Ransomware Response Checklist Template

Owned by the incident lead. The answers in this phase decide which later phases appear.

• Confirm ransomware is the cause — ransom notes, renamed or encrypted files, mass file changes flagged by endpoint tools; record the time it was first seen
• Open the incident record and link it to the general incident response checklist — severity, business units affected and the first known host
• Record whether a ransom demand has been received and whether data theft is claimed or suspected — yes, no or not yet known
• Mobilise the named team — incident lead, IT recovery lead, legal counsel, communications, finance and the executive sponsor who holds payment authority
• Move to out-of-band communication — personal phones or a pre-arranged backup channel, assuming email and chat are visible to the attacker
• Notify your cyber insurer and retained incident response firm — many policies require notice before you appoint outside help or incur costs

Isolation tasks are assigned to the IT recovery lead; evidence tasks to the forensic lead.

• Isolate affected hosts from the network — through the endpoint tool or by pulling the network connection, rather than powering them off
• Power down only devices you cannot disconnect — shutting down loses the memory evidence investigators may need
• Cut lateral paths — disable remote access, VPN and remote management tools until they are checked, and block the attacker’s known IP addresses and domains
• Disable compromised and suspicious accounts — prioritise domain admin, service and backup accounts, and revoke cloud sessions and tokens
• Take backup systems offline or confirm they are isolated — attackers routinely target backup consoles and snapshots to block recovery
• Preserve evidence — a sample of encrypted files, the ransom note, logs exported off the affected network and a chain-of-custody record

The restore decision in task 6 needs approval from the IT recovery lead and the system owner.

• Identify the ransomware variant — from the ransom note, file extension or the investigator’s analysis; check No More Ransom for a free decryptor
• Establish the initial access route and earliest attacker activity — phishing, exposed remote desktop, an unpatched VPN or stolen credentials
• List every affected system and data store — encrypted, accessed or unknown — and attach the list to the record
• Check that backups are intact and predate the compromise — restore points, immutability, and whether the backup console itself was accessed
• Scan the chosen restore points for the attacker’s tools and persistence before restoring anything
• Decide what can be restored, what must be rebuilt and what is lost — recorded with the reasoning

Appears only when Phase 1 records a ransom demand. Every task is assigned to legal counsel or the executive sponsor, not to IT.

• Do not contact the attacker until the decision owner has approved it — any contact goes through counsel or a specialist negotiator
• Report the attack to law enforcement — FBI field office or IC3 in the US, Report Fraud (formerly Action Fraud) or the NCSC in the UK, or your national authority
• Screen the attacker and any payment route against sanctions lists — OFAC in the US, OFSI in the UK; paying a sanctioned party can be unlawful even if you did not know
• Check whether a ban or reporting duty applies to you — public bodies and regulated critical infrastructure in some countries face new payment rules
• Record the decision on paying, with the reasons, the people who made it and the legal advice received — including a decision not to pay
• Where a decryptor is obtained, test it on copies in an isolated environment before it touches production data

• Remove every foothold — malware, scheduled tasks, new accounts, remote access tools installed by the attacker and changes to group policy
• Reset privileged credentials — domain and cloud admins, service accounts and the backup system, from a clean device
• Reset the Active Directory KRBTGT account password twice, with replication between the resets, where domain controllers were compromised
• Close the way in — patch the exploited flaw, remove exposed remote desktop, and enforce MFA on the abused account type
• Rebuild domain controllers and other critical servers from known-good media where they cannot be trusted

Each restore tier needs sign-off from the system owner before the next tier starts.

• Restore identity, network and security tooling first — directory services, DNS, endpoint protection and logging
• Restore critical business systems in the agreed priority order — from the business impact analysis, not from whoever asks loudest
• Scan each restored system before reconnecting it to the production network
• Watch for re-entry — heightened alerting on the restored systems and on the accounts the attacker used, for an agreed period
• Confirm business operations are back — the business owner tests the service and signs it off

Notification tasks switch on when Phase 1 records data theft as claimed, suspected or not yet known.

• Hand any personal data exposure to the data breach response workstream — the regulator clock may already be running
• Monitor the attacker’s leak site and dark web channels for your data — usually through your incident response firm or threat intelligence provider
• File any mandatory reports — sector regulators, cyber incident reporting rules and, where you paid, payment reporting duties
• Hold a blameless lessons-learned review and raise improvement actions with owners and dates — backup immutability, MFA coverage, remote access and detection
• Approve closure — the executive sponsor and head of security confirm that evidence is retained and actions are tracked