performing-ransomware-response

Executes a structured ransomware incident response from detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening, covering ransom negotiation, backup integrity verification, and regulatory notification. Use when actively responding to a ransomware outbreak or crypto-ransomware infection, or deciding on ransom payment and containment steps.