Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsA useful ransomware incident response checklist turns your approved plan into clear actions, named decision-makers, and communication routes. Build it before an attack, then use it during an incident to guide detection, coordinated containment, reporting, evidence preservation, and recovery—in that order, adapted to your organization and applicable obligations.
What your checklist should do
Use the checklist as an operational aid to your organization’s approved incident response plan, not as a replacement for incident-specific technical, legal, or regulatory advice. CISA’s joint #StopRansomware Guide, revised October 19, 2023, provides ransomware-specific preparation and response guidance. NIST SP 800-61 Rev. 3, published in April 2025, offers broader incident-response recommendations within the NIST Cybersecurity Framework 2.0.
As an Amazon Associate I earn from qualifying purchases.
Organize the checklist around a clear sequence: prepare in advance; detect and analyze the incident; contain affected systems; notify the right people and authorities; preserve evidence; eradicate the threat and recover; then review and improve the plan. During a live incident, follow your approved plan and its chain of command. A checklist should help people act consistently without delaying urgent safety or containment decisions.
Prepare the checklist before an incident
Assign roles and decision authority
List each role, its primary contact, an alternate, and the decisions that role can make. Adapt these responsibilities to your organization’s size and structure.
#1 Best Overall
- Incident lead and alternate, responsible for coordinating the response under the approved plan.
- Technical decision-makers for security, IT, infrastructure, identity, and affected business systems.
- Executive contact who can make or escalate operational decisions.
- Communications or public information lead for internal messages and public statements.
- Legal and privacy contacts to assess legal obligations and the handling of potentially exposed data.
- Cyber insurer, managed security provider, or incident response provider, if applicable, including the process for engaging them.
- Relevant law enforcement and government contacts for your organization’s location and sector.
Store contact details and response instructions somewhere responders can reach if the organization’s network, email, or identity systems are unavailable. Make clear who can authorize isolation, shutdown, external notifications, and restoration.
Make the plan usable under pressure
CISA recommends creating, maintaining, and regularly exercising a basic cyber incident response plan and associated communications plan, including ransomware and data-extortion or breach procedures. Review the plan with the people in its chain of command, and exercise both the technical steps and the communications process.
- Keep a current inventory of critical systems, service dependencies, owners, and recovery priorities.
- Document out-of-band communication options, such as verified phone numbers, for use if normal channels may be monitored or unavailable.
- Maintain accurate internal and external contacts, including escalation routes and after-hours procedures.
- Test backup availability and integrity, and confirm that responders know how to restore without reconnecting compromised systems.
- Record where to find logging, cloud snapshot, evidence-handling, and system-isolation procedures.
What to do first when ransomware is suspected
1. Activate the plan and assess the situation
Use the organization’s approved incident response plan and move through its initial response steps in sequence. Confirm what is known, which systems appear affected, whether encryption or data theft is suspected, and which critical services may be at risk. Record times, observations, decisions, and the people involved. Avoid treating an early indication as proof of the full scope: the initial picture may change as responders gather evidence.
Recommended Free Tools
Use a trusted, out-of-band channel for coordination when possible. An attacker may be monitoring organizational activity or communications; discussing response actions over a potentially compromised system can expose plans or alert the attacker.
2. Isolate affected systems in a coordinated way
Coordinate containment with the incident lead and technical decision-makers so that isolation limits further spread while taking operational dependencies into account. Disconnect affected hosts from wired and wireless networks where feasible. If multiple systems or subnets appear affected, CISA says taking the network offline at the switch level may be appropriate. Consider the impact on safety, critical services, and evidence before taking broader action.
For affected cloud resources, take volume snapshots for later forensic review. Record what was isolated, when, by whom, and what operational effects followed.
3. Treat power-down as a fallback
If affected hosts cannot be disconnected by other means, powering them down may limit spread. CISA warns that doing so can destroy volatile evidence, including information held in memory. Treat shutdown as a considered fallback—not an automatic first step—and weigh the immediate risk of continued spread against the loss of evidence.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Who to notify and how to report
Use assigned roles and established channels
Activate the incident and communications plans. Notify internal stakeholders and external parties according to assigned roles and the organization’s procedures. Keep management and senior leaders informed as facts develop, separating confirmed information from working assumptions. Route public statements through communications or public information personnel rather than allowing multiple teams to publish independently.
Contact appropriate agencies and assess notification duties
CISA’s guide lists CISA, the local FBI field office, the FBI Internet Crime Complaint Center (IC3), and the local U.S. Secret Service field office as possible reporting or assistance channels. These are U.S. channels; organizations elsewhere should use the relevant authorities for their jurisdiction. Your sector may also have specific reporting routes.
If personal or other regulated data may have been exposed, involve legal and privacy contacts promptly and follow the requirements that apply to the organization, affected individuals, sector, and jurisdiction. The CISA guide does not establish one notification deadline that applies to every organization or location. Do not assume a universal reporting clock or rely on the checklist alone to determine legal obligations.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Containment, eradication, and evidence
Preserve evidence without delaying necessary mitigation
Preserve relevant evidence when feasible, while prioritizing actions needed to limit ongoing harm. When immediate mitigation is not possible, CISA advises collecting system images and memory captures from a sample of affected devices, relevant logs, precursor malware samples, and indicators of compromise. Where possible, preserve volatile or short-retention evidence, such as memory and firewall log buffers, before it is lost.
Keep a record of evidence sources, collection times, handlers, and transfers, following your organization’s evidence-handling procedures. Coordinate forensic collection with qualified incident responders or law enforcement as appropriate. Consult federal law enforcement about possible decryptors; do not assume one exists for a particular ransomware variant or promise that files can be decrypted.
Eradicate before reconnecting systems
Work with the response team to identify and remove the cause of the compromise before returning systems to normal use. Use the investigation to determine which accounts, devices, services, and network segments may still be affected. A device that appears functional is not necessarily clean; avoid reconnecting or using compromised systems as part of the recovery environment.
Recover services and data safely
Restore according to operational priorities
Restore data from offline, encrypted backups in an order tied to safety, mission, business priorities, and system dependencies. Confirm that each backup is suitable for recovery and that the systems receiving it are clean. Validate restored systems before reconnecting them to production networks or relying on them for critical operations.
Before an incident, assess backup arrangements against the organization’s needs: whether data can be recovered, how it is separated from systems attackers could reach, whether restoration has been tested, how much capacity is available, and whether recovery times fit operational requirements. Review access controls and compatibility with your systems. CISA also cautions that immutable storage can involve compliance, misconfiguration, and cost considerations; immutability by itself does not establish that a backup is recoverable or appropriate.
Review the response and improve the checklist
After the incident, record what happened, what decisions were made, what worked, and what needs correction. Use that review to update the incident response and communications plans, clarify roles or escalation paths, and improve backup and recovery procedures. Exercise the revised plan again so changes are understood before the next incident. Consider sharing relevant indicators and lessons with CISA or your sector’s Information Sharing and Analysis Center (ISAC), as appropriate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
