Building a ransomware recovery plan that works under pressure

Act on containment and reporting together

The #StopRansomware Guide, published by CISA, MS-ISAC, the NSA and the FBI, covers prevention and a response checklist. Its first numbered response step is to identify affected systems and isolate them immediately. The instruction to follow the first three steps in sequence refers to numbered actions, not to completing every reporting activity before containment.

Do not wait for a notification form or a completed investigation before taking urgent, coordinated containment action. Assign technical containment, evidence preservation, legal reporting and communications to named people who can work in parallel. Reporting deadlines generally run from awareness of a qualifying incident; notify the relevant authority promptly while the technical team limits further damage. Coordinate isolation with incident responders and operational owners, especially where shutting down systems could affect safety.

Decide the roles before the crisis

Name who leads the response, who can authorise major decisions such as taking systems offline, and who owns the technical, legal and communications workstreams. CISA’s stakeholder list [CPG 4.A] is a good starting roster: internal IT, any managed security service providers, your cyber insurance company, and departmental or elected leaders. Add legal counsel – the payment question, if it arises, is a legal one before it is a commercial one.

The first 72 hours

The first 72 hours, and who says so

Window	Action	Source
First hour	Isolate impacted systems. If several subnets are affected, take the network offline at the switch level.	CISA #StopRansomware Guide
First hour	Move to out-of-band communication such as phone calls, so the actor is not tipped off that they have been discovered.	CISA #StopRansomware Guide
Within 24 hours	Early warning to the CSIRT or competent authority, if you are in scope.	NIS2 Article 23(4)(a)
Hours 1–48	Threat hunt: dropper malware, newly created AD accounts, anomalous VPN logins, shadow-copy deletion via vssadmin.exe, wbadmin.exe or bcdedit.exe.	CISA #StopRansomware Guide
Within 72 hours	Incident notification with an initial assessment of severity and impact, and the indicators of compromise available.	NIS2 Article 23(4)(b)
Within one month of notification	Final report: detailed description, likely root cause, applied and ongoing mitigations, and any cross-border impact.	NIS2 Article 23(4)(d)

Phase 1 – detection and analysis

Detection and analysis establish what happened, which systems are affected and whether the actor still has access. Continue this work while limiting harm; it is not a reason to postpone isolation of known affected systems. Preserve useful evidence where possible. CISA highlights abnormal changes to backups, shadow copies, disk journaling and boot configuration, including suspicious use of bcdedit.exe, fsutil.exe, vssadmin.exe, wbadmin.exe and wmic.exe. These are legitimate tools whose context and unexpected use matter.

Alongside that: newly created Active Directory accounts or unexplained privilege escalation, anomalous VPN logins, Cobalt Strike beacons named after legitimate Windows processes, unexpected remote monitoring and management software, unexpected PowerShell or PsTools use, and LSASS or Active Directory credential dumping. For exfiltration, look for abnormal outbound volume on any port, Chisel tunnelling SSH over HTTPS 443, abuse of Cloudflared tunnels, Rclone and Rsync, web file-storage services, and FTP or SFTP.

Two findings from this phase change everything downstream. The first is exfiltration, which changes your notification obligations and removes any assumption that a decryption key ends the matter. The second is precursor malware – CISA names Bumblebee, Dridex, Emotet, QakBot and Anchor – because “a ransomware event may be evidence of a previous, unresolved network compromise”.

Phase 2 – reporting and notification

Under Article 23(3) of NIS2, an incident is significant if it has caused or is capable of causing severe operational disruption of the services or financial loss, or has affected or is capable of affecting others by causing considerable material or non-material damage. If it qualifies, Article 23(4) sets four deliverables: an early warning within 24 hours of becoming aware; an incident notification within 72 hours with an initial assessment of severity, impact and available indicators of compromise; an intermediate report on request; and a final report no later than one month after the incident notification, covering a detailed description, the likely root cause, applied and ongoing mitigations and any cross-border impact. Trust service providers must send the incident notification within 24 hours. Where the incident is still ongoing at the one-month mark, you file a progress report instead, and the final report within one month of finishing.

In the United States, CISA directs victims to report to CISA, the local FBI field office, the FBI Internet Crime Complaint Center (IC3) or the US Secret Service. Reporting also matters if payment is ever discussed – see should you pay the ransom? for what a timely report does to your legal position.

Phase 3 – containment and eradication

Containment is where teams tip off the attacker. CISA is direct about it: “use out-of-band communication methods such as phone calls to avoid tipping off actors that they have been discovered … Not doing so could cause actors to move laterally to preserve their access or deploy ransomware widely prior to networks being taken offline.” Your incident bridge should not run on the mail system you are investigating.

Phase 4 – restore in an order you chose in advance

• Restore against a predefined critical asset list covering systems critical for health and safety, revenue generation or other critical services – and the systems they depend on.
• Bring things back “on a clean network”, not into the environment the actor still has access to.
• Track systems and devices not perceived to be impacted so they can be deprioritised – continue checking those systems for evidence of compromise; an initial lack of indicators is not proof that they are unaffected.
• Identify dropper malware before rebuilding from backups: CISA warns that actors “often drop ransomware variants to obscure post-compromise activity” and that care is needed “to prevent continuing compromises”.
• Consult law enforcement about available decryptors – researchers have broken the encryption in some variants and released tools.
• Reconnect systems and restore data from offline, encrypted backups based on a prioritisation of critical services, taking care not to re-infect clean systems during recovery.
• Confirm the entry point is closed before anything faces the internet again.

What a rehearsal actually surfaces

Exercise the plan with the actual decision-makers and record what needs changing. Agree a risk-based exercise schedule, for example an annual tabletop with additional rehearsals after major changes. Sophos’s The State of Ransomware 2026 provides recovery context: 55% of surveyed victims recovered within a week and 83% within a month, with an average recovery cost of USD 1.7 million excluding ransom. Those aggregate survey figures do not measure the causal benefit of rehearsal or predict your recovery time.

The other end is the part plans usually ignore. Virtually every organisation in that survey whose data was encrypted – 99% – reported lasting repercussions on the defending team: 41% increased anxiety or stress about future attacks, 40% increased pressure from senior leaders, 31% guilt that the attack was not stopped in time, and 29% staff absence due to stress or mental-health issues. For 21%, the team’s leadership was replaced as a direct result. Build shift rotation, handover and an explicit decision to stand people down into the plan, because a rehearsal is where you find out that three people hold every credential that matters.

The controls that make this plan executable – offline backups, segmentation, MFA and the logging the hunt phase depends on – are covered in the ransomware readiness checklist.