Ransomware: Readiness, Response Decisions & Recovery

Kaveri Crescent Hospitals, a fictional hospital group in Karnataka, has watched ransomware take hospitals offline for days. The board wants to know three things: how ready are we, how fast could we recover, and who decides what on the night it happens.In six lessons you learn what ransomware is and how the criminal business behind it works, using WannaCry, AIIMS Delhi and Colonial Pipeline as case studies; score the group's readiness against the NIST IR 8374 ransomware profile and the CIS Controls from real-looking evidence and pick the five biggest gaps; build the backup and recovery plan in Excel (RTO, RPO, a 3-2-1-1-0 design, restore order by clinical criticality, time to recover); work through a six-update tabletop exercise, deciding and justifying containment, isolation, notifications (CERT-In within six hours, the Data Protection Board under the DPDP Act, the insurer, law enforcement) and the payment question; then write the incident communications and the lessons-learned report in Word.This is a management and defence course: no malware, no attack tools, nothing to install. You work in Bartman's in-browser GRC Workspace, Excel lab and Word lab, and your hospital's figures and incident facts are generated for you, so your answers differ from everyone else's. Part of the Bartman Cybersecurity track (Professional Certificate in Cybersecurity, LSBF).

Tools: Ransomware readiness, NIST IR 8374, CIS Controls, Incident response, CERT-In, DPDP Act, Backup and recovery, Excel, Word