ransomware-response-in-otlisted

## When to Use - Ransomware indicators on an OT host: renamed files, ransom notes, encrypted historian archives. - Ransomware confirmed in IT or the DMZ with any path into OT. - Reports from operators of unreadable HMI screens or corrupt project files. - Enterprise SOC notification of ransomware in a shared service. ## Prerequisites - Zone and conduit map with Purdue levels for every affected host. - Approved conduit list from `ot-firewall-rule-review`. - Backup inventory: what is backed up, where, and whether the backup is offline. - Emergency contact list: operations manager, safety engineer, IT SOC, vendor contacts. - Firewall or VLAN access to apply isolation changes. - Credentials: read-only on OT hosts for confirmation, admin on the boundary firewall for isolation. - Authorization: operations manager approves isolation. IT security lead owns enterprise-side containment. - Upstream skills: `ot-network-isolation-procedure` for the isolation mechanics. This skill decides, that skill executes. ### Safety This skill is active. Isolation changes a live system and is gated in the Workflow section. - Active. Applies firewall or VLAN changes to live segments. Requires operations manager approval. Human safety and process integrity outrank containment. ## Workflow > SAFETY: If at any point the action risks human safety or process integrity, halt and escalate to the operations lead before continuing. 1. Confirm the decision authority. The operations manager owns any actio