Many companies have already implemented ransomware countermeasures. However, it is critical to not only prevent incidents but also prepare for when they occur. There are numerous issues to consider, including investigation and analysis, forensic response, decisions regarding ransom demands, consulting with experts, reporting obligations, public disclosure, and measures to prevent recurrence. In this session, we will explain these key points and work together to explore the most effective solutions.