First 15 minutes of a ransomware event

Overview

The opening quarter-hour sets containment quality and legal defensibility. Assume breach is active until network data proves otherwise.

Minute 0–5

• Designate incident commander (voice + deputy); open war room channel with legal/PR on standby per policy.
• Preserve: snapshot SIEM time, note who was notified, avoid mass password resets before scope known (can alert actors).
• Isolate highest-risk assets first: DCs with unusual auth, backup consoles, RMM, VPN concentrators.

Minute 5–15

• Disable compromised accounts identified from alerts; block IOC IPs/domains at perimeter if playbook allows.
• Snapshot or power-separate one suspect host for memory if forensics retainer exists—do not reboot casually.
• Inventory backup consoles: are they reachable from compromised VLANs? Air-gap management if needed.

Communications

Internal “no speculation” rule; single spokesperson to executives. Log decisions with timestamps.

Pitfalls

Mass GPO disable security panic; paying ransom without counsel; deleting logs to “reduce noise.”

Handoff

After 15 minutes, shift to structured runbook phase—containment checklist owner + evidence preservation SOP.