Understanding ransomware incidents through CyBOK
Understanding the impact of ransomware requires more than counting compromised devices or exposed records. It also means identifying which business activities may stop and who is responsible for the decisions that follow. Using Keio Group’s incident announcement as a starting point, this article shows how CyBOK Knowledge Areas can help you identify the knowledge needed to consider appropriate measures.
What Keio Group’s announcement tells us
Keio Corporation announced that it had confirmed a ransomware attack on the group’s servers in the early hours of 26 September 2026. Its announcement that day stated that the business systems of some group companies were affected, while railway operations were unaffected and no information leakage had been confirmed [1]. It is important to distinguish the impact on business systems from the impact on railway operations. This announcement alone does not establish the route of entry, the total financial damage or the technical reasons why the impact was limited.
Identify which business activities could stop
The question to consider is who would be affected, and how, if a similar disruption occurred in your organisation. If reservations, order processing, invoicing and customer support depend on shared authentication or networks, a single incident could affect several activities. This is a question for examining your own dependencies, rather than an assumption about Keio’s systems. Alongside an inventory of servers, identify the activities that could stop, alternative ways of working, the data required and the people authorised to decide when operations can resume.
Consider three CyBOK Knowledge Areas
Risk Management & Governance provides a starting point for considering what to protect and which activities to prioritise. Security Operations & Incident Management covers the knowledge needed to recognise anomalies, coordinate with stakeholders and make decisions about response and resumption. Network Security helps you understand communications and boundaries, and consider where the spread of an incident might be contained. These are learning connections made in this article; they do not imply that CyBOK has assessed the causes of, or measures taken in, the Keio incident. Moving between these three areas makes it easier to consider technical measures and management decisions as parts of the same problem.
Prepare to make decisions about stopping systems
We suggest reviewing the separation of networks and access privileges supporting critical activities, and deciding in advance what should be disconnected, and by whom, when a compromise is suspected. Disconnection can limit damage, but it also affects operations. Tabletop exercises involving management and business teams are needed to consider both consequences. For example, use a scenario in which an order-processing system must be stopped while customer enquiries are rising sharply. Practise deciding how to receive orders through alternative channels, explain the situation to customers and prioritise recovery.
Start with one business activity
Choose one important activity, such as order processing or customer support. Write down the consequences of stopping it, the systems it depends on, alternative arrangements and who decides when it can resume. Then read the CyBOK material on risk management and incident management, and identify anything you cannot explain. Isolation and evidence preservation may be useful starting points for technical staff; alternative ways of working for business teams; and decisions about stopping and resuming operations for management. Once you have organised the relevant knowledge, the next step is to test those decisions with stakeholders in a tabletop exercise.
Next to read
How to Learn Cybersecurity Systematically — Using CyBOK as a “Map”
Use Knowledge Areas to locate your learning within the wider field and identify related topics.
Turning Knowledge into Practice — What Can You Learn with a Cyber Range and SudoRange?
Discover how a safe exercise environment can connect knowledge with practical actions and decisions.
References
[3] CyBOK Knowledgebase v1.2, list of Knowledge Areas.
CyBOK Attribution
CyBOK Version 1.2.0 © Crown Copyright, The National Cyber Security Centre 2026, licensed under the Open Government Licence: http://www.nationalarchives.gov.uk/doc/open-government-licence/.