Ransomware Response Playbook: Decisions for the First 72 Hours

The first 72 hours of a ransomware attack are a chain of decisions that each close an option: isolating, calling, scoping, restoring, paying, disclosing. Take them in the wrong order and you lose evidence, tip off the attacker, or give up a legal mitigation you could have kept.

This guide is for the IT director, security lead or CISO who is facing encryption this morning or rehearsing it, and for the executive who signs the pay or no-pay decision. It sets out who decides what, in which hour, and what to write down. The order is our analysis of CISA, OFAC, SEC and Microsoft guidance.

What should you do first after a ransomware attack?

Do these six things, in this order:

1. Open an out-of-band channel, then isolate in a coordinated way.
2. Call your insurer and outside counsel.
3. Report to the FBI or CISA.
4. Scope encryption, identity and data theft.
5. Restore from a verified clean point.
6. Decide payment and disclosure on the facts.

Two things run from hour 0 and do not wait for scoping: the law-enforcement report and the disclosure clock. Both have owners named in the first hour.

Hour 0-1: what do we do before touching a system?

Open a channel that does not depend on your own systems, name the people who own the decisions that cannot wait, and only then isolate. CISA warns that attackers "may monitor your organization's activity or communications," so it advises isolating in a coordinated manner and using out-of-band methods "such as phone calls" to avoid tipping them off (CISA, "I've Been Hit By Ransomware!"). Skipping that could let the actors move laterally to preserve access, or deploy ransomware widely before the networks go offline.

1. Within 15 minutes, the IR lead moves everyone involved to phone calls or a messaging account that is not in your tenant, and confirms by roll call that each decision-maker is on it. Treat email, chat and the directory as compromised. Verify: a written list of who is on the channel.
2. Within the first hour, the CISO names the owner of the disclosure clock (usually the general counsel or their delegate) and one contact owner for the attacker. Verify: both names are in the decision log. The contact owner matters because the FBI observed Gunra actors trying to reach management staff at victim companies directly by email to solicit payment, with limited success (FBI/CISA advisory AA26-222A). Executives should forward anything from the attacker to that person and answer nothing.
3. Within the first hour, the IR lead tells staff not to delete ransom notes, because CISA's law-enforcement list says of the readme file: "DO NOT REMOVE the file or decryption may not be possible." Keep every communication with the attacker.

How do we isolate without destroying evidence?

Disconnect affected systems from the network and leave them powered on. Power them off only if you cannot disconnect them: CISA's step says power down "if you are unable to disconnect them," and its note warns this destroys artifacts "stored in volatile memory." CISA also tells responders to move through its first three steps in sequence.

Identity containment is separate and also belongs here. Microsoft's guidance for this stage is to disable privileged accounts except a small number your administrators use to reset Active Directory, and to reset the krbtgt password twice in rapid succession. Your IR firm should sequence these steps.

Correction: "never power off an infected machine." The rule is close, but CISA does not make it absolute. Its order is isolate first and power down only when you cannot disconnect, and Microsoft agrees on keeping isolated systems on. The domain-controller exception above is Microsoft's, for the identity system.

Verify the step: the decision log shows the time each segment was cut, who cut it, and which hosts were left running.

Who do we call, and in what order?

Call your insurer and outside counsel first, then the IR firm, and report to the FBI or CISA within the first day, before any payment is on the table. CISA lists the cyber insurance company among the stakeholders to notify, alongside IT, managed security providers and leaders. Everything after that is our recommended order.

1. Insurer, within the first hours (CISO or risk manager). Check your policy for notice timing and for any panel vendors it requires before you sign anyone. Policies differ, so read yours rather than assume. Verify: the claim number is in the log.
2. Outside counsel (general counsel). Counsel owns the sanctions screening, the privilege questions and the disclosure analysis. Ask your counsel how to engage the IR firm. Do not assume routing through counsel protects the report: in the Capital One litigation (E.D. Va., June 25, 2020) the court held the Mandiant report was not protected work product, even though the company had arranged to receive it through its law firm: Capital One had already contracted with Mandiant to provide that information to it directly.
3. IR firm (CISO, with counsel's agreement and, where your policy requires it, the insurer's). It takes over memory capture, imaging and the identity sequence above.
4. FBI field office or IC3, and CISA (CISO or counsel), within 24 hours. CISA says to report to CISA, your local FBI field office, the FBI's Internet Crime Complaint Center (IC3) or the Secret Service. The FBI and CISA ask for the report "regardless of whether you or your organization have decided to pay" (AA26-222A). Under OFAC's 2021 advisory, OFAC will consider a "self-initiated and complete report" made "as soon as possible after discovery" a voluntary self-disclosure and a significant mitigating factor in its enforcement response. If you wait until a payment is on the table, you may lose it. While you are on the phone, ask whether a decryptor already exists.

Nobody except the named contact owner talks to the attacker, and that person does nothing until counsel and the insurer are in. Our reasoning: an early reply can create sanctions exposure and a record you did not control, and it closes the option of deciding calmly. OFAC says payment facilitators, including insurers and digital forensics and incident response firms, may themselves risk violating its regulations.

Hours 1-24: what has the attacker actually done?

Scope three things separately, because each leads to a different decision: what is encrypted, whether identity is compromised, and whether data left the network. Ransomware may be the last step of an older intrusion (CISA says the event "may be evidence of a previous, unresolved network compromise"), so scoping looks backward as well as at today's encryption.

• Encryption (IT lead): which systems, which backups, which business services. Feeds the restore decision.
• Identity (identity owner, with the IR firm): the systems and accounts involved in the initial breach, which CISA notes can include email accounts, plus newly created Active Directory accounts or accounts with escalated privileges and recent activity on privileged accounts such as Domain Admins.
• Data theft (IR firm): potential signs of data exfiltrated from the network. CISA notes that actors sometimes steal data and threaten to publish it before ransoming the network. A leak-site claim alone is not proof either way; confirm theft in your own telemetry.

Where an AI agent helps. A defensive agent can triage logs, flag new privileged accounts and large outbound transfers, and draft the timeline for the IR firm. It needs read-only access to log stores and a human who confirms every finding before it enters the decision log. It should not isolate hosts or disable accounts on its own authority.

Verify the step: each of the three questions has an answer of "yes," "no" or "not yet known," with the evidence behind it, in the decision log. Scoping feeds the disclosure analysis, which runs alongside it.

Hours 24-72: do we restore?

Restore only from a verified clean point, into an isolated network, identity first. CISA says to identify dropper malware "before rebuilding from backups," to restore from offline, encrypted backups in order of critical services, and to add only clean systems to any new VLAN. The same guide places password resets for all affected systems "once the environment has been fully cleaned and rebuilt," which is a different step from Microsoft's early identity containment above; do both, at their own times. Microsoft's recovery planning treats restore as the alternative to paying a ransom. Backup design and restore testing are covered in our immutable backups guide.

How long this takes varies widely. In Sophos's 2026 State of Ransomware in the U.S. survey of organizations with 100 to 5,000 employees, 53% fully recovered within a week and 24% took one to six months (a vendor-commissioned, self-reported survey).

Should we pay the ransom?

Not by default. Paying is a legal and business decision. The U.S. government "strongly discourages" payment, which is not a general ban, and it buys a decryptor at best. Make the decision after restore options are known, from a written record.

What payment does not buy. CISA's guide says paying "will not ensure your data is decrypted, that your systems or data will no longer be compromised, or that your data will not be leaked." For a public company it also does not end the materiality duty (see the disclosure section). The FBI and CISA state they "do not encourage paying ransom," because payment does not guarantee recovered files.

The sanctions exposure. OFAC liability is strict: a company may be liable "even if such person did not know or have reason to know" that the transaction was prohibited. Licenses for payments with a sanctions nexus are reviewed with a presumption of denial. See OFAC's Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (September 21, 2021).

Correction: "paying ransomware is illegal." It is not a general rule. The government strongly discourages payment, and a payment to a sanctioned party or a sanctions-nexus recipient is where the legal exposure sits: OFAC's advisory says it may impose civil penalties on a strict-liability basis. A report to law enforcement early counts in your favor. Treating "don't pay" as if it were law skips both the screening and the report.

Do we have to disclose?

Start the analysis at discovery and run it alongside scoping; the scoping facts finish it. The owner you named in hour 0-1 runs this.

• Public companies. The SEC requires the materiality determination "without unreasonable delay after discovery." Once the company determines that the incident is material, an Item 1.05 Form 8-K is due within four business days after that determination. SEC staff interpretations say ending the incident, including by paying a ransom, does not relieve the company of the determination, and that the ransom size is only one factor (SEC Form 8-K staff interpretations). See our SEC incident disclosure guide.
• Health data. Under the HIPAA breach rule (45 CFR 164.402), an acquisition, access, use or disclosure of protected health information that the rule does not permit is "presumed to be a breach" unless a risk assessment shows a low probability that protected health information was compromised, and one factor is "whether the protected health information was actually acquired or viewed." Our reading: encryption alone does not clear a health-sector company of notice duties, and your theft scoping feeds the assessment directly. See our HIPAA breach notification guide.
• State laws and contracts. Whether encryption-only or confirmed exfiltration triggers notice varies by state, and customer contracts carry their own clocks. Counsel decides; see our multistate breach notification procedure.
• CIRCIA. As of November 9, 2026, covered-entity incident and ransom-payment reporting under CIRCIA is not required, because CISA's CIRCIA page says it will not be required until the final rule goes into effect, and the final rule has not been published.

The decision log

Keep one log, in one place the team can reach during the incident, and write each irreversible decision into it before you act on it. Copy the fields below into your ticketing system or fill them in here; your answers stay in your browser.

Rehearse this order with your team before you need it; our cybersecurity tabletop exercise guide shows how.