Ransomware Playbook Builder (CISA)
Drafts a ransomware incident response playbook and checks readiness against CISA and NIST guidance.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent can produce a structured ransomware incident response playbook covering preparation, detection, containment, eradication, recovery and post-incident review, with checklists aligned to the CISA StopRansomware Guide and the NIST Cybersecurity Framework. It also includes a Python script that holds a preparation checklist and can produce a gap analysis of an organization's readiness. The agent is told to defer to legal counsel on ransom payment and breach notification decisions.
Great for
- Security teams drafting or updating a ransomware response plan
- Compliance staff documenting CISA or NIST CSF alignment
- Facilitators preparing tabletop exercises
Skip it if
- Live incident response: the checklists are generic and cannot replace experienced responders or legal advice on payments or notification duties
- Organizations expecting authoritative legal or regulatory compliance sign-off, since the skill itself says to consult counsel
Try asking
- “Create a ransomware incident response playbook for our mid-size company aligned with CISA StopRansomware and NIST CSF”
- “Run a CISA-aligned readiness assessment against our current controls and list the gaps”
- “Write tabletop exercise scenarios and checkpoints using our ransomware playbook”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
building-ransomware-playbook-with-cisa-framework.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip building-ransomware-playbook-with-cisa-framework.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip building-ransomware-playbook-with-cisa-framework.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review the generated playbook with legal counsel before adopting it, especially ransom payment and notification sections
- Provide your real asset inventory and backup details so the gap analysis reflects your environment
- Test any restoration steps in a non-production environment before relying on them
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.