Responding to a security incident

Objectives

• Set up a crisis team and its roles
• Take the first actions without destroying evidence
• Meet your notification obligations

Programme

1. Anatomy of a ransomware attack
2. The first hours: isolate, preserve, alert
3. Internal and external communication, notifications to the authorities (data protection authority, national cybersecurity agency)
4. Business recovery and lessons learned
5. Tabletop crisis exercise