Situation
A mid-sized organization has cyber insurance, endpoint protection, backups, and an incident response document. The plan has not been exercised recently. Contact lists are scattered, backup administrators use the same identity system as everyday users, and the team is unsure who can authorize isolation of a critical system after hours.
Approach
- Review the incident plan, escalation paths, insurer and counsel notification conditions, technical dependencies, and available out-of-band communications.
- Map the first hours of a ransomware scenario, including who declares an incident and who may isolate systems.
- Examine whether backup administration, privileged access, and recovery documentation remain usable if the primary identity environment is unavailable.
- Facilitate a tabletop exercise using injects that test decisions rather than trivia.
- Capture gaps, owners, target dates, and evidence needed to close each action.
Validation
- An incident-readiness review reduces uncertainty but cannot guarantee prevention, detection, containment, recovery time, insurance coverage, or legal compliance.
- Any conclusions would be limited to the approved scope, the evidence available, and the conditions at the time of review.
- The organization would review factual accuracy, own production decisions, and approve any risk acceptance or implementation work.