Mandiant responds to over 1000 incidents a year including some of the largest ransomware incidents. Based on our experiences, Mandiant has identified consistent themes and challenges that organizations face when recovering from a ransomware incident. The goal of this presentation is to bring awareness to these challenges and provide considerations for how an organization may choose to address them.