In the first hour of a ransomware incident, identify the affected systems and isolate them from the network. CISA advises taking the network offline at the switch level if several systems are hit, and powering devices down only when you cannot disconnect them, because shutdown loses evidence held in memory.
Step 1: find and isolate
CISA's checklist says to determine which systems are impacted and immediately isolate them. If many systems or subnets look affected, take the network offline at the switch level. If that is not possible, unplug devices or remove them from Wi-Fi. For cloud resources, snapshot volumes so you can examine them later.
Step 2: do not power down by reflex
Powering off feels safe. CISA says to do it only if you cannot disconnect devices or shut down the network, because you lose ransomware artifacts and evidence in volatile memory. That evidence can show how the attacker got in.
Step 3: communicate out of band
CISA recommends out of band channels such as phone calls. If your email or chat is on the compromised network, the attacker may see that you are responding and move faster. Keep a printed contact list for this reason.
Step 4: triage what to restore first
Use a predefined critical asset list and its dependencies. Track the systems you believe are unaffected so you can deprioritise them without forgetting them.
Step 5: look for earlier stage malware
CISA says to check antivirus, EDR, IDS and IPS records and logs for signs of earlier malware, and to look for precursor dropper malware before rebuilding from backups.
Step 6: start the notifications
Follow your incident response plan: involve IT, any managed security provider, your cyber insurer and leadership. CISA's guide lists reporting to CISA, your local FBI field office, the FBI's IC3, or your local U.S. Secret Service field office. If data was breached, follow your notification requirements.
What not to do yet
Do not wipe and rebuild immediately. CISA's containment guidance says that if no initial mitigation seems possible, take a system image and memory capture of sample devices and collect logs and malware samples first. Rebuild comes after you understand how the attacker got in.
Before the incident
Print this list and attach your own contact numbers. The NCSC also advises keeping offline playbooks. During an incident is a bad time to write a plan.
Quick check
Should we pull the power cable on every affected machine?
Only if you cannot disconnect them from the network. Disconnecting preserves memory. Powering off loses it, per CISA.
Who do we tell first?
Follow your incident response plan. It should name internal leads, your insurer and any external responders, then law enforcement reporting.
Sources
Last reviewed: 19 October 2026.
