First, invoke your approved incident response plan. Isolate affected systems without powering them off, preserve evidence, bring in legal counsel and incident responders, and start a decision log. CISA's joint ransomware guide gives a response checklist, and it asks you to follow its first three steps in sequence.
What does the official guidance say?
CISA, the NSA, the FBI and the Multi-State Information Sharing and Analysis Center wrote the Ransomware and Data Extortion guide. Part 2 is a response checklist, organised under detection and analysis, containment and eradication, and recovery and post-incident activity. It begins with a plain instruction: follow your approved incident response plan.
That is the reminder that matters most for a CISO. The worst time to decide who has authority is during the incident. If the plan has not been written, tested and approved by executives, the first hours go to arguing about it.
What happens in the first hour?
Work these in parallel, with named owners.
Contain. The guide says to determine which systems are affected and isolate them immediately. If many systems or subnets appear affected, take the network offline at the switch level rather than relying on shutting machines down. Where you cannot disconnect, power down devices as a last resort, with the understanding that you may lose volatile evidence.
Preserve. Keep logs, ransom notes, sample encrypted files and any suspicious binaries. Take snapshots of affected virtual machines before changing them. Record times and actions as you go.
Escalate. Notify the executive team, legal counsel and your cyber insurer if you have a policy, because policies often require early notice. Engage an incident response firm if you have one on retainer.
Protect what is still clean. Take backups offline or disconnect them so the attacker cannot reach them. Reset credentials for privileged accounts, starting with those the attacker is likely to have used.
Open a decision log. Time, decision, who decided, why. It becomes your record for regulators, insurers and your own review.
What about the decision to pay?
CISA's guidance and law enforcement generally discourage payment, noting that it does not guarantee data recovery and may encourage further attacks. Payment can also raise legal issues, such as sanctions exposure, which is for counsel to assess. Decide with legal advice and the executive team, and document the reasoning either way. This post is not legal advice.
Who needs to be told, and when?
Reporting duties vary by country, state, sector and contract. Customers, regulators and law enforcement may each have a deadline. The guide recommends reporting to CISA, the FBI or the relevant law enforcement body. Ask counsel to map your obligations before an incident, and keep the list near the plan.
Communicate to staff in plain words, and agree one spokesperson. Silence invites rumour. Over-sharing technical details before they are verified can add risk.
How does recovery start?
Do not restore into a network that is still compromised. Confirm how the attacker entered and how they moved, close that path, then rebuild from known good images, restoring data in an order set by business priority. Test restores in a clean segment before reconnecting. Reset all credentials, including service accounts and keys, because the attacker may hold copies.
A constructed example
A regional distributor finds file servers encrypted at 2 a.m. The on call engineer pulls the affected switch uplinks, the CISO opens the plan and appoints a scribe for the decision log, and the legal lead calls the insurer's hotline. The team finds backups were on the same domain as production and disconnects them before the attacker reaches them. By morning they know the entry point was a remote access account with no second factor. Recovery begins from rebuilt servers and offline backups, and the account policy is the first fix.
How to check or apply this before an incident
- Write the plan, name the decision makers and get written executive approval.
- Print or store a copy outside your own network.
- Keep offline, tested backups of critical systems.
- Pre-agree retainers with responders and counsel.
- Keep a contact list with regulators, insurer and law enforcement.
- Run a tabletop exercise twice a year.
- Know your restore time for your top five systems.
Quick check
Should I shut down infected machines immediately?
Isolating from the network is preferred. Powering down loses volatile evidence, so treat it as a last resort when you cannot disconnect.
Do I need a decision log?
Yes. It supports legal, insurance and regulatory reviews and helps your team learn afterwards.
Sources
Last reviewed: 18 October 2026.
