, and post-incident reviews keep the playbook usable.
What a ransomware incident response playbook template should contain
Plan, playbook, and runbook
Three documents, three jobs:
- Incident response plan: the organization-wide governance document. NIST treats it as the roadmap for building response capability.
- Ransomware playbook: the scenario-specific workflow. NIST describes playbooks as actionable steps for particular situations.
- Runbook: the technical procedure for a single action, such as isolating an endpoint or restoring a server.
NIST's SP 800-61 Rev. 3, finalized in April 2025, is the current baseline and supersedes Rev. 2.
Template anatomy
Every procedure in the playbook should carry the same fields:
- Purpose and activation trigger
- Severity level
- Responsible owner and required inputs
- Action steps
- Approval point
- Evidence to capture
- Escalation path
- Completion criteria
Consistency matters more than polish. A responder at 3 a.m. should find the same fields in the same place every time.
The reusable template pack
Build these eight documents:
- Master ransomware playbook
- First-hour checklist
- RACI and contact directory
- Asset and dependency register
- Communications templates
- Ransom decision log
- Recovery checklist
- Post-incident review form
How to build the playbook before an incident
Define scope, triggers, and severity
List the events that activate the playbook:
- Confirmed mass file encryption
- Ransom note creation
- Suspicious backup deletion
- Correlated EDR, identity, and network alerts
Define severity tiers and state what is out of scope, such as a single quarantined commodity malware sample. Align the lifecycle with NIST SP 800-61 Rev. 3, the CISA #StopRansomware Guide, and your own policies.
Speed matters. In one Trigona incident DeepSeas analyzed, roughly 2.5 hours passed between compromise and ransomware execution. Sophos also reports that 88% of ransomware payloads deploy outside business hours, so test your overnight escalation path.
Assign roles, alternates, and decision authority
Build a RACI covering:
- Incident commander and technical lead
- Legal counsel and privacy or compliance lead
- Communications lead and executive sponsor
- Infrastructure and backup owners
- Cyber insurer and law-enforcement liaison
Require primary and alternate contacts, after-hours numbers, delegation rules, and explicit authority for disruptive actions like isolating production systems or disabling accounts. Out-of-date contact lists are among the most common gaps DeepSeas finds in readiness work.
Document the environment and dependencies
Responders cannot decide what to isolate or restore first without a map. Include fields for:
- Business-critical applications, identity systems, and domain controllers
- File shares, cloud workloads, and remote access services
- Backup repositories, OT, mobile devices, and third-party dependencies
For each, record the owner, network segment, recovery priority, business impact, and data sensitivity. If you run OT, treat safety and process continuity as separate decision gates. CISA's OT ransomware fact sheet calls for testing manual workarounds in case ICS must be cut off from IT.
Predefine evidence, legal, and decision gates
Add instructions to switch to out-of-band communications, preserve logs and volatile evidence, contact counsel, engage the cyber insurer, and record chain of custody.
Then create approval gates for:
- Ransom discussions
- Regulator or customer notifications
- Forensic collection
- Privileged credential resets
- System shutdowns
- Restoration from backups
Validate legal requirements with qualified counsel. The playbook organizes decisions; it does not replace legal advice.
Connect the playbook to tools and safe automation
Map each action to your EDR, SIEM, identity, network, backup, ticketing, and collaboration tools. Vendor choice doesn't matter, as long as the mapping exists.
Separate low-risk automation (alert enrichment, case creation) from actions needing human approval (isolating a critical production system, disabling a broad identity group). DeepSeas MDR follows this model: it recommends actions, the customer approves, and it never auto-isolates a production line or medical device.
How to use the playbook during an active ransomware incident
Confirm the incident and activate the case
Work through a fixed sequence:
- Validate indicators and rule out false positives
- Declare severity and open the incident record
- Assign the commander and notify the team
Capture the initial timestamp plus:
- Affected systems and indicators
- Business impact and unknowns
- The next decision checkpoint
Contain spread while preserving evidence
CISA's guidance is to identify affected systems and isolate them immediately, using out-of-band channels. Power down only when disconnection is impossible, because shutdown destroys volatile evidence.
Caution: Coordinate any shutdown, restart, reimaging, or deletion with the technical and forensic leads. Evidence may be needed for investigation, insurance, or legal purposes.
Containment actions include:
- Endpoint isolation
- Network path restrictions
- Compromised account lockout
- Protection of backup infrastructure
In the Trigona case, the DeepSeas SOC alerted immediately and all four infected devices were quarantined, even though the attacker had reached three domain controllers.
Scope the blast radius
Correlate endpoint, network, identity, cloud, email, and authentication logs to find patient zero, persistence, data access, and possible exfiltration. Keep an indicator worksheet with:
- Hostnames, accounts, and file hashes
- Processes, domains, and IP addresses
- Ransom note details and suspicious tools
- Affected data repositories
Eradicate persistence and close the access path
Review these areas for leftover access:
- Privileged and service accounts
- Scheduled tasks and registry changes
- Remote access tools, cloud tokens, and email rules
The Trigona intrusion shows why. The attacker created an "ITadmin" account, installed AnyDesk, disabled MFA, and scheduled hourly log clearing.
Set criteria for sanitizing versus rebuilding. CISA advises rebuilding from standard images and addressing compromised credentials before reconnecting anything. Confirm the original access path is closed before recovery starts.
Keep a timeline, decision log, and status report
The scribe records timestamps, actions, owners, approvals, evidence locations, and reasons for changing course. Each status report should state:
- What is known and what is unknown
- What is underway
- What decisions are needed
- When the next update arrives
Recovery, communications, legal, and post-incident templates
Establish recovery gates
Nothing reconnects until the checklist is complete:
- Verified clean backups
- Rebuilt or validated systems
- Patched vulnerabilities and rotated credentials
- Active monitoring
- Approved network access
- Business-owner signoff
Restore by business priority and dependency. After each stage, validate data integrity, application function, security telemetry, and signs of reinfection. Sophos reports that in the US, 53% of victims fully recovered within a week, with a mean recovery cost of $2.51M excluding ransom.
Build a ransom and decryption decision record
The template should compare:
- Recovery options and business interruption
- Exfiltration risk and legal exposure
- Insurance requirements and sanctions screening
- Law-enforcement input
- Legitimate decryption resources
The FBI does not support paying ransoms, and payment does not guarantee recovery. OFAC warns that payments involving sanctioned parties can create civil liability. Don't hard-code a universal answer. Require executive, legal, insurance, and technical review, and check current guidance each time.
Add US reporting workflows
Deadlines run on separate clocks. Don't merge them into one countdown.
| Regime | Trigger and deadline |
|---|---|
| SEC Form 8-K Item 1.05 | Four business days after a materiality determination |
| HIPAA breach notification | Without unreasonable delay, no later than 60 days after discovery |
| FTC GLBA Safeguards Rule | 500+ consumers; FTC notice within 30 days of discovery |
| NYDFS Part 500 | 72 hours after determining a qualifying incident |
| CIRCIA | Final rule pending; proposed 72 hours for incidents, 24 hours for payments |
Also track FBI IC3 and CISA reporting, state breach laws, and contractual duties. For each regime, log:
- Discovery time and deadline
- Jurisdictions and data categories
- Counsel approval
- Regulator contact and submission status
Prepare communication templates
Draft separate versions for:
- Employees, executives, and the board
- Customers and partners
- Regulators, insurers, and law enforcement
- Media holding statements and closure notices
Every message should:
- Name an authorized spokesperson
- Avoid unsupported conclusions
- Protect investigative details
- Tell recipients what to do
- Record legal or executive approval
Complete the post-incident review
Use a blameless format covering:
- Attack path, detection, and containment
- Eradication and recovery
- Communications and decision quality
- Evidence handling and external coordination
Add a remediation register with risk priority, owner, deadline, budget or dependency, validation method, and the playbook section to update. Track time to detect, contain, and restore, but set targets from your own baselines and exercise results.
How to test, maintain, and operationalize the playbook
Validate through exercises and restoration drills
Progress in stages:
- Document walkthroughs
- Tabletop exercises (CISA publishes a ransomware tabletop package)
- Technical simulations and backup restoration tests
- Communications drills
- Controlled adversary emulation
A tabletop tests decisions. A restore test tests equipment and people. You need both. Record what fails during the exercise, then assign each item a remediation owner:
- Participant decisions and unclear instructions
- Missing contacts and unavailable tools
- Unsafe automation and recovery blockers
Maintain version control
Assign a playbook owner and track version, approval date, review date, change history, and distribution list. Update after incidents, exercises, major infrastructure or personnel changes, new suppliers, and regulatory changes.
NIST recommends periodic testing but sets no universal frequency. Where NYDFS applies, annual exercises are required.
Run a short quarterly check:
- Contacts answer
- Asset inventory is current
- Backups restore
- Procedures match your tools
- Alternates can run the workflow
Address 24/7 coverage
If you lack a round-the-clock SOC, pair the playbook with managed detection and response. DeepSeas provides customizable MDR and CyberFusion SOC coverage that works inside your existing tools. Clients set what analysts may do, from containment to full response.
External support still has to fit your roles, approvals, and escalation paths, so write it into the RACI.
Frequently Asked Questions
What is a ransomware incident response playbook template?
It is a customizable, scenario-specific document that holds triggers, roles, response steps, decision points, communications, evidence requirements, and recovery procedures for ransomware incidents.
What should a ransomware incident response playbook include?
A complete playbook covers preparation, detection, containment, evidence preservation, eradication, recovery, legal and communications workflows, decision logs, contacts, and post-incident improvement steps.
What should you do first when ransomware is detected?
Confirm the incident and activate the playbook, then isolate affected systems, switch to out-of-band communications, preserve evidence, protect backups, and escalate to the response team.
How should a ransomware playbook handle backup recovery?
Verify backups are clean and recoverable, restore in priority order within a controlled environment, and complete monitoring and validation before reconnecting anything.
Should an organization pay a ransomware demand?
Payment is a legal, operational, financial, insurance, and sanctions decision with no guarantee of recovery or data deletion. Involve counsel, insurers, executives, and law enforcement.
How often should a ransomware playbook be tested and updated?
Review after incidents, exercises, technology or personnel changes, and regulatory changes. Run recurring tabletop, restoration, and technical exercises based on your risk.
