Ransomware Recovery Playbook Aligned to ISO 22301

Playbook Phases

1. Detect & triage — confirm ransomware indicators via SIEM/EDR; freeze uncontrolled “fixes”
2. Contain — isolate affected segments; protect backups and admin planes
3. Activate continuity — BCP workarounds for priority activities from the BIA
4. Recover — rebuild from known-good media; validate integrity before reconnect
5. Communicate — executives, customers, regulators, law enforcement as required
6. Improve — lessons learned into plans, controls, and exercises

Minimum Playbook Contents

• Decision tree for BCP activation vs IT-only recovery
• Out-of-band contact methods (assume email/SSO impaired)
• Backup inventory, immutability status, restore order
• Clean-room / rebuild standards
• Legal / ransom decision escalation (policy-owned, not improvised)
• Exercise schedule referencing clause 8.5

How CyberSilo Helps

• BCMS programme artefacts — BIA, plans, exercise records — organised in Compliance Standards Automation
• ThreatHawk SIEM / SOAR for detection, response evidence, and ICT continuity telemetry during disruption
• Advisory scoping for certification readiness — contact CyberSilo

Frequently Asked Questions

Should we pay the ransom?

That is a legal, insurance, and executive decision outside this technical playbook. Pre-define escalation paths before an incident — do not create them mid-crisis.

Is restoring from backup the whole plan?

No. Containment, business workarounds, communications, and malware-free rebuild are equally critical.

How often should we exercise ransomware recovery?

Set a risk-based schedule under clause 8.5. Include both tabletop decision-making and technical restore tests.

Related ISO 22301 Resources

ThreatHawk SIEM + SOAR · DR template · Hub