Ransomware playbook

This playbook has technical guidance for responding to a ransomware incident. It is not a standalone resource: use it alongside your incident management plan to make sure it works for your school.

---

Overview

Ransomware is a type of cyber-attack. Specific malicious software is used to block access to a device, system, or data.

This may be used as a tactic to then ask for a “ransom” in exchange releasing the device, system or data.

These instructions cover a ransomware incident that affects a school’s IT infrastructure, digital assets and data.

---

Page last reviewed
18 May 2026