PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchA ransomware playbook should make the first decisions predictable: who coordinates, which systems matter most, how to contain the intrusion, and how to restore services without bringing the attacker back in. Build and exercise those decisions before an incident; during one, use a disciplined sequence that protects people and services, preserves evidence, and keeps recovery separate from compromised systems.
What to put in place before an incident
Preparation is what lets responders act quickly without improvising priorities, authority, or communications. The joint CISA, FBI, NSA, and MS-ISAC #StopRansomware Guide recommends preparing for incidents as well as preventing them. Its revision is dated October 19, 2023; CISA lists that date on the guide publication page.
As an Amazon Associate I earn from qualifying purchases.
Know what you have and what must come back first
- Maintain an inventory of physical and logical IT assets, including systems, accounts, and services that support health and safety, revenue, or other critical operations. Protect the inventory and keep a useful offline copy.
- Map dependencies: a service may rely on identity, network, cloud, data, or third-party systems that also need to be restored. Record these relationships alongside the inventory.
- Set restoration priorities in advance with business and service owners. Define what counts as an acceptable recovery point and recovery time for each critical service, then ensure the dependencies and staff needed to meet those goals are available.
Make the response plan usable under pressure
- Approve, distribute, and exercise an incident-response plan and a communications plan. Specify internal escalation, decision authority, public-communications approval, and who prepares holding statements.
- Maintain a contact sheet for IT and security responders, executives, outside service providers, the insurer, law enforcement, and relevant government response organizations. Include a way to reach key people if corporate email or collaboration tools are unavailable.
- Plan for coordinated, out-of-band communications if attackers may be monitoring organizational systems. Keep the contact sheet and essential response procedures accessible without relying on the affected environment.
- Use tabletop exercises and technical recovery exercises to test both decisions and execution. CISA identifies exercise resources as part of its preparation guidance; sector information-sharing organizations can also help teams practice coordination.
Prove that backups and rebuild materials are usable
- Keep offline, encrypted backups of critical information. Test their availability, integrity, and restoration steps regularly in a disaster-recovery scenario; a backup that exists but cannot be restored is not a recovery capability.
- Maintain suitable system images or golden images, templates, required software, source code, and relevant license or escrow materials. Keep the materials current enough to rebuild on available hardware or platforms.
- Design backup isolation so a compromise of production credentials or accounts does not automatically expose recovery copies. Include cloud services in the design and establish which recovery duties belong to your organization under the applicable shared-responsibility arrangements.
- Measure restore time and integrity during exercises, and compare results with service priorities and recovery-point needs. Choose an approach that fits staffing capacity, retention needs, dependencies, and the ability to keep the recovery environment clean; there is no single backup design that suits every organization.
Retain visibility and limit unnecessary access
- Apply least privilege and access controls, secure exposed services and identities, and understand the security boundaries of cloud services and providers.
- Retain useful system, network, endpoint, and cloud logs. CISA recommends keeping and backing up logs for critical systems for a minimum of one year, if possible; that is guidance, not a universal legal retention rule.
- Confirm that responders can access logs and security tools when production systems or standard accounts are unavailable. Include log preservation and retrieval in exercises.
What to do immediately after ransomware is detected
Start with containment, then establish the scope and restoration priorities. CISA’s checklist begins: “Determine which systems were impacted, and immediately isolate them.” Follow the organization’s approved plan, and avoid assuming that the visible ransom note identifies every affected system or the start of the intrusion.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Activate the response structure. Notify the designated incident lead and technical responders using the approved channels. If those channels may be monitored or unavailable, switch to the out-of-band method in the plan.
- Identify and isolate affected systems. Disconnect affected devices or otherwise isolate them using the organization’s established procedures. If multiple systems or subnets are involved, network-level isolation may be more workable than handling each device individually. Coordinate changes so responders do not inadvertently expose response actions.
- Triage service impact and recovery order. Identify which systems support critical services, what dependencies are affected, and which services need attention first. Use the priorities and dependency information prepared before the incident.
- Review detections and logs for a wider intrusion. Examine endpoint and network security tools and available logs for additional affected systems, precursor malware, and signs of earlier compromise. Treat the encryption event as a possible stage in a longer intrusion rather than proof that the incident is limited to the systems showing a ransom note.
Do not rush to wipe or rebuild affected systems before responders have considered evidence preservation. At the same time, containment and safety needs may require immediate action; the incident lead should coordinate those trade-offs with technical responders and follow the organization’s plan.
How to preserve evidence while containing the attack
Evidence can help establish how the attacker gained access, what was affected, and whether access remains. Preserve it in coordination with incident responders and, where appropriate, law enforcement. Prioritize information that may disappear or be overwritten, especially volatile evidence.
- Capture memory and short-retention logs when feasible, and preserve relevant system images, security logs, network records, malware samples, and indicators of compromise.
- Record affected assets, accounts, observed activity, containment actions, and key decisions with timestamps. Keep records in a location that is not dependent on compromised systems.
- Identify compromised accounts and access routes, including email accounts, and contain them in coordination with the response team. Consider related access paths rather than disabling only the account or device first noticed.
- Use trusted, variant-specific guidance when available. The CISA, FBI, and Australian Cyber Security Centre advisory on Play ransomware is an example of threat-specific guidance, not a universal incident recipe. It recommends MFA, particularly for webmail, VPN, and critical-system accounts, offline backups, and prompt reporting; check current advisories during a live incident because tactics and indicators can change.
Who to notify and when
Use the approved response and communications plans to notify technical responders, organizational leadership, service providers, insurers, and other stakeholders. Coordinate public statements through the authority defined in the plan; a holding statement can acknowledge an incident without speculating about cause, scope, or data exposure before those facts are established.
Assess whether data was exposed and what breach-notification duties apply. Requirements depend on jurisdiction, sector, contracts, and the facts of the incident, so involve the appropriate legal and privacy specialists rather than treating a general playbook as a statement of law.
Free tools Windows power users keep installed
One-click scans. No signup required.
For U.S. organizations, the joint CISA guide recommends reporting to or seeking assistance from CISA, a local FBI field office, the FBI Internet Crime Complaint Center (IC3), or a local U.S. Secret Service field office. These contacts are U.S.-specific; organizations elsewhere should use the relevant national and local authorities and established sector channels.
How to restore systems safely
Restore in the order established for critical services, but only through a recovery path that is separated from compromised systems. The CISA guide recommends restoration from offline, encrypted backups and emphasizes preventing compromised systems from contaminating clean recovery systems.
- Establish a clean recovery environment. Keep affected systems out of the recovery network. Confirm that the systems, credentials, and management tools used to rebuild are trusted and that the environment is appropriately separated from compromised infrastructure.
- Rebuild and restore by service priority. Use clean system images or rebuild materials and the offline backups selected for the affected services. Follow dependency order as well as business priority so a restored service is not relying on a compromised upstream component.
- Validate before reconnecting. Check restored systems for signs of compromise and confirm they are clean before reconnecting them to production or making them available to users. Coordinate the transition with responders and service owners.
- Reconnect in a controlled way. Restore access and service dependencies in a planned order, monitoring available security tools and logs as systems return. If suspicious activity reappears, isolate the affected systems and reassess the scope rather than continuing the rollout.
Recovery planning should account for how long restores actually take in exercises, the integrity of recovered data, available hardware or platforms, staff capacity, cloud responsibilities, and service dependencies. These factors determine whether a backup approach can meet the organization’s needs; the guide does not prescribe a particular vendor or a universal recovery design.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Close the incident and improve the playbook
After services are recovered, document decisions, gaps, and lessons while the response is still fresh. Update the incident-response and communications plans, inventory, recovery priorities, contact sheet, and technical procedures as needed. Consider sharing useful indicators and lessons with CISA or a sector information-sharing organization where appropriate.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →For a framework-level view of ransomware risk management, NIST lists NIST IR 8374 Revision 1: Ransomware Risk Management, a CSF 2.0 Community Profile as final and dated June 11, 2026. It complements operational response procedures with a current risk-management framing.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
