Whether to pay a ransom is a business and legal decision, not a technical one, and no checklist makes it for you. What you can do is answer a set of questions first: can you restore, what is stolen, what does the law allow, and who must be told. Many teams skip these under pressure.
What the CISA guide does and does not say
CISA's #StopRansomware guide does not state a payment policy. It describes how attackers demand ransom for decryption and pressure victims by threatening to release stolen data. It also notes that some ransomware tries to delete or encrypt backups so that restoration is impossible unless the ransom is paid. The practical advice it gives is to consult federal law enforcement about decryption tools and to report the incident.
Other government and insurer statements exist. This post does not cite them because their current wording was not confirmed here. Ask your counsel for the current position in your jurisdiction.
Questions to answer first
- Can we restore without the key? Test your offline backups and the time to rebuild. If restoration is realistic, the decision changes.
- Is a decryptor available? Ask law enforcement. CISA says researchers have found flaws in some variants.
- What was taken? Encryption and theft are separate problems. Paying for a key does not undo stolen data, and the guide describes extortion by threatening release.
- What does the law say? Payments can raise legal questions that vary by country and by the group involved. Get counsel involved before any contact with the attacker.
- What does insurance require? Policies often have notice and consent conditions. Read yours now.
- What must we report? See below.
Reporting duties
The Cyber Incident Reporting for Critical Infrastructure Act of 2022 would require covered entities to report a covered cyber incident within 72 hours and a ransom payment within 24 hours. CISA's page says the proposed rule was published on 4 April 2024 and that mandatory reporting does not begin until a final rule takes effect, with no date given. Voluntary reporting is encouraged. See CIRCIA explained.
Decide as a group, in writing
Record who decided, what information they had and what advice they took. Use the incident lead, legal, finance and an executive. Write the decision down while it is fresh, because it will be questioned later.
The best time to decide is before an attack
Settle your internal approach in advance, in a tabletop exercise. A calm discussion on a Tuesday beats an improvised one at midnight. See how to run a tabletop exercise.
Quick check
Does paying guarantee we get our data back?
No source I fetched promises that. Treat any attacker claim with caution and plan to rebuild from clean backups either way.
Is this legal advice?
No. Speak to qualified counsel in your jurisdiction.
Sources
Last reviewed: 19 October 2026.
