Building Ransomware Playbook With Cisa Framework
Builds a structured ransomware incident response playbook aligned with the CISA...
Install
npx skills add AgentFlocks/flocks --skill building-ransomware-playbook-with-cisa-framework -g -a claude-code -y- Repository
- AgentFlocks/flocks504
- Category
- Engineering
- Updated
- 5d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 1,819 tokens
- Runs scripts
- Yes, review before use
What it does
Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Activates for requests involving ransomware response planning, CISA compliance, incident response playbook creation, or ransomware preparedness assessment.
Building Ransomware Playbook with CISA Framework
When to Use
- An organization needs to create or update its ransomware incident response playbook following CISA guidelines
- A security team is conducting a ransomware readiness assessment against the CISA StopRansomware framework
- Compliance requires documenting ransomware response procedures aligned with NIST CSF and CISA recommendations
- During tabletop exercises to validate that the organization's ransomware response steps match industry best practices
- After a ransomware incident to update the playbook with lessons learned and close identified gaps
Do not use as a substitute for legal counsel regarding ransom payment decisions, breach notification timelines, or regulatory obligations specific to your jurisdiction.
Prerequisites
- Familiarity with the CISA StopRansomware Guide (cisa.gov/stopransomware/ransomware-guide)
- NIST Cybersecurity Framework (CSF) understanding (Identify, Protect, Detect, Respond, Recover)
- Inventory of critical assets, backup infrastructure, and communication channels
- Defined roles and responsibilities for incident response team members
- Python 3.8+ for playbook generation and compliance checking automation
- Access to organization's asset inventory and backup configuration documentation
Workflow
Step 1: Preparation Phase (CISA Part 1 - Prevention)
Establish ransomware-specific defenses before an incident:
