When ransomware hits, the first 60 minutes decide whether you're recovering or improvising. Drawing on incident response engagements and threat intelligence work tracking hundreds of ransomware groups, this session breaks down two concepts every CISO should have ready before they're needed: the "cleanroom," an isolated, verified-clean recovery environment where you can restore systems without re-infecting them, and the "digital jump-bag," the pre-packed kit of contacts, credentials, playbooks, and tools you grab the moment an incident is declared. Expect concrete, field-tested advice: what actually goes in the jump-bag (and what people forget), how to build a cleanroom on a realistic budget, and the coordination failures that turn a contained incident into a crisis. Attendees will leave with a checklist they can start building this week.
