## Cambium Data Blog
Cambium Data has been serving the Omaha area since 2009, providing IT Support such as technical helpdesk support, computer support, and consulting to small and medium-sized businesses.
[ Categories ](https://cambiumdata.directivesites.com/blog/categories "Categories")
[ Tags ](https://cambiumdata.directivesites.com/blog/tags "Tags")
[ Categories: All Categories ](https://cambiumdata.directivesites.com/javascript:void(0); "Categories")
Search...Suggested keywords
[ x ](https://cambiumdata.directivesites.com/javascript:void(0);)
# Test Your Incident Response with a Hypothetical Crisis
[Cambium Data Blog](https://cambiumdata.directivesites.com/blog/categories/blog) [Business](https://cambiumdata.directivesites.com/blog/categories/business)
[Tony Underwood](https://cambiumdata.directivesites.com/blog/blogger/tony-underwood)
Friday, 08 May 2026
[ 0 Comments ](https://cambiumdata.directivesites.com/blog/test-your-incident-response-with-a-hypothetical-crisis#comments)
[  ](//cambiumdata.directivesites.com/images/easyblog_shared/May_2026/05-08-25/IncidentResponse_1879035681_400.jpg "Test Your Incident Response with a Hypothetical Crisis")
Imagine getting to the office Tuesday morning, ready for another productive day, when your lead admin walks in with bad news. The file infrastructure is down, and so is everything else. It’s been encrypted by ransomware, and you’re the latest target of a zero-day ransomware attack that managed to bypass your antivirus. What do you do?
That’s what we’re here to find out. Let’s walk through a hypothetical situation to test your incident response readiness.
## Phase 1: Containment
The ransomware is moving across your network, actively hunting down backups so it can delete them.
Do you have a kill switch protocol? Your team must immediately disconnect the infected machines from both the wireless and wired networks. Don’t worry about a graceful disconnection; this is manual isolation to keep the rest of your network safe.
Make sure your employees know how to physically isolate their machines without waiting for IT approval in the event of a crisis.
## Phase 2: The Backup Audit
Once your IT partner has been notified, you need to remember one key statement: “I’m not paying the ransom.”
You can restore a backup, provided it’s available. So, are your backups immutable? These days, hackers target standard cloud backups first, and if your backups are read/write, the hacker has probably already encrypted those, too.
If your backups were deleted right now, do you have an off-network or immutable backup that the hackers can’t touch?
## Phase 3: The Virtualization Pivot
While you’re figuring out this whole mess, you have clients calling and a team that’s sitting around idly.
This downtime is costing you thousands in billable revenue and reputation loss. Can you virtualize your business to get it back in order before it collapses under the downtime? With a modern Backup and Disaster Recovery solution, you don’t have to wait for your physical servers to be rebuilt; you just spin up a clean backup in the cloud. Your team can log back in and get to work on the “clone” of your business while the cleanup of the physical hardware happens in the background.
So, can you get back to 100 percent productivity in under 4 hours, or are you looking at a four-day rebuild?
## Phase 4: Forensics and Compliance
With the immediate crisis resolved, it’s time to turn toward the legal work required.
You’ll probably have reporting requirements for your insurance and potentially your state’s data privacy board. Do you have a breadcrumb trail you can follow to figure out what data was accessed and how? If you have Endpoint Detection and Response, you can show how the breach was contained to a single folder and no client data was stolen. Without those logs, you have to assume the worst and notify every client that you’ve been had—and that’s both embarrassing and potentially damaging.
Check to make sure you have forensic logs required by your cyber-insurance policy and other regulatory bodies to prove you weren’t negligent.
So how did it go? Think you’re ready to handle a potential crisis? Whether you failed the drill or not, know Cambium Data can get your incident response to where it needs to be. Learn more today by calling us at (402) 514-3200.
[ ](https://cambiumdata.directivesites.com/javascript:void(0);) [ ](https://cambiumdata.directivesites.com/javascript:void(0);) [ ](https://cambiumdata.directivesites.com/javascript:void(0);)
Tags:
[Backup](https://cambiumdata.directivesites.com/blog/tags/backup) [Disaster Recovery](https://cambiumdata.directivesites.com/blog/tags/disaster-recovery) [Ransomware](https://cambiumdata.directivesites.com/blog/tags/ransomware)
[ Your Complete Guide to Backup Best Practices ](https://cambiumdata.directivesites.com/blog/your-complete-guide-to-backup-best-practices)
[ A Small Business Guide to the Trustworthy 3-2-1-1 ... ](https://cambiumdata.directivesites.com/blog/a-small-business-guide-to-the-trustworthy-3-2-1-1-rule)
About the author
[  ](https://cambiumdata.directivesites.com/blog/blogger/tony-underwood)
[Tony Underwood](https://cambiumdata.directivesites.com/blog/blogger/tony-underwood)
[ ](https://cambiumdata.directivesites.com/blog/blogger/tony-underwood)
Tony Underwood, Founder and President of Cambium Data Inc. has proven himself as one of the top internetworking experts in the industry. Mr. Underwood began his IT career in 1991 in the US Navy working on critical military computer systems. He grew his computer and networking knowledge through a number of different IT jobs from desktop support all the way up to leading the Network Engineering organization of a multi-billion dollar international company. Mr Underwood was recognized as Cisco Certified Internetwork Expert [\#7112](https://connect.directive.com/v4_6_release/services/system_io/Service/fv_sr100_request.rails?service_recid=7112&companyName=Dti) in March of 2001 and in 2022 he achieved the lifetime status of Cisco CCIE Emeritus
Author's recent posts
[More posts from author](https://cambiumdata.directivesites.com/blog/blogger/tony-underwood)
[ Thursday, 03 September 2026 Cambium Data launches new website! ](https://cambiumdata.directivesites.com/news-a-events/launches-new-website)
[ Wednesday, 02 September 2026 How to Avoid the 4 Common Backup Failures ](https://cambiumdata.directivesites.com/blog/how-to-avoid-the-4-common-backup-failures)
[ Monday, 31 August 2026 Securing Remote Work Without Micromanaging Your Team ](https://cambiumdata.directivesites.com/blog/securing-remote-work-without-micromanaging-your-team)
Comments
No comments made yet. Be the first to submit a comment
**** Already Registered? [Login Here](https://cambiumdata.directivesites.com/home/login-logout?return=aHR0cHM6Ly9jYW1iaXVtZGF0YS5kaXJlY3RpdmVzaXRlcy5jb20vYmxvZy90ZXN0LXlvdXItaW5jaWRlbnQtcmVzcG9uc2Utd2l0aC1hLWh5cG90aGV0aWNhbC1jcmlzaXM=)
Thursday, 03 September 2026
Subscribe to the blog (Please fill in your email address to subscribe to updates from this post.)
**Captcha Image**