---
title: [CM] [PB] Threats Against Cyber Attack
description: "Playbook: Threats against Ransomware Attack"
---

[Crisis Management | CM](https://blog.bcm-institute.org/en/crisis-management)

# [\[CM\] \[PB\] Threats Against Cyber Attack](https://blog.bcm-institute.org/en/crisis-management/playbook-threats-against-ransomware-attack)

 Written by [Moh Heng Goh](https://blog.bcm-institute.org/en/crisis-management/author/moh-heng-goh) | May 29, 2024 7:13:26 AM

#### Action Steps for Threats against Cyber Attack

##### Description of Crisis

A cybersecurity event is a cybersecurity change that may have an impact on organisational operations (including mission, capabilities, or reputation)

| This playbook is a training aid for Module 2 Session 2 of the CM-300/ 5000 Implementer/ Expert Implementer Course participants to attempt the CM plan development assignment. |  |
| --- | --- |

#### Scenario: A ransomware attack, locking business-critical data and disrupting services essential to your organisation's operations

#### Action Steps

##### Pre-Crisis

Before the crisis hits, the organisation should make sure to:

- Explain to the crisis management members the threat (ransomware, phishing, etc) and how it works.
- Establish a cybersecurity event response guideline.
- Maintain up-to-date critical contact information (service providers, additional resources, third parties intervening during a cybersecurity crisis, etc).
- Identify alternative methods of communication in case virtual meetings are not possible and business units if emails are unavailable (conference bridge, physical command centre, etc.).

##### During-Crisis

The crisis management team should consider the following while managing the crisis:

- Rely on the cyber event response team to obtain updates on the situation (technical response);
- Gather information on the cyber security incident;
- Follow cyber response guidance described in the Cyber Event Response handbook;
- Assess the impact on operations (current and imminent): 
    - Identify which critical systems and data are affected;
    - Identify what critical operations are or will be interrupted;
    - Communicate with affected business units
    - Determine if BC Plans and manual workaround should be activated
- Assess the impact on employees (if HR data is impacted); 
    - Identify what types of HR data have been affected
    - Identify which employees have been affected
    - Provide support and, if needed, offer credit bureau services to affected employees
    - Communicate with affected employees and explain to "ABC Company" action plan.
- Assess the impact on suppliers and partners (If suppliers and partners are affected) 
    - Identify what types of data have been affected
    - Identify which suppliers/partners have been affected
    - Communicate with affected suppliers/partners and explain the "ABC Company" action plan.
- Assess legal and regulatory impacts;
- Identify objectives for success (e.g., recovering operations, data, etc.)
- Communicate with relevant authorities
- If needed, communicate with a third party to help manage the situation
- If applicable, liaise with a cyber insurance supplier;

##### Post-Crisis

Once the objectives for success have been met and the crisis has been resolved:

- Identify gaps and action plans to improve IT security and awareness
- In a post-event report, identify what went well and what went wrong in the crisis management response and establish action plans.
- Communicate the post-event report to relevant stakeholders.

#### More Information About Crisis Management Courses

To learn more about the course and schedule, click the buttons below for the  CM-300 Crisis Management Implementer \[CM-3\] and the CM-5000 Crisis Management Expert Implementer \[CM-5\].

|  |  |  |  |  |
| --- | --- | --- | --- | --- |
|  |  |  |  |  |
|  |  | Please feel free to send us a note if you have any questions. |  |  |
|  |  |  |  |  |

[View full post](https://blog.bcm-institute.org/en/crisis-management/playbook-threats-against-ransomware-attack)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Moh Heng Goh"
  },
  "dateModified" : "2026-06-16T03:29:51.041Z",
  "datePublished" : "2024-05-29T07:13:26Z",
  "headline" : "[CM] [PB] Threats Against Cyber Attack",
  "image" : {
    "@type" : "ImageObject",
    "height" : 400,
    "url" : "https://3893111.fs1.hubspotusercontent-na1.net/hubfs/3893111/Playbook%20Morepost/IC_Crisis%20Scenario_Threats%20Against%20Ransomeware%20Attack.png",
    "width" : 385
  },
  "mainEntityOfPage" : "https://blog.bcm-institute.org/en/crisis-management/playbook-threats-against-ransomware-attack",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Crisis Management"
  }
}
```