A ransomware attack has hit your organization. Encrypted files have disrupted critical business functions. You’ve isolated the infected systems, notified leadership, and begun forensic analysis. The CEO is demanding immediate restoration. Backups are available but untested. What is the BEST next action?
A. Begin restoration from backups immediately.
B. Pay the ransom to recover data quickly.
C. Validate the integrity of backups before starting restoration.
D. Rebuild affected systems from scratch using original install media.