The Cyber Incident Response (IR) workshop is full day, comprehensive workshop that will help you understand what you need to do to prepare before, during, and after a ransomware attack or breach. The morning session will be a planning session led by industry IR leaders who will coach you through preparation to post-incident activities from hour 1 to 48 months out after a ransomware attack. At the end of this session, you will have completed the K12 SIX IR planning template and understand how to use it in case of an incident. The afternoon session will be a hands-on IR/Breach exercise presented by Microsoft. During the hands-on session, you will navigate a virtual environment that has suffered a ransomware attack and learn what you need to look for and what you need to be aware of in a real-world scenario. (Breakfast and lunch are provided.)