Post-incident reviews of three ransomware events show responders took different containment steps each time, and in one case a server was restored before the attack vector was understood. What would BEST improve consistency?
Select an answer to reveal the explanation.
Short Explanation
When everyone plays the same song from memory, you get three different songs. A playbook is the sheet music: the steps, the decision points and who does what for ransomware. Leaning on one expert is the trap; that person won't always be available, and knowledge in one head isn't a process.
Full Explanation
Playbooks are incident-type-specific procedures that sit under the incident response plan. For a recurring threat such as ransomware, a playbook defines the sequence of actions, the decisions that require authorization, the roles involved, the evidence to preserve and the conditions to meet before moving from containment to eradication and recovery, including identifying the attack vector before restoring systems. Exercising it ensures responders know it and exposes gaps. Assigning one experienced engineer to lead every response creates a single point of failure and makes consistency depend on an individual rather than a documented process. An endpoint product with automated rollback is a technical control that may reduce impact, but it does not tell responders what to do, in what order or who decides, and it does not prevent restoring before the vector is understood. Detailed documentation after each event supports lessons learned, but it records inconsistency after the fact instead of preventing it. Exam caveat: playbooks must stay aligned with the overall plan and be updated as lessons are learned. Operational check: confirm the playbook has an owner, a version date, a gate requiring root-cause understanding before restoration, and has been used in an exercise.