Downloadable template

Checklist: responding to ransomware

Print it and keep it with your response plan, outside your usual systems. It assumes your main systems may be unavailable.

How to use it

Use this list as a memory aid, not a complete plan. The big decisions (whether to pay, who to notify, when to restart) belong to your leadership, with your legal advisers and insurer. Prepare the contact details in advance: in the middle of a crisis, nobody finds a phone number.

Download (Word, .docx)

1. In the first hour: contain

Isolate affected devices from the network (unplug the cable, disable Wi-Fi) without powering them off, to preserve evidence in memory.
Disable compromised accounts and, if needed, cut remote access (VPN, remote desktop).
Protect backups: disconnect or lock them before they are encrypted or deleted.
Activate your crisis team and open a time-stamped log of every finding and decision.
Communicate out of band (phone, personal messaging): assume the attacker can read your email and chat.

2. Within 24 hours: assess

Identify what is affected: systems, data, sites, suppliers and customers involved.
Find the likely entry point and check whether data was copied before encryption (double extortion).
Take a snapshot of what is affected (disk images, logs) before any rebuild.
Notify your cyber insurer and your legal counsel; respect the reporting deadlines in your policy.
Bring in an incident response team, internal or external, if you lack the expertise.

3. Decisions and notifications

Report the incident to law enforcement and the competent cybersecurity agencies in your country.
Determine notification duties: regulators, affected individuals, customers, partners (DORA, NIS2, GDPR, Law 25, sector rules).
Record the ransom decision: who decides, on what basis, with what advice. Check sanctions exposure first.
Prepare a single, factual communication for staff, customers and the media.

4. Recovery

Rebuild from clean sources: validated images, backups tested and scanned before restoration.
Reset all credentials (service accounts, administrators, access keys) before reconnecting anything.
Restore in business-priority order, based on your impact analysis and recovery objectives (RTO/RPO).
Monitor restored systems closely: the attacker may have left persistent access.

5. After the incident

Hold a blameless review within two to four weeks.
Fix the root cause and the gaps found (access, segmentation, backups, detection).
Update the response plan, the contact details and the exercise scenarios.
Schedule an exercise that replays the scenario to confirm the fixes work.

Sources

This list draws on public good practice, including the guides above; it is neither endorsed nor published by those agencies.

General-purpose template provided as a starting point. Adapt it to your organization and have it reviewed by your legal, compliance and security advisers before use. It is not legal advice.