This phase will help you develop the necessary incident response management workflows that also include disaster recovery as a necessary component to mitigate the impact of a ransomware incident. This phase will take you through the following activities:
- Understand the incident management process for handling ransomware.
- Run a tabletop exercise to determine current workflows and gaps in the incident management process.
- Document and prioritize desired features of future state in an initiative list.
- Document runbooks for ransomware response.
Use this phase as part of the full blueprint, Create a Disaster-Ready Ransomware Recovery Plan.