Advanced · Self-paced learning
Inquiry This course is not yet bookable.
In the case, attackers claim to have stolen data and set a short deadline. Decide who preserves evidence and secures access, which specialists check the claim and what information senior management needs by when. If the deadline expires before further findings arrive, revise your procedure and identify the remaining uncertainty. You can use your completed version to prepare your own area.
The course does not provide incident response, negotiation, forensic services or individual legal advice. Payment decisions and possible reporting duties require separate assessment in the relevant jurisdiction.
Your ransomware working pack covers initial actions, specialist contacts, claim checks and escalation routes. Use it to prepare for and update an extortion incident.
Basic familiarity with organisational crisis or information security processes. For preparation in your own area, an overview of critical services and access to relevant decision roles are sufficient. A substitute case allows completion without sensitive information.
Planned as four to five hours of self-study with staged case decisions and self-checks with explanations.
Planned learning time: 4–5 hours
