Create an incident response plan for a ransomware attack. Follow NIST framework: (1) Preparation: what tools/contacts needed, (2) Detection & Analysis: how to identify, (3) Containment: short-term (isolate) and long-term (rebuild), (4) Eradication: remove malware, patch vulnerability, (5) Recovery: restore from backup, verify, (6) Lessons Learned: post-incident review. Write as an actionable playbook.
