# Building Ransomware Playbook With Cisa Framework

Builds a structured ransomware incident response playbook aligned with the CISA...

- Repository: https://github.com/AgentFlocks/flocks (504 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add AgentFlocks/flocks --skill building-ransomware-playbook-with-cisa-framework -g -a claude-code -y`
Codex: `npx skills add AgentFlocks/flocks --skill building-ransomware-playbook-with-cisa-framework -g -a codex -y`
Cursor: `npx skills add AgentFlocks/flocks --skill building-ransomware-playbook-with-cisa-framework -g -a cursor -y`
Gemini CLI: `npx skills add AgentFlocks/flocks --skill building-ransomware-playbook-with-cisa-framework -g -a gemini-cli -y`

## Description

Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Activates for requests involving ransomware response planning, CISA compliance, incident response playbook creation, or ransomware preparedness assessment.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Building Ransomware Playbook with CISA Framework

## When to Use

- An organization needs to create or update its ransomware incident response playbook following CISA guidelines
- A security team is conducting a ransomware readiness assessment against the CISA StopRansomware framework
- Compliance requires documenting ransomware response procedures aligned with NIST CSF and CISA recommendations
- During tabletop exercises to validate that the organization's ransomware response steps match industry best practices
- After a ransomware incident to update the playbook with lessons learned and close identified gaps

**Do not use** as a substitute for legal counsel regarding ransom payment decisions, breach notification timelines, or regulatory obligations specific to your jurisdiction.

## Prerequisites

- Familiarity with the CISA StopRansomware Guide (cisa.gov/stopransomware/ransomware-guide)
- NIST Cybersecurity Framework (CSF) understanding (Identify, Protect, Detect, Respond, Recover)
- Inventory of critical assets, backup infrastructure, and communication channels
- Defined roles and responsibilities for incident response team members
- Python 3.8+ for playbook generation and compliance checking automation
- Access to organization's asset inventory and backup configuration documentation

## Workflow

### Step 1: Preparation Phase (CISA Part 1 - Prevention)

Establish ransomware-specific defenses before an incident:

The rest: https://github.com/AgentFlocks/flocks/blob/HEAD/.flocks/flockshub/plugins/skills/Anthropic-Cybersecurity-Skills/building-ransomware-playbook-with-cisa-framework/SKILL.md