Building a ransomware recovery plan that works under pressure

Use CISA’s order, not your instinct

The #StopRansomware Guide, written by CISA with MS-ISAC, the NSA and the FBI, is in two parts: prevention best practices, and a response checklist. The checklist is explicitly ordered, and the guide says so in as many words — "be sure to move through the first three steps in sequence": Detection and Analysis, then Reporting and Notification, then Containment and Eradication. Recovery and the post-incident review follow.

Reporting sitting before containment surprises most teams, because containment feels like the urgent thing. The sequence is deliberate. The regulatory clock starts when you become aware of the incident, not when you have finished handling it, and under Article 23(5) of the NIS2 Directive the CSIRT or competent authority responds where possible within 24 hours with initial feedback and, on request, guidance and technical support. Notifying early buys you help; notifying late buys you nothing. Article 23(1) removes the usual excuse: "the mere act of notification shall not subject the notifying entity to increased liability".

Decide the roles before the crisis

Name who leads the response, who can authorise major decisions such as taking systems offline, and who owns the technical, legal and communications workstreams. CISA’s stakeholder list [CPG 4.A] is a good starting roster: internal IT, any managed security service providers, your cyber insurance company, and departmental or elected leaders. Add legal counsel — the payment question, if it arises, is a legal one before it is a commercial one.

The first 72 hours

Phase 1 — detection and analysis

The goal of the first phase is not to fix anything. It is to establish what happened, how far it reached, and whether the actor is still inside. CISA’s hunt list is specific enough to hand to an analyst: endpoint modifications that impair backups, shadow copies, disk journaling or boot configuration, and anomalous use of built-in Windows tools — bcdedit.exe, fsutil.exe (deletejournal), vssadmin.exe, wbadmin.exe and wmic.exe (shadowcopy or shadowstorage). "Misuse of these tools is a common ransomware technique to inhibit system recovery."

Alongside that: newly created Active Directory accounts or unexplained privilege escalation, anomalous VPN logins, Cobalt Strike beacons named after legitimate Windows processes, unexpected remote monitoring and management software, unexpected PowerShell or PsTools use, and LSASS or Active Directory credential dumping. For exfiltration, look for abnormal outbound volume on any port, Chisel tunnelling SSH over HTTPS 443, abuse of Cloudflared tunnels, Rclone and Rsync, web file-storage services, and FTP or SFTP.

Two findings from this phase change everything downstream. The first is exfiltration, which changes your notification obligations and removes any assumption that a decryption key ends the matter. The second is precursor malware — CISA names Bumblebee, Dridex, Emotet, QakBot and Anchor — because "a ransomware event may be evidence of a previous, unresolved network compromise".

Phase 2 — reporting and notification

Under Article 23(3) of NIS2, an incident is significant if it has caused or is capable of causing severe operational disruption of the services or financial loss, or has affected others by causing considerable material or non-material damage. If it qualifies, Article 23(4) sets four deliverables: an early warning within 24 hours of becoming aware; an incident notification within 72 hours with an initial assessment of severity, impact and available indicators of compromise; an intermediate report on request; and a final report no later than one month after the incident notification, covering a detailed description, the likely root cause, applied and ongoing mitigations and any cross-border impact. Where the incident is still ongoing at the one-month mark, you file a progress report instead, and the final report within one month of finishing.

In the United States, CISA directs victims to report to CISA, the local FBI field office, the FBI Internet Crime Complaint Center (IC3) or the US Secret Service. Reporting also matters if payment is ever discussed — see should you pay the ransom? for what a timely report does to your legal position.

Phase 3 — containment and eradication

Containment is where teams tip off the attacker. CISA is direct about it: "use out-of-band communication methods such as phone calls to avoid tipping off actors that they have been discovered … Not doing so could cause actors to move laterally to preserve their access or deploy ransomware widely prior to networks being taken offline." Your incident bridge should not run on the mail system you are investigating.

Phase 4 — restore in an order you chose in advance

• Restore against a predefined critical asset list covering systems critical for health and safety, revenue generation or other critical services — and the systems they depend on.
• Bring things back "on a clean network", not into the environment the actor still has access to.
• Track systems and devices not perceived to be impacted so they can be deprioritised — knowing what you can ignore is as valuable as knowing what to fix first.
• Identify dropper malware before rebuilding from backups: CISA warns that actors "often drop ransomware variants to obscure post-compromise activity" and that care is needed "to prevent continuing compromises".
• Consult law enforcement about available decryptors — researchers have broken the encryption in some variants and released tools.
• Reconnect systems and restore data from offline, encrypted backups based on a prioritisation of critical services, taking care not to re-infect clean systems during recovery.
• Confirm the entry point is closed before anything faces the internet again.

What a rehearsal actually surfaces

A plan you have never run is a guess. Tabletop it at least annually with the real decision-makers, and fix what breaks. What rehearsal buys is measurable at both ends. In Sophos’s The State of Ransomware 2026, 55% of victims were fully recovered within a week and 16% within a day, with 83% back inside a month and only 3% taking longer than three months; the average recovery cost excluding any ransom was USD 1.7 million.

The other end is the part plans usually ignore. Virtually every organisation in that survey whose data was encrypted — 99% — reported lasting repercussions on the defending team: 41% increased anxiety or stress about future attacks, 40% increased pressure from senior leaders, 31% guilt that the attack was not stopped in time, and 29% staff absence due to stress or mental-health issues. For 21%, the team’s leadership was replaced as a direct result. Build shift rotation, handover and an explicit decision to stand people down into the plan, because a rehearsal is where you find out that three people hold every credential that matters.

The controls that make this plan executable — offline backups, segmentation, MFA and the logging the hunt phase depends on — are covered in the ransomware readiness checklist.