IR Exercise — Ransomware Scenario
78%
Communication
85%
Decision Making
72%
Escalation
68%
Procedures
88%
AI FacilitatorFACILITATOR2:47 PM
INJECT: Your SOC has detected unusual outbound traffic from the payment processing server.
Sarah MitchellINCIDENT COMMANDER2:49 PM
First priority is containment. Isolate the payment server immediately. Pulling in Legal and Comms now.
AI FacilitatorFACILITATOR2:49 PM
Good call on containment. James, as Comms Lead, what channels are you preparing?
James RiveraCOMMS LEAD2:51 PM
Drafting internal holding statement now. Will have external comms ready within 30 minutes.
Improve escalation timing for legal notification
NIST SP 800-61Legal was notified 12 minutes after containment. Target notification within 5 minutes of confirmed data exposure.
Establish pre-drafted holding statements
SANS IRCommunications team did not have pre-approved templates available. Pre-draft statements for top 3 scenario types.
Formalize evidence preservation checklist
ISO 27035No explicit evidence preservation step was triggered. Add forensic hold checklist to incident playbook.