Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A useful ransomware response plan is an approved, offline-accessible playbook that tells people who makes decisions, which systems matter most, how to isolate an attack, whom to contact, what evidence to preserve, how to meet notification duties, and how to restore clean operations. Build it with offline encrypted backups, test those backups in realistic recovery exercises, and rehearse the plan with executives, IT, security, legal advisers, insurers, and critical service providers before an incident.
The guidance below follows the joint CISA, MS-ISAC, FBI, and NSA #StopRansomware Guide (September 2023). It is broad U.S. planning guidance, not legal advice; notification duties still depend on your jurisdictions, sector, data, contracts, and the facts of the incident.
What a ransomware response plan must accomplish
Ransomware can make files, applications, identity systems, and entire networks unavailable while responders are still trying to determine whether data was stolen. A plan reduces that uncertainty by assigning authority and giving teams a safe sequence to follow. It should cover both ransomware encryption and data-extortion or breach scenarios, because an organization may face operational disruption, privacy obligations, or both.
Put the plan in writing, obtain formal approval from the CEO or equivalent, make sure the organization understands its role, and keep a copy available when email, file shares, single sign-on, or other normal tools cannot be used. Store protected offline or hard-copy versions of the plan, contact lists, network diagrams, asset priorities, recovery instructions, and relevant contracts.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
The joint federal guide describes the goal this way: “Create, maintain, and regularly exercise a basic cyber incident response plan (IRP) and associated communications plan that includes response and notification procedures for ransomware and data extortion/breach incidents.” Treat that as a minimum baseline rather than a complete plan for every organization.
1. Establish decision authority and named roles
During an attack, delays often come from uncertainty about who can disconnect systems, shut down a service, notify customers, or authorize emergency spending. Name a primary and alternate for every critical role, and document how authority transfers if someone is unavailable.
Core roles to assign
- Incident lead: owns the incident process, convenes the response team, sets priorities, and records major decisions.
- Technical response lead: coordinates security, infrastructure, identity, endpoint, cloud, and application teams.
- Isolation authority: can approve disconnecting hosts, segments, accounts, remote-access paths, or services when delay would increase harm.
- Business and recovery leads: identify essential services, approve restoration order, and coordinate workarounds for staff and customers.
- Legal and privacy adviser: evaluates breach, contractual, employment, sector, and jurisdiction-specific duties.
- Communications lead: prepares internal messages, customer or partner notices, media responses, and executive updates.
- Evidence and records custodian: maintains the incident log and coordinates preservation of images, memory captures, logs, and malware samples with qualified responders.
- Executive sponsor: resolves business trade-offs, approves major risk decisions, and keeps the board or governing body informed as appropriate.
Document who can activate the plan, who can declare a major incident, who may contact law enforcement or government agencies, and who may approve an emergency service or forensic engagement. Include after-hours numbers and a backup communication method for each person. CISA recommends written executive approval and senior-leadership participation in exercises, not merely technical-team sign-off.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsUse an authority matrix
| Decision | Primary authority | Required consultation | Offline record |
|---|---|---|---|
| Activate the response plan | Incident lead or designated executive | Technical and business leads | Activation criteria and call tree |
| Isolate systems or network segments | Named isolation authority | Technical lead and affected service owner | Approved isolation options and safety constraints |
| Engage external responders | Executive sponsor or delegated incident lead | Legal, insurer, procurement as required | Retainer, policy, and escalation contacts |
| Issue external statements | Communications lead under executive approval | Legal and privacy advisers | Message approval path and holding statements |
| Restore a critical service | Recovery lead and service owner | Technical, security, and business leads | Restoration order and acceptance tests |
2. Map systems, data, dependencies, and business priorities
You cannot choose a safe isolation or restoration order if you do not know what the organization runs. Maintain an inventory of endpoints, servers, network devices, cloud workloads, identity systems, SaaS services, operational technology where relevant, backup infrastructure, and third-party connections. Record owners, locations, administrative accounts, support contracts, and recovery prerequisites.
Capture dependencies, not just asset names
For each critical service, document the applications, databases, authentication systems, DNS, certificates, network paths, integrations, licenses, hardware, software images, and vendor access it needs. A payroll application, for example, may depend on identity, a database cluster, file storage, a time service, and an external payroll connection. Restoring only its files would not make it usable.
Identify which systems support health and safety, revenue, legal obligations, customer commitments, or other essential services. Assign a business owner and a maximum tolerable outage or recovery target where your organization already uses those measures. If formal targets do not exist, use a plain-language priority such as “life-safety,” “essential operations,” “customer-facing,” or “administrative.”
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
Protect the documentation
- Keep current network diagrams, IP ranges, trust relationships, cloud accounts, remote-access paths, and segmentation information offline or in hard copy.
- Store an offline asset list with system owners, criticality, dependencies, and recovery prerequisites.
- Record where clean installation media, system images, licenses, configuration backups, and spare hardware are held.
- Keep emergency contact details separate from the identity and email systems most likely to be unavailable.
- Limit access to sensitive diagrams and credentials, but ensure the response team can obtain them during an outage.
Update the inventory whenever a major system, provider, network connection, or business process changes. An old diagram can be more dangerous than no diagram if it causes responders to isolate the wrong service.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute3. Build a recovery design that ransomware cannot easily destroy
Maintain offline, encrypted backups of critical data and regularly test both their availability and integrity. A backup that remains continuously reachable from production may be deleted or encrypted by the same attacker. “Offline” means the copy is not accessible through the normal compromised accounts, networks, or management plane during an attack.
What to include in the backup scope
- Business data, databases, file shares, and configuration data.
- Identity, directory, and access-control information needed to rebuild accounts safely.
- Application binaries, operating-system images, infrastructure-as-code or configuration exports, and license information.
- Cloud workloads, SaaS export data, encryption keys, certificates, and recovery credentials, stored under a separate access path.
- Documentation describing dependencies, restoration order, validation tests, and required hardware or capacity.
Keep encryption keys and backup administration separate from ordinary production credentials. Use more than one recovery path so a single compromised account, tenant, or management environment cannot remove every copy. Apply retention that covers the time an intrusion might remain undetected, while meeting your legal, contractual, and operational requirements.
Compare backup approaches against recovery needs
| Criterion | Questions to answer | Evidence to retain |
|---|---|---|
| Isolation | Can ransomware reach, delete, or alter the copy through production credentials or networks? | Access design, network controls, and an offline access procedure |
| Encryption | Are copies encrypted in transit and at rest, and are keys protected separately? | Key-management ownership and recovery instructions |
| Restore speed | How long does it take to obtain capacity, rebuild dependencies, and return a service to operation? | Timed restoration records |
| Integrity | Can you verify that files, databases, images, and configurations are complete and unaltered? | Checks, validation results, and clean restore logs |
| Coverage | Does the design include applications, identity, cloud services, licenses, and hardware—not only user files? | Scope map tied to the asset inventory |
| Resilience | Would one compromised account, site, provider, or environment eliminate every copy? | Separation and failure-test results |
| Capacity and retention | Can the organization retain enough historical versions and restore them at the required scale? | Capacity calculations and retention policy |
Immutable storage can help prevent modification, but it is not automatically the right answer for every organization. It may introduce configuration, access, capacity, or compliance costs. Evaluate it alongside isolation, encryption, testing, and operational recovery rather than treating the label as proof of recoverability.
Test an actual recovery
- Select a critical service and define what “usable” means: successful login, correct data, required integrations, security controls, and business-owner acceptance.
- Retrieve the backup through the emergency process, without relying on the production identity system or normal network path.
- Restore the operating system, application, data, identity dependencies, licenses, certificates, and configuration needed for the service.
- Validate integrity and functionality with technical checks and a business-owner acceptance test.
- Record elapsed time, missing prerequisites, capacity limits, errors, and manual workarounds.
- Correct the gaps, update the recovery documentation, and repeat at a frequency appropriate to the service’s criticality and change rate.
A successful file download is not a successful recovery test. The test must demonstrate that a clean environment can be rebuilt and operated in the order your business requires.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Write the communications and notification workflow
Prepare messages and approval paths before an incident, when there is time to choose precise language. Decide what information may be shared, who may share it, which audiences need updates, and how to communicate if corporate email, phones, collaboration tools, or customer portals are unavailable.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Maintain a contact and escalation list
- Executives, board or governing-body contacts, IT, security, facilities, business owners, human resources, privacy, legal, and communications.
- Incident-response and forensic providers, managed service providers, cloud and software vendors, telecommunications providers, and critical suppliers.
- Cyber-insurance contacts and any required breach-coordination service.
- Law enforcement, relevant government reporting channels, and sector contacts where appropriate.
- Alternate numbers, secure out-of-band channels, and physical meeting locations.
Print or export the list and review it regularly. Do not assume that a directory inside the compromised environment will be available.
Set message rules
Use a short internal holding message that tells staff how to report symptoms, which systems to stop using, and where official updates will appear. Prepare executive updates that separate confirmed facts, working hypotheses, business impact, decisions needed, and next review time. External statements should be coordinated through communications and legal advisers; employees, customers, partners, and regulators should not receive conflicting accounts from different teams.
Notification requirements are not universal. They depend on jurisdiction, data type, sector rules, contractual commitments, and whether information was accessed or exfiltrated. Have counsel map those obligations before an incident, including who must make each notification, what evidence is needed, and how timing is calculated. Do not place one generic deadline in the plan.
Recommended Free Tools
5. Define the first-response workflow
The plan should give responders prompts, not replace qualified incident-response judgment. During a real event, follow the approved plan and the advice of the designated technical and legal responders.
- Recognize and report: Tell staff how to report ransom notes, unusual encryption, disabled security tools, suspicious logins, or unavailable files. Record the time, reporter, affected location, and visible symptoms.
- Activate and log: The incident lead activates the team, opens an incident log, establishes an out-of-band channel, and records decisions, approvals, times, and people involved.
- Determine scope: Identify affected hosts, accounts, subnets, cloud services, applications, and signs of data access. Treat scope as uncertain until responders have evidence.
- Isolate safely: Disconnect affected systems or segments using approved procedures. If many systems or subnets are involved, network-level isolation may be necessary. Consider operational and safety effects before cutting services.
- Protect evidence: Where feasible, preserve relevant system images, memory, logs, authentication records, and malware samples. Coordinate collection with qualified responders so evidence is not destroyed by hurried cleanup.
- Notify and coordinate: Contact leadership, legal advisers, insurers, service providers, and authorities through the established workflow. Assess reporting to CISA or law enforcement and any applicable breach notifications.
- Contain and eradicate: Remove the intrusion and close persistence or access paths under responder guidance. Do not restore systems that have not been assessed as clean.
- Restore in priority order: Rebuild clean systems from offline encrypted backups, restoring dependencies and validating each service with its owner.
- Monitor and learn: Watch restored environments for renewed compromise, document the timeline and decisions, and assign corrective actions after service is stable.
Keep a complete incident checklist with the plan so responders can follow the same sequence under stress. It should include safety constraints, evidence-handling instructions, escalation thresholds, and the location of offline records.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Exercise the plan with leadership and providers
A written plan is only credible after people have used it. Run a tabletop or spoken walkthrough involving IT and security, senior management, business owners, legal and communications, and the providers who would actually be called. CISA publishes ransomware tabletop scenarios and exercise resources that can help structure the discussion.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Use a realistic scenario
Start with a believable event: several systems are unavailable, the scope is unclear, a ransom note appears, and there are indications that data may have been copied. Add complications such as an unavailable identity service, competing restoration priorities, a critical supplier that cannot be reached, or conflicting demands for a public statement.
Test decisions, not just knowledge
- Who has authority to isolate a network segment, and what safety checks are required?
- Can the team reach every contact without corporate email or single sign-on?
- How will executives approve an external responder, emergency purchase, or customer message?
- What evidence will be preserved, by whom, and where will it be stored?
- Which service is restored first, and what dependencies make that order workable?
- What facts would trigger legal, contractual, sector, or government notifications?
Record every gap as an owner-assigned action with a due date. Update the plan, diagrams, contact list, backup scope, and training based on the exercise. Senior leaders should participate because restoration priorities, risk acceptance, and public communications are business decisions, not only technical ones.
7. Decide when to use an external response provider
Organizations without sufficient in-house capacity may arrange an incident-response retainer or managed security and response service before an attack. This is an implementation option, not a substitute for internal authority, backups, or exercises.
Compare providers on ransomware experience, coverage hours, scope and deliverables, escalation path, evidence handling, recovery support, references, and contract terms. Confirm who owns collected evidence, how quickly the provider can begin, what is excluded, how communications are coordinated with counsel and an insurer, and whether restoration assistance is included or separately priced. Put the provider’s contacts and activation conditions in the offline plan, and invite the provider to a tabletop.
8. Maintain the plan as an operational document
Assign an owner for the plan and set review triggers. Review it after every exercise, incident, major technology change, provider change, acquisition, network redesign, or regulatory change. At each review:
- Call every primary and alternate contact and remove stale entries.
- Reconcile the asset inventory and dependency map with actual production systems.
- Confirm that offline copies can be reached without compromised credentials or networks.
- Check that backup tests include integrity, dependencies, capacity, and business acceptance.
- Verify that clean images, licenses, keys, hardware, and emergency procedures are still usable.
- Ask legal and privacy advisers to reconfirm jurisdiction- and sector-specific notification requirements.
- Ensure executives know their approval duties and that staff know how to report a suspected incident.
Version each release, record its approval date, and retire obsolete printed copies. Keep the current plan, recovery information, and contact list in more than one protected offline location.
Quick Recap
Ransomware readiness checklist
- Written plan approved by the CEO or equivalent.
- Named incident lead, alternates, technical, legal, communications, evidence, business, and executive roles.
- Offline copies of the plan, contacts, diagrams, asset priorities, and recovery instructions.
- Current inventory of systems, data, dependencies, third-party access, and cloud connections.
- Offline encrypted backups protected from production credentials and networks.
- Documented retention, capacity, keys, clean images, licenses, hardware, and restoration prerequisites.
- Regular restore tests proving availability, integrity, speed, and business usability.
- Isolation procedures for individual hosts, accounts, services, and network segments.
- Evidence-preservation and incident-log procedures coordinated with qualified responders.
- Internal, external, insurer, provider, law-enforcement, and government contacts with out-of-band alternatives.
- Legal notification matrix tailored to jurisdictions, data, sector, and contracts.
- Tabletop exercises involving leadership and relevant providers, with tracked corrective actions.
- Scheduled reviews after exercises, incidents, and major environmental changes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
