A ransomware incident creates decisions about services, staff, customers, recovery, and outside help. Technical responders cannot make every organizational choice alone. Leadership needs an agreed way to set priorities and approve actions while facts are still developing.
Understand the idea
Before an incident, identify who can stop a service, authorize recovery, contact providers, approve spending, and lead communications. Define an alternative when a usual decision-maker is unavailable. Discuss the information needed for these decisions rather than assuming a contact list is a complete response plan.
- Authority
Know who can authorize the important decisions.
- Options
Compare recovery, continuity, and response constraints.
- Record
Keep the reasons, evidence, owners, and next review point.
A practical example
Imagine systems unavailable during a busy service period. The technical team can restore one system first, but leadership must choose which activity has the highest priority and who will tell affected teams. A prepared decision structure helps make that choice visible and accountable.
What to do next
- Agree decision authority. Name who may pause services, approve recovery, engage outside support, authorize spending, and lead communications.
- Set recovery priorities. Connect important services to operational needs and a tested recovery plan. Decide who resolves conflicting priorities.
- Keep alternate contacts. Provide a route that still works if usual accounts, devices, or key people are unavailable.
- Exercise the plan. Use a controlled scenario to test decisions under uncertainty, then assign and verify corrections.
How to check the result
Exercise the authority and contact routes in a controlled scenario. Record decisions and recovery evidence during a real response, including unresolved questions about information exposure and continuing access.
A backup restores yesterday’s data. Who decides whether that is acceptable?
The decision needs business ownership as well as technical evidence. Document the data gap, operational consequences, and available alternatives with the authorized leadership team.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
