This playbook is designed for enterprise security teams, CISOs, and IT leadership who need an actionable, step-by-step response framework for an active or imminent ransomware incident. It assumes you have an active infection or have been notified by your EDR. Time is everything — average ransomware dwell time before encryption in 2025 was 4.2 days; you may have a window.
Phase 1: Detection & Initial Containment (0–2 Hours)
The first two hours are the most critical. Your goal is not to remediate — it is to stop the bleeding. Every minute of delay allows the ransomware to encrypt more files and spread to more hosts.
- Immediately isolate all confirmed infected hosts from the network — pull cables or disable NICs via management console. Do NOT simply shut down (this can destroy forensic evidence and some ransomware variants detonate on shutdown)
- Disable VPN access and remote desktop connections enterprise-wide until scope is assessed
- Contact your cyber insurance carrier NOW — most policies require notification within 24 hours and they control negotiation authorization
- Activate your incident response retainer if you have one — do this before calling anyone else
- Preserve all evidence: do NOT reimage, wipe, or restore anything yet
- Assign a dedicated incident commander — a single person owns all decisions from this point
- Stand up a dedicated out-of-band communications channel (Signal, encrypted email) — assume primary email may be compromised
- Identify patient zero: which host encrypted first? Check EDR telemetry for earliest file rename events with suspicious extensions
Phase 2: Scope Assessment (2–8 Hours)
With containment in place, you need to understand the full blast radius before making any recovery decisions. Rushing to restore without completing this phase is the single most common mistake that leads to reinfection.
- Enumerate all encrypted hosts using your SIEM — query for mass file rename events in the past 72 hours
- Identify the ransomware variant using the ransom note, encrypted file extension, and tools like ID Ransomware (nomoreransom.org)
- Determine if data exfiltration preceded encryption — check firewall egress logs for large outbound transfers in the prior 72–168 hours
- Check for active persistence mechanisms: scheduled tasks, new local admin accounts, registry run keys, new services
- Identify the initial access vector: phishing email, RDP exposure, VPN vulnerability, or supply chain?
- Determine if domain controllers were compromised — if so, assume all credentials are invalid and plan for full AD rebuild
- Complete scope assessment before making any public statements or regulatory notifications
- Document everything with timestamps — this log will be required by your insurer and potentially by regulators
Regulatory Notification Timelines
Many enterprises delay notifications out of uncertainty or reputational concern. This is a costly mistake — the fines for missing deadlines routinely exceed the cost of the incident itself.
Ransom Payment Decision Framework
The decision to pay is not a technical decision — it is a legal, financial, and ethical one that must involve legal counsel and your cyber insurer. Use this decision table to structure the conversation:
| FACTOR | PAY | DO NOT PAY | NOTES |
|---|---|---|---|
| Backup integrity confirmed? | Either | → Don't Pay | If clean backups exist and recovery is feasible within business tolerance, payment is almost never justified |
| Data exfiltrated? | Consider Pay | Either | Double-extortion: paying may prevent publication, but there are no guarantees — groups have published data after payment |
| Threat actor on OFAC list? | → Do Not Pay | — | Payment to sanctioned entities (LockBit, Evil Corp, Conti successors) may constitute a federal crime regardless of intent |
| Decryptor track record? | Consider Pay | Lean No Pay | Some groups have reliable decryptors; others provide broken tools. Research the group on Ransomlook.io |
| Recovery time with backups? | Either | — | If backup restoration will take longer than negotiated decryption delivery, payment may be justified on business continuity grounds alone |
| Insurer authorization? | Required | N/A | NEVER pay without explicit written insurer authorization — unauthorized payments are typically not reimbursed and may void your policy |
Phase 3–5: Recovery (8–48 Hours)
- Rebuild patient zero and all confirmed infected hosts from scratch — do NOT trust any system that was online during the incident
- Reset ALL credentials enterprise-wide, starting with privileged accounts — this is non-negotiable if AD was compromised
- Deploy new EDR agent configurations with enhanced logging before reconnecting any system to the network
- Patch the initial access vector before restoring connectivity to prevent immediate reinfection
- Verify all persistence mechanisms have been removed on every restored host
- Restore from the last known-clean backup — validate integrity before restoration using hash verification
- Restore in priority order: critical business systems first, then secondary systems, then workstations
- Maintain a 24-hour monitoring period for any restored system before declaring it clean
- Validate application functionality and data integrity before business users access restored systems
- Conduct a full post-incident review within 5 business days — document the full timeline, root cause, and every action taken
- Close the initial access vector permanently — not just patched, but eliminated architecturally where possible
- Review and test your backup strategy — 3-2-1 rule, offline copies, immutable backups, tested restoration procedures
- Implement network segmentation if not already in place — ransomware propagates via flat networks
- Run a tabletop exercise within 30 days to embed the lessons from this incident into team muscle memory
The Breach Response Playbooks module in SentinelPRO IA automates the first two phases of this playbook — automatic host isolation on ransomware detection, backup integrity verification, and regulatory notification timeline tracking. The SOC Analyst Access module provides the forensic timeline and scope assessment tools referenced in Phase 2. Available on Professional and Enterprise plans.