FREE TEMPLATE · EXCEL WORKBOOK
Ransomware first-72-hours checklist
A timed checklist for the first 72 hours of a ransomware attack and the weeks after. It sits next to a decision log for board-level choices, a contacts sheet for the Benelux and a backup assessment to decide what can be restored safely.
What's inside
- 46 timed actions across the first hour, 24 hours, 72 hours and after, with references
- Regulatory checkpoints for NIS2, DORA and GDPR in the timeline
- Decision log for isolation, attacker contact, ransom and restore choices
- Contacts sheet with Benelux CSIRTs and police
- Backup assessment grid to validate restore points
Worksheets
First 72 hoursDecision logContactsBackup assessment
How to use it
- Fill in owners and the contacts sheet in advance and print a copy
- At declaration, start at H-01 and record the time of every completed action
- Log every major decision with rationale and the advice taken
- Use the backup assessment before restoring anything
- Rehearse the checklist in a tabletop exercise at least once a year
Companion playbook
Ransomware response playbook: the first hour, 24 hours and 72 hours →
Same house style as every Secrato template: a start sheet with instructions, light blue cells to fill in, and version control. Free to use within your organisation. This template is practical guidance, not legal advice.
Get the template
Enter your work e-mail and we will send you a personal download link straight away. We may follow up with related guidance; you can opt out at any time.
