Incident Response Tabletop — Ransomware at Northbeam Analytics

Friday afternoon at Northbeam Analytics — a mid-size SaaS with AWS + Datadog concentration and an on-call team running close to burnout — and the SOC dashboard lights up with simultaneous encryption alerts across three RDS instances and a customer-facing S3 bucket. You are the Incident Commander. You have ninety minutes before customers notice and regulators need to be told. Draft the first 90 minutes of an incident response plan: roles & decision rights, the communication tree, the containment sequence, and a recovery decision — score yourself against a four-criterion rubric and print the Tabletop Brief.