Get your organisation ready for ransomware, and know what to do in the first hour
For operations, IT and practice leaders in 20 to 500 person organisations: a working 26-sheet workbook, 5 fillable forms, brand-ready plan and message templates, three tabletop scenarios and an e-book that follows one firm from 'could that be us?' through a real incident and its review.
- A 26-sheet workbook: 0-4 self-assessment, ranked gap plan, recovery register with restore checks, timeline, evidence register, notification tracker and a dashboard with five charts
- A 13-section incident response plan and ransomware playbook, a backup and recovery standard and a leadership sign-off memo
- 5 fillable forms for the first hour, notification decisions, a ransom demand, restore tests and the after-action review
- 32 messages, 26 AI prompts, three tabletop scenarios and a 14-question LMS-ready knowledge check
The Ransomware and Cyber Incident Response Playbook · Bodhih Pro Kits · 322 by Bodhih Training, trainers to 2,000+ companies since 2008.
How should a small or mid-size organisation prepare for and respond to ransomware?
Prepare first: name a team with deputies and an out-of-band contact list, keep an immutable or offline backup and time your restores. On the night, disconnect without powering off, call your insurer and forensics, preserve evidence, track every notification clock with counsel and review afterwards. Bodhih Training's Ransomware and Cyber Incident Response Playbook gives you each file.
Want the full free guide first? Read How to respond to ransomware: a plan for small and mid-size firms.
You already feel the problem. Here is what it is costing you.
Nobody knows who to call at 3 a.m.
The IT provider's after-hours number is in a contract appendix, the plan is on the server that just got encrypted, and the decision-maker's phone is on silent.
Backups exist, but nobody has timed a restore
You know there are backups. You do not know if the attacker can reach them, how long a restore takes, or what to bring back first.
The legal clocks start before you know the facts
Personal data may be involved, clients have notice clauses and the insurer has conditions. You need a way to track every party and every clock with counsel.
The ransom question arrives with a deadline
Someone will ask whether to pay. You need the questions, the advice and the decision recorded, not a debate at midnight.
Picture the next few weeks with the kit open beside you.
Imagine the night it happens. The on-call phone rings at 2:22. Within twenty minutes the incident lead has declared a severity, the team is on an out-of-band group, and the affected servers are disconnected but still running, so the evidence is intact.
By dawn the insurer has a claim reference, forensics is connected, staff have a text telling them not to log in and when the next update comes, and the scribe's timeline already reads like a report.
As you open the Notifications sheet the next morning, every party is already a row: the insurer, the clients with notice clauses, the regulator. Counsel confirms the clocks; you track them to MET.
Whether you start with the Business Case Calculator tonight or the Contacts sheet at Monday's meeting, the Start-here map tells you which file to open next.
23 files that do the work for you
The e-book shows you how. The tools make it happen. Here is exactly what you download.
The Ransomware and Cyber Incident Response Playbook (e-book, PDF)
The guide: methods, worked examples, scripts and exercises
Start here: incident response map
The job in ten steps with the file for each, your first hour, your first week, a 30/60/90-day plan, the 'Brand it in five minutes' box and what is in the kit.
Incident Response Readiness Workbook
26-sheet workbook: Settings, 0-4 self-assessment with a ranked gap plan, contacts, severity levels, recovery register with RTO and restore checks, restore tests, incident register, timeline, decision log, evidence and chain of custody, notification tracker, exercises, actions, RACI, roadmap, jurisdiction and framework crosswalks, official sources, glossary, What changed log and a dashboard with five charts.
Ransomware Business Case Calculator
Five-sheet calculator: your estimates and quotes, the cost per outage day, the cost of an incident with and without preparation in three scenarios, net year 1 and year 2, and a dashboard with three charts.
First-hour triage and containment record
Four-page fillable record for the first hour: what was seen and who reported it, the severity score and declaration, a minute-by-minute first-hour checklist with the call log, containment actions, and the evidence and chain-of-custody log.
Notification decision worksheet
Three-page fillable worksheet for the privacy lead and counsel: what data and whose, which countries and contracts, the harm assessment, every clock with its start time, and the decision record with who was told and when.
Ransom demand decision record
Three-page fillable record for the hardest call: the facts of the demand, the options and what each rests on (backups, law, sanctions, insurer, law enforcement advice, the worth of any deletion promise), and the decision with who decided and the reporting steps that follow.
Backup restore test record
Two-page fillable record for a quarterly restore test: the systems, the copy used, the timed restore against RTO and RPO, the owner's data check, the immutable-copy check and what to change.
Tabletop exercise and after-action review
Three-page fillable form: the exercise plan and roles, an observer's sheet for each inject, and a blameless after-action review (expected, happened, why, change) with an owned action list. Use it for exercises and real incidents.
Incident response plan and ransomware playbook
Brand-ready 13-section plan: scope and authority, severity levels, roles and deputies, out-of-band contacts, the first hour, containment and evidence, eradication and recovery, a one-page backup and recovery standard, communication, notification, an extortion and ransom policy statement, after-action review and plan maintenance.
Tabletop exercise pack: three scenarios
Brand-ready facilitator pack: how to run a 90-minute tabletop, three scenarios (ransomware at 3 a.m., a supplier's email takeover with fake invoices, client data on a leak site) with 18 timed injects, what good looks like, and a hot-wash scoring table.
Leadership sign-off and decision memo
Brand-ready four-part memo: the decision to prepare (with the calculator's numbers, low case first), plan approval with risk acceptance, the decision record for a serious incident, and the incident close-out.
Incident communications message library
Brand-ready library of 32 messages and scripts: staff texts and briefings, client holding statements and notice-clause letters, supplier payment warnings, insurer notice, notices to affected people and a support line script, regulator cover note, media holding statement, journalist script and the hard moments.
Worked example pack: Kestrel Ridge Engineering
The main files completed for one composite 120-person engineering firm in Brisbane: business case, self-assessment and gap plan, recovery register and restore tests, the incident timeline, notification tracker, ransom decision summary, after-action review and costs.
AI prompt pack for incident response
26 tool-agnostic prompts grouped by prepare, respond, recover and learn, each with what to paste in and what to check, plus four human-review rules for using AI during an incident.
Team briefing session plan and answer key
A 45-minute session plan for all staff, facilitator notes, a ten-minute add-on for managers and the printable answer key for the 14-question knowledge check.
Incident response knowledge check (LMS-ready)
14 scenario questions with four options, the correct letter and an explanation; imports into Bodhih LMS or any LMS that accepts CSV quizzes.
Numbers that matter: incident readiness KPI card
14 numbers with plain-words definition, formula, where each lives in the workbook and what to do when it moves, plus a flow mini-infographic.
First hour and decision card
The first 60 minutes in three blocks, twelve 'if this, do that' decisions with the file to open, and fifteen mistakes with what to do instead.
Cyber insurance and outside help card
Eight questions to answer with your broker before the night, the outside help to line up in advance and the order of the first calls.
Notification clocks and ransom rules by country (November 2026)
Dated sheet: personal data breach clocks, wider incident reporting, ransom payment rules and where to report, for the EU, UK, US, Canada, Australia and New Zealand.
Incident readiness 12-month calendar
31 calendar events: twelve weekly readiness meetings, three tabletop exercises, quarterly restore tests and contact checks, monthly security meetings, the insurance walk-through and the six-monthly plan review.
Incident readiness task board (CSV import)
34 tasks with phase, owner role, start and due week, labels and the kit file to use; imports into Trello, Asana, Notion, Planner or Jira.
Chapter by chapter
Each chapter opens with a real situation, gives you a method and ends with something to do today, using the tools in your kit.
- Format
- PDF e-book + XLSX + fillable PDF + DOCX + printable PDF + ICS + CSV
- Files
- 23 files plus a one-click ZIP
- E-book
- 70 pages
- Works with
- Excel, Google Sheets, Apple Numbers, LibreOffice, Word, Google Docs, Acrobat Reader, Google Calendar, Outlook, Apple Calendar, Trello, Asana, Notion, Planner, Jira, Bodhih LMS and most LMS quiz importers
- Best for
- Small and mid-size organisations of 20 to 500 people preparing for, or recovering from, a ransomware or cyber incident
What an incident really costs
How ransomware and other incidents hurt a small or mid-size organisation, pricing an outage day, and a business case that shows the low case first.
The plan and the team
Six roles with deputies, out-of-band communication, the incident lead's authority and outside help lined up in advance.
The readiness self-assessment
A 0-4 maturity self-assessment of 24 practices and a gap-to-action plan ranked by gap x impact.
Backups you have tested
3-2-1 plus an immutable or offline copy, RTO and RPO, recovery tiers, minimum viable operations and timed restore tests.
Severity and the first hour
Four severity levels, the first hour in three blocks and why you disconnect rather than power off.
Contain and preserve evidence
Containment that keeps evidence, chain of custody, eradication and the credential reset order.
Communication under pressure
Four questions in every message, who hears what and when, and pre-approved words for 3 a.m.
Notification clocks and the law
Personal data breach clocks, duties that follow the data, the notification tracker and a UK email takeover case.
Insurance, outside help and the ransom decision
Reading a cyber insurance policy, outside help, official positions on ransom payments and the decision record.
Exercise, review and improve
Tabletop exercises, the blameless after-action review, AI with human review and the yearly rhythm.
Not just reading. Tools you will actually open again.
Start here
- 00-Start-Here-Incident-Response-Map.pdf: the job in ten steps with the file for each, your first hour, your first week, a 30/60/90-day plan and the 'Brand it in five minutes' box
Workbooks
- Incident-Response-Readiness-Workbook.xlsx: 26 sheets including Settings, a 0-4 self-assessment and ranked gap plan, contacts, severity levels, recovery register, restore tests, incident register, timeline, decision log, evidence register, notification tracker, exercises, actions, RACI, roadmap, crosswalks, sources, glossary, What changed and a dashboard with five charts and traffic lights
- Ransomware-Business-Case-Calculator.xlsx: 5 sheets comparing the cost of an incident with and without preparation in three scenarios, net year 1 and year 2
Fillable forms
- First-Hour-Triage-and-Containment-Record.pdf: severity call, first-hour checklist and call log, containment actions, evidence and chain of custody
- Notification-Decision-Worksheet.pdf: whose data and where, harm assessment, every clock and the decision record
- Ransom-Demand-Decision-Record.pdf: the facts of the demand, the questions to answer with advice, the decision and what follows
- Backup-Restore-Test-Record.pdf: a timed restore test against RTO and RPO with the owner's data check
- Tabletop-Exercise-and-After-Action-Review.pdf: exercise plan, observer's sheet and a blameless review with actions
Word templates
- Incident-Response-Plan-and-Ransomware-Playbook.docx: 13 brand-ready sections including a backup and recovery standard and an extortion policy statement
- Tabletop-Exercise-Pack-Three-Scenarios.docx: facilitator guide and three scenarios with 18 timed injects
- Leadership-Sign-Off-and-Decision-Memo.docx: decision to prepare, plan approval, incident decisions and close-out
- Incident-Communications-Message-Library.docx: 32 messages and scripts for staff, clients, suppliers, insurer, people affected, regulators, media and hard moments
- Worked-Example-Pack-Kestrel-Ridge.docx: the main files completed for one composite 120-person engineering firm
- AI-Prompt-Pack-for-Incident-Response.docx: 26 prompts with what to paste in, what to check and four human-review rules
- Team-Briefing-Session-Plan-and-Answer-Key.docx: a 45-minute staff session, manager add-on and the printable answer key
Team training (LMS-ready)
- Incident-Response-Knowledge-Check.csv: 14 scenario questions in question, option_a to option_d, correct, explanation format
Cheat sheets
- Numbers-That-Matter-Incident-Readiness.pdf: 14 numbers with formulas and what to do when they move
- First-Hour-and-Decision-Card.pdf: the first 60 minutes, 12 'if this, do that' decisions and 15 mistakes to avoid
- Cyber-Insurance-and-Outside-Help-Card.pdf: eight questions for your broker and the outside help to line up
- Notification-Clocks-and-Ransom-Rules-by-Country-November-2026.pdf: dated sheet for the EU, UK, US, Canada, Australia and New Zealand
Calendar and import
- Incident-Readiness-12-Month-Calendar.ics: 31 calendar events
- Incident-Readiness-Task-Board.csv: 34 tasks for Trello, Asana, Notion, Planner or Jira
E-book
- The Ransomware and Cyber Incident Response Playbook e-book: about 10,500 words, 10 chapters and 23 figures
When you have worked through it, you will be able to…
Every outcome is practised with a worked example and a tool, not just described.
- Price an outage day and write a business case that shows the low case first
- Name six roles with deputies and build a printed, out-of-band contact list
- Score 24 practices honestly and work a gap plan ranked by formula
- Set RTOs and RPOs, keep an immutable or offline copy and time restores against them
- Run the first hour from a card: declare, disconnect, call, preserve
- Send staff, client, supplier and media messages that say what you know and when you will know more
- Track every notification party and clock with counsel, and decide an extortion demand with a record
- Rehearse with three tabletop scenarios and turn every lesson into an owned action
Know your starting point. Prove your progress.
People who measure before and after improve faster and can show it. AssessAll, our sister assessment platform, has AI-graded assessments that pair with this kit. Take one now, work through the kit, then re-take it.
Incident Response & On-Call Judgment
Take the assessment →AssessAll assessmentCrisis & High-Stakes Decision Making
Take the assessment →AssessAll assessmentWorkplace Cybersecurity Awareness Assessment for Annual Recertification of All Staff
Take the assessment →JobularyUse the fresh-start effect to reset a goal (Jobulary)
Make it a growth plan →A taste of Chapter 2
If an attacker is in your network, they may be reading your email and chat, and a plan discussed there can tip them off. So the team needs a way to talk that does not depend on company systems: personal mobiles, a secure messaging group set up in advance and a printed contact list. That is what "out-of-band" means. The Contacts sheet in the workbook holds the list: each role and deputy, your managed service provider's 24/7 line, your detection provider, your insurer's breach hotline, the forensics firm, counsel, your bank's fraud team and your national cyber agency. It flags any contact not checked within 92 days. Print it, keep a copy at two homes, and check it every quarter with a one-line message (Message Library M32).
The honest comparison
| Free templates and typical advice | This kit | |
|---|---|---|
| The plan | A long generic template nobody reads | A 13-section plan in plain words, with roles, deputies, authority and a first-hour card |
| Where you stand | A yes and no checklist | A 0-4 self-assessment with level descriptors, gap x impact priority and a ranked gap plan |
| Backups | 'We have backups' | A recovery register with tiers, RTO, RPO, copy checks and a restore test log that flags anything slower than its target |
| During the incident | Notes on whatever is to hand | Timeline, decision log, evidence register and notification tracker built for the scribe and the privacy lead |
| Rehearsal | None, or one big exercise every few years | Three ready tabletop scenarios with 18 timed injects and a blameless review form |
| Compared with a consultant or a retainer | A consultant brings judgement and hands-on time; a retainer brings forensics on call | The method, files and decisions in one place; works alongside either, and tells you when to call them |
Made for you if…
- Operations directors, IT managers and practice managers who have been told 'you own incident response now'
- Founders and COOs of 20 to 500 person organisations with no security operations centre
- Organisations in the US, Canada, the UK, the EU, Australia and New Zealand that hold staff or client personal data
- Teams whose insurer, auditor or largest client has asked to see an incident response plan
- Organisations that have had an incident and want the next one to go differently
- IT providers and consultants who want a clear, brandable starting kit for a client (within the licence)
Probably not for you if…
- Anyone wanting legal advice: notification and payment rules need counsel in each country
- Anyone wanting an audit, attestation, certification or a guarantee that an attack will not succeed
- Large enterprises with an established security operations centre and incident response retainer
- Technical forensics training: the kit tells you when and how to bring in a forensics firm, not how to do their work
Built by trainers, tested in real rooms.
Bodhih Training has designed and delivered corporate programmes since 2008. Bodhih Pro Kits package what works in those workshops into a guide plus the exact tools we use, so you can apply it the same day without a facilitator in the room.
From here to using it in three steps
- STEP 1
Tap Get the kit
Name, email and country. UPI, card or netbanking in India; international cards everywhere else. No account to create.
- STEP 2
Download instantly
Your download page opens at once, with every file and a one-click ZIP. A permanent link lands in your inbox too.
- STEP 3
Open the first tool
Start with the quick-start chapter, then the main spreadsheet or planner. Most buyers use something from the kit the same day.
Your incident response, ready before you need it
Open the Start-here map and give it one hour. Whether you begin with the Contacts sheet tonight or the first restore test next week, you will know who to call, what to do first and which file to open.
Personal licence for the buyer's own use, including use within your own organisation and with its staff. Please don't share or resell the files. Team, company and consultant licences: solutions@bodhih.com.
What buyers say
No ratings yet. Only people who have bought this kit can rate it - every buyer gets a one-click rating link a couple of days after their purchase.
The Bodhih family, when you are ready for more
The Psychosocial Risk Management Kit
Identify, assess and control psychosocial hazards at work as a health-and-safety duty, not.
The SME Sustainability Reporting Kit
Help a small or mid-size company answer customers', banks' and investors' sustainability q.
The NIS2 and Cyber Essentials Readiness Kit
Get a mid-size organisation ready for the EU NIS2 Directive and UK Cyber Essentials.
AssessAll
250+ AI-graded assessments to measure skills and earn verified credentials.
Jobulary
Individual development plans that start from evidence and stay yours.
Bodhih Training
Run this topic as a live workshop for your team, in person or online.
Pewple
Book a vetted coach for career, leadership or communication. Pay per session.
Bodhih.org pathways
Certification pathways in Applied AI, Workplace English and management.
The Ransomware and Cyber Incident Response Playbook: FAQs
Read the free guideAlready bought? Resend my linkWill this kit stop a ransomware attack or make us compliant?
No kit can promise either. The kit helps you prepare and respond: a plan, roles, tested backups, a first-hour card, evidence and notification records, messages and exercises. It is educational, not legal advice, and it is not an audit or a certification. Not affiliated with or endorsed by NIST, ISO, CISA, the NCSC, ASD or any regulator.
What should a small business do in the first hour of a ransomware attack?
Put one person in charge, move the team to an out-of-band channel, disconnect affected devices from the network without powering them off, tell the decision-maker, cut internet and VPN if spread is possible, call your insurer's hotline, engage forensics and tell staff not to log in. The First Hour and Decision Card sets it out minute by minute.
Should we pay the ransom?
The kit does not tell you to pay or not to pay. Official guidance in the US, UK and elsewhere discourages payment, sanctions law may apply, some countries require a report if you pay, and a deletion promise cannot be verified. The Ransom Demand Decision Record makes sure counsel, your insurer and law enforcement are heard before the decision-maker decides.
How long do we have to report a data breach in the UK, EU, US or Australia?
It depends on the law, the facts and sometimes the contract, and clocks often start when you become aware rather than when you are certain. The dated sheet lists the main personal data breach clocks and wider incident reporting rules for the EU, UK, US, Canada, Australia and New Zealand at November 2026. Counsel confirms what applies to you.
How do we know our backups will survive ransomware?
Keep at least three copies on two kinds of storage with one offsite and one immutable or offline, protect the backup console with separate credentials and MFA, and time a restore of each critical system every quarter against its RTO. The Recovery register and Backup Restore Test Record do this for you.
What should we ask our cyber insurer before an incident?
The notice condition, whether you must use panel firms, what needs consent before you spend, the excess and any waiting period, what the policy says about extortion and sanctions, and whether cover depends on controls you declared. The Cyber Insurance and Outside Help Card lists all eight questions.
How often should we run a tabletop exercise?
The kit's method is at least twice a year with the real decision-makers and a different scenario each time, plus a review after every real incident. The Tabletop Exercise Pack has three 90-minute scenarios ready to run.
Can we do this without a consultant or a security team?
Many small organisations build and rehearse their plan themselves with their IT provider. The kit gives you the method, files and decision rules, and tells you when to bring in forensics, counsel and your insurer, who you will still need on the night.
Can I use this with my team?
Yes, within your own organisation under the personal licence: share the files with your staff, run the 45-minute briefing and load the knowledge check into your LMS. Company-wide, multi-entity and consultant licences are available via solutions@bodhih.com.
Does it work in my country?
The method works anywhere. The dated sheet covers the EU, UK, US, Canada, Australia and New Zealand, with a short note for India and the Gulf. Laws, reporting routes and clocks change, so check the official sources listed and your counsel.
How can I measure my team's starting point on incident judgement?
AssessAll offers the Incident Response and On-Call Judgment, Crisis and High-Stakes Decision Making, and the Workplace Cybersecurity Awareness Assessment at assessall.com, useful for the incident team's decisions under pressure and for all-staff awareness alongside the kit's own knowledge check.
How do I turn this into a development plan for myself?
Pick one gap from your plan and start it on a fresh-start date, such as the first Monday of the quarter; Jobulary explains how to use the fresh-start effect to reset a goal.
How much does The Ransomware and Cyber Incident Response Playbook cost?
₹1,999 including 18% GST for buyers in India, or $49 for buyers outside India. One-time payment, no subscription, with an automatic invoice.
How do I get the files after paying?
Instantly. Your download page opens the moment payment succeeds, and a permanent download link is emailed to you. Download each file separately or everything in one ZIP.
What software do I need?
Any of the usual tools: Excel or Google Sheets for spreadsheets, Word or Google Docs for templates, Adobe Acrobat Reader, Preview, Xodo or GoodNotes for the fillable PDFs, and Google, Outlook or Apple Calendar for the calendar plan.
Can I get a refund?
Because it is a digital download, kits are not refundable once downloaded. We always refund a duplicate charge or a failed delivery, and if a file is corrupted and we cannot fix it within 3 working days. Full terms: bodhih.org/refunds.
Can my company buy this for a team?
Yes. Team and company licences, and workshops on this topic run by Bodhih Training, are available. Write to solutions@bodhih.com or call +91 99000 11601.
