A prepared electrical contracting business should develop a written ____ that outlines communication protocols, containment steps, and procedures for restoring compromised systems from backups after a cyberattack.

An electrical contracting company discovers that its scheduling software and customer database have been locked by a cyberattack. According to the "Respond and Recover" functions of cybersecurity, which of the following is the appropriate course of action?

Your electrical contracting business is experiencing a ransomware attack that has locked your main scheduling computer. You immediately activate your written incident response plan. Match each practical action taken by your team to the corresponding component of the response plan.

To minimize business downtime during a ransomware attack, an electrical contractor's incident response plan should prioritize immediately restoring compromised systems from backups before taking steps to contain the threat.

An electrical contracting business is hit by a cyberattack that encrypts its project management files. Evaluate the scenario to determine the most effective strategy for managing the crisis. Arrange the following incident response steps in the optimal order, prioritizing threat containment before operational recovery.