How to build a ransomware incident response plan using Cyber Centre guidance

The Canadian Centre for Cyber Security (Cyber Centre) released the second edition of its Ransomware playbook (ITSM.00.099) on Jan. 28, 2026, replacing the 2021 version. Together with its January 2026 guide Developing your incident response plan (ITSAP.40.003), it gives Canadian organizations a free, practical template. This guide turns both into a written plan in eight steps.

A plan matters because the first hours of a ransomware attack decide how much is lost. Teams that already know who isolates systems, who calls police and where clean backups are kept recover faster and make fewer expensive mistakes.

Step 1: Get management commitment and scope the plan

1. Open the plan with a short statement from leadership approving it and giving the response team authority to act, including shutting down systems.
2. Run a quick risk assessment: list critical assets (identity systems, ERP, file servers, payroll, customer databases) and how each could be compromised.
3. Set objectives and simple measures, such as time to isolate an infected device or time to restore a critical system.

Step 2: Name the cyber incident response team

1. Assign an incident lead, technical leads for identity, endpoints, network and backups, a communications lead, and contacts in legal, management and privacy.
2. Add external contacts: managed service provider, cyber insurer and its breach coach, incident response firm, and your bank.
3. Print the contact list. If email and Teams are encrypted or compromised, you will need phone numbers and an out-of-band channel such as a separate messaging group.

Step 3: Fix the backup plan before you need it

The playbook recommends keeping multiple backups, with at least two stored offline and disconnected from networks, testing them regularly and encrypting them.

1. Document what is backed up, how often, where copies sit and who can delete them.
2. Protect backup consoles with separate credentials and phishing-resistant multi-factor authentication. Attackers routinely target backup systems first.
3. Schedule restore tests for at least one critical system each quarter and record how long it takes.

The playbook pairs backups with a recovery plan. Keep an up-to-date inventory of hardware, software and data, rank business functions by how long the organization can live without them, and record the dependencies between systems so you restore them in a workable order. If you carry cyber insurance, note the policy number, the insurer's breach hotline and any rule about which response firms you must use, because some policies limit coverage if you hire outside their panel.

Step 4: Write the immediate response checklist

The Cyber Centre's checklist for the first few hours is the core of your plan. Adapt each line to your environment:

1. Identify and isolate infected systems. Disconnect them from the internet and internal networks. Note which switch ports, VLANs or EDR isolation actions to use.
2. Report the incident to your local police, the Canadian Anti-Fraud Centre and the Cyber Centre.
3. Assemble the response team and assign roles.
4. Reset credentials, especially privileged and service accounts, while keeping any credentials you need for restoration.
5. Wipe and reinstall infected devices, and update firmware.
6. Scan backups and restored systems before reconnecting them, and deal with anything flagged.

Add a line on evidence: capture memory and disk images and export logs before wiping, if your insurer or police will need them.

Step 5: Write the recovery sequence

1. Find and fix the point of entry (an exposed VPN, a phished account, an unpatched server) before reconnecting anything.
2. Restore from clean, offline backups.
3. Restore critical systems first, in an isolated environment, in the order you set in your recovery plan. Identity services usually come first.
4. Bring in outside cyber security professionals when the job exceeds your team.
5. Inform stakeholders using your prepared communications plan.
6. Analyze the root cause and how far the attacker got, including what data may have been stolen.

Step 6: Decide in advance how you will handle a ransom demand

The Cyber Centre says the decision to pay belongs to the organization, but recommends contacting police before considering it. It warns that paying does not guarantee you will get your data or systems back, can lead to further demands or re-targeting, may not stop stolen data from being leaked or sold, and funds more attacks. Write down who has authority to make that decision, who advises them (legal, insurer, law enforcement) and what information they need. Settling this in advance keeps it from being decided in a panic.

Step 7: Add reporting, privacy and communications duties

1. Cyber Centre: report through the online form on its incident management page (choose An Organization). General line: 1-833-CYBER-88 (1-833-292-3788).
2. Canadian Anti-Fraud Centre: report online at reportcyberandfraud.canada.ca or call 1-888-495-8501.
3. Police: call local police; in an emergency, 911.
4. Privacy regulators: ransomware often involves data theft. If personal information is involved, assess whether you must report to the Office of the Privacy Commissioner of Canada (real risk of significant harm), to Quebec's Commission d'accès à l'information (risk of serious injury) or to a provincial commissioner. Record the incident in your breach register either way.
5. Communications: prepare holding statements for staff, clients and media, and decide who may speak publicly.

Step 8: Test, review and update

The Cyber Centre recommends testing the plan with exercises and revisiting it at least once a year. Run a tabletop exercise based on a realistic ransomware scenario, then hold a post-incident review after any real event. The playbook describes the cycle as prepare, observe, resolve and understand: each review should feed changes back into preparation.

Prevention controls to list in the plan

• Multi-factor authentication for all accounts, least privilege and a limited number of administrators.
• Prompt patching, particularly of internet-facing devices.
• Network segmentation, application allow lists and restricted macros.
• Centralized logging and alerting, and protective DNS.
• Email authentication with SPF, DKIM and DMARC.

Sources

• Canadian Centre for Cyber Security: Ransomware playbook (ITSM.00.099)
• Canadian Centre for Cyber Security: Developing your incident response plan (ITSAP.40.003)
• Canadian Centre for Cyber Security: Report a cyber incident
• Canadian Centre for Cyber Security: Contact us
• Canadian Anti-Fraud Centre: Reporting fraud and cybercrime