Be Ready 2.0: Ransomware Response

Tuesday, November 10, 2026 I 2:00 p.m. ET

Session 2 of Be Ready 2.0 puts your incident response (IR) plan to the test. Building on Session 1’s focus on mission alignment and operationalizing your IR plan, this session moves from theory to practice. You’ll work through a mock ransomware event and see how your plan holds up under pressure.

This isn’t a session you watch from the sidelines. Presented content is paired with an interactive exercise where you’ll collaborate with peers, tackle scenario-based challenges, and identify gaps in real time as you choose your next steps through polling. Come ready to talk, share, and learn from others facing the same challenges.

Bring to the Session

• Your organization’s most recent IR plan
• The three MS-ISAC Incident Response Workflows (attached)
• A setup where you can speak and unmute during breakouts

As You Work Through the Scenario, Consider

• Does my IR plan define what an incident is?
• Does it tell me the next three steps once an incident is declared?
• Are roles and responsibilities clearly defined?
• Does it establish who has the authority to act in each role?

Designed for IT and cybersecurity managers and staff, key decision makers, and emergency planners with cybersecurity responsibilities, this session will help you use your plan to coordinate a response with other participants.

The mock incident will challenge your approach to:

• Communications
• Roles, responsibilities, and authority
• Prioritizing tasks
• The unique complexities of ransomware response

You’ll leave with practical solutions for the gaps you uncover, ready to strengthen your own organization’s IR planning.