Incident number / name:
Decision owner:
Person keeping the record:
Symptom and time
- Host / device / owner:
- Report time and timezone:
- First known symptom and time:
- Actions already taken before this card:
- Facts / hypotheses / gaps are marked separately.
Isolation or shutdown
- The host was disconnected from the network without a privileged sign-in.
- Checked whether encryption or data destruction is still active.
- Selected: leave powered on and isolated / controlled shutdown / escalate.
Decision, time, person, and reason:
Shutdown removes volatile memory. It may still limit damage when encryption or data destruction is active and the host cannot quickly and safely be isolated from the network and accessible storage. Do not power off devices indiscriminately without a decision owner.
Shares and services
- Shares visible from the host:
- New file changes still visible: yes / no / unknown.
- The service owner decided whether to restrict writes or disconnect.
- Business impact and time of change recorded.
Privileged accounts
- Accounts used on the host:
- Active sessions / tokens requiring revocation:
- Reset or block performed from a clean workstation.
- Available logs preserved and time of every change recorded.
Backups
- Backup repository separated from the suspect environment.
- No backup was connected to an infected host.
- Newest restore point that available evidence shows predates the unwanted changes, and its verification status:
- Person authorised to decide on restoration:
Contacts
- Business / service owner:
- Technical contact / supplier:
- Bank, insurer, or relevant authority — if applicable:
- External contact, time, and facts shared:
State at the end of this card
Confirmed hosts / accounts / services:
Scope still unknown:
Next decision, person, and time:
The first hour of ransomware explains the decision context. Also use the IR checklist and, to preserve facts and hypotheses, the basic digital forensics worksheet. This card does not replace a response plan, specialist support, or the organisation’s obligations.