In the first hour of a ransomware attack, isolate affected systems without alerting the attacker, avoid powering machines off, preserve evidence, triage what matters most, and bring in your insurer, leadership and law enforcement. CISA's guidance for victims lays out these steps.
1. Isolate, but quietly
Identify the affected systems and cut them off. CISA says that if several systems or subnets look compromised, take the network offline at the switch level. If you cannot, unplug the devices or disconnect them from Wi-Fi. For cloud resources, snapshot the volumes first so you can review them later.
Attackers may be watching your email and chat. Use out-of-band channels such as phone calls to coordinate, or they may move laterally or deploy more widely before you cut access.
2. Do not power off by reflex
Power down a device only as a last resort, when you cannot disconnect it any other way. Shutting down can destroy evidence held in memory. Highly volatile data such as memory and Windows Security logs can be lost quickly.
3. Triage against a list
Check the impacted systems against your list of critical assets, and also track the systems that look unaffected. This is where a current asset inventory pays off. If you do not have one, build it now in a spreadsheet from what people tell you, and fix the process later.
4. Tell the right people
Engage internal teams, managed security providers and your cyber insurer as your plan directs. Report the incident to CISA, your local FBI field office, IC3 or a Secret Service field office. Check your legal duties too. See breach notification deadlines for one example.
5. Ask about decryptors
CISA advises consulting federal law enforcement about available decryption tools, even if mitigation is possible, because researchers have sometimes found flaws in specific ransomware variants. This is a question to ask early, not a reason to wait.
6. Preserve evidence
If you cannot contain the spread right away, image affected systems, capture memory, and collect logs and malware samples. You will need them for the investigation, for insurers and sometimes for regulators.
What not to do
- Do not reboot, wipe or reimage machines before capturing what you need.
- Do not log in to compromised systems with domain admin accounts.
- Do not announce details publicly before legal and communications leads agree.
- Do not decide on any payment in the first hour. See the ransom payment decision.
Quick check
Should we shut everything down?
Disconnect rather than power off. Powering off can destroy volatile evidence, and CISA lists it as a last resort.
Who do we call first?
Follow your plan. In most cases that means the incident lead, then your insurer and counsel, then law enforcement.
Sources
Last reviewed: 19 October 2026.
