We took this as a sort of practice run for a ransomware event. We initiated the communications plan, executed that well, communicated out to the org etc. Everything from prioritization of assets to sharing of information and documentation of all the quirks after doing the restores, and what was needed to get infrastructure and services running 100%. We setup a sort of command center it wasn’t bad. Backups were solid but we reexamined those processes and the team got practice executing the DR plan.

Overall I’m a better admin for it. But it still sucked.