building-ransomware-playbook-with-cisa-framework

name	building-ransomware-playbook-with-cisa-framework
description	Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Use when creating or updating a ransomware playbook, running a CISA-aligned readiness assessment, or validating response steps during a tabletop exercise.
domain	cybersecurity
subdomain	ransomware-defense
tags	["ransomware","incident-response","CISA","playbook","compliance","NIST"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"]
mitre_attack	["T1486","T1490","T1489","T1078","T1021.002"]
mitre_f3	{"version":"1.1","tactics":["initial-access","monetization"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"}]}

Building Ransomware Playbook with CISA Framework

When to Use

• An organization needs to create or update its ransomware incident response playbook following CISA guidelines
• A security team is conducting a ransomware readiness assessment against the CISA StopRansomware framework
• Compliance requires documenting ransomware response procedures aligned with NIST CSF and CISA recommendations
• During tabletop exercises to validate that the organization's ransomware response steps match industry best practices
• After a ransomware incident to update the playbook with lessons learned and close identified gaps

Do not use as a substitute for legal counsel regarding ransom payment decisions, breach notification timelines, or regulatory obligations specific to your jurisdiction.

Prerequisites

• Familiarity with the CISA StopRansomware Guide (cisa.gov/stopransomware/ransomware-guide)
• NIST Cybersecurity Framework (CSF) understanding (Identify, Protect, Detect, Respond, Recover)
• Inventory of critical assets, backup infrastructure, and communication channels
• Defined roles and responsibilities for incident response team members
• Python 3.8+ for playbook generation and compliance checking automation
• Access to organization's asset inventory and backup configuration documentation

Workflow

Step 1: Preparation Phase (CISA Part 1 - Prevention)

Establish ransomware-specific defenses before an incident:

CISA Preparation Checklist:
━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Maintain offline, encrypted backups tested for restoration
[ ] Create and exercise a cyber incident response plan (IRP)
[ ] Implement network segmentation between IT and OT networks
[ ] Enable MFA on all remote access and privileged accounts
[ ] Deploy endpoint detection and response (EDR) on all endpoints
[ ] Disable or restrict RDP; require VPN for remote access
[ ] Maintain a software/hardware asset inventory
[ ] Apply patches within 48 hours for internet-facing systems
[ ] Configure email filtering and disable macro execution by default
[ ] Conduct regular phishing awareness training
[ ] Implement application allowlisting (AppLocker/WDAC)
[ ] Test backup restoration quarterly and document RTO/RPO

Step 2: Detection and Analysis Phase

Identify ransomware indicators and assess scope:

Detection Indicators:
━━━━━━━━━━━━━━━━━━━━
- Mass file rename operations with new extensions (.locked, .encrypted)
- Ransom notes appearing in directories (README.txt, DECRYPT.html)
- Volume Shadow Copy deletion (vssadmin delete shadows)
- Abnormal CPU usage from encryption processes
- EDR/AV alerts for known ransomware signatures
- Network connections to known C2 infrastructure
- Unusual lateral movement via SMB or PsExec
- Sysmon Event ID 11 (file creation) spikes

Initial Analysis Steps (CISA):
  1. Take system images and memory captures of affected devices
  2. Identify patient zero and initial access vector
  3. Determine the ransomware family (ID Ransomware, ransom note analysis)
  4. Assess encryption scope: which systems, shares, and data are affected
  5. Check if data exfiltration occurred (double extortion indicator)