Incident responders investigate and contain the compromise; recovery firms work to restore systems and operations; ransomware negotiators manage communications with attackers and advise on demands. Their scopes can overlap, but negotiation is not technical recovery—and it cannot guarantee decryption, data deletion, or an end to the attack. During an incident, coordinate these roles through your organization’s response plan and keep business recovery priorities in your hands.
What each ransomware specialist does
| Role | Primary job | Typical work | What the role cannot promise |
|---|---|---|---|
| Incident responder | Investigate and contain the compromise | Identify affected systems and likely entry points; assess attacker access and possible data exposure; preserve evidence; coordinate containment and eradication; support recovery planning. | That all affected systems or data can be recovered, or that containment alone restores business operations. |
| Recovery firm | Help restore systems and operations | Assess clean backups or available decryptors; rebuild systems; restore data; sequence restoration around business priorities. | That a particular backup is usable or that restoration is safe before the compromise is contained. |
| Negotiator | Manage communications with attackers and support decisions about demands | Seek time, clarify claims, communicate the organization’s position, and help assess a demand if payment is under consideration. | That criminals will provide a working decryptor, return all data, delete stolen data, or stop attacking. |
These are functional distinctions, not uniform professional designations. A provider may combine services, and the exact scope depends on its contract. A commercial incident-response description, for example, includes containment, investigation, decryption-key validation, and recovery planning; that is a provider’s stated scope, not an industry-wide standard. See Unit 42’s ransomware investigation service description.
As an Amazon Associate I earn from qualifying purchases.
How the roles fit together
Investigation findings help determine what can safely be restored and may inform any discussion of a ransom demand. Recovery should not outrun containment: reconnecting compromised systems or restoring onto an unclean environment can reinfect systems. The organization—not an outside provider—must set the order of business recovery, because it knows which services and operations matter most.
These specialists may work for separate firms or under one provider. A single provider can reduce handoffs, while separate specialists may provide distinct expertise or satisfy policy requirements. There is no universally best configuration; choose based on the incident, written scopes, and insurance terms.
#1 Best Overall
- Define the work in writing: investigation, containment, evidence handling, rebuilding, restoration, attacker communications, and any payment-related support.
- Ask how the provider will coordinate with internal IT, legal counsel, the insurer, leadership, and other specialists.
- Clarify who validates that restored systems are clean and who decides restoration priorities.
- Check insurer panel requirements, policy conditions, legal support, and communication procedures before authorizing work.
CISA identifies IT teams, managed security providers, insurers, and organizational leaders as relevant stakeholders; UK-published Counter Ransomware Initiative guidance also points to insurers, technical authorities, law enforcement, and incident-response companies as potential sources of expertise. Neither an outside provider nor a public agency replaces organizational leadership’s business decisions. CISA #StopRansomware Guide · Counter Ransomware Initiative guidance
What to do first during a ransomware incident
Follow your incident response plan and bring the appropriate internal and external stakeholders together. CISA’s joint U.S. guidance recommends isolating affected systems, preserving relevant evidence, and seeking help from appropriate authorities. Do not treat system restoration as a substitute for investigating the compromise.
- Isolate affected systems. Follow the response plan and disconnect impacted systems as appropriate to limit spread. Coordinate decisions with the response team; avoid actions that destroy useful evidence.
- Preserve evidence. Retain relevant system images, memory, and logs where possible. Record decisions and key events for technical, legal, and operational follow-up.
- Report and request help where appropriate. In the United States, CISA’s guidance identifies CISA, the FBI, the FBI Internet Crime Complaint Center, and the U.S. Secret Service as reporting or assistance options. Federal asset response provides technical help to mitigate impacts and speed recovery; federal threat response involves law-enforcement and intelligence work. Agency involvement does not perform the organization’s own remediation or make its business decisions.
- Assess exposure and obligations. Determine whether data may have been exfiltrated, how sensitive it is, and whether legal or contractual notification duties apply. Requirements vary by jurisdiction and the organization’s circumstances.
- Restore cautiously. Scan backups where possible, restore from offline, encrypted backups, and keep unclean systems from reconnecting. Coordinate rebuild and restoration with the responders’ findings.
The CISA guide’s resource record says it was revised on 19 October 2023 and developed through the Joint Ransomware Task Force, with contributions from CISA, MS-ISAC, NSA, and the FBI. CISA guide resource record
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What negotiation can—and cannot—do
A negotiator can manage a channel to attackers, seek time, clarify what they claim to have taken or encrypted, and help the organization assess its options. That can inform a decision, but it does not make the attacker trustworthy. A payment or promise does not guarantee usable decryption, complete data return, deletion of stolen files, or protection from another attack.
CISA, the FBI, and NSA strongly discourage paying a ransom, citing the risk of encouraging further criminal activity and the lack of any guarantee of file recovery. Counter Ransomware Initiative guidance likewise says payment fuels the ransomware business model. It also recognizes that organizations may face difficult decisions under applicable local laws and regulations. Before considering a payment, examine the technical and operational situation, alternatives, legal requirements, and any relevant insurance conditions with qualified advisers. Check whether the insurance policy includes a negotiator or requires use of an approved provider.
CISA’s BlackMatter advisory · Counter Ransomware Initiative guidance · Ransomware response reference
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Prepare before an attack
Know whom to contact before an incident: identify internal decision-makers, your insurer’s response hotline and approved providers, and the external technical and legal support your organization may need. Review the response plan with the people expected to use it, including how priorities and communications will be coordinated.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Offline backups are one part of recovery preparation. CISA recommends offline backups and describes physically separate storage as one possible component. An external hard drive can serve as offline backup storage, but hardware alone does not create a secure backup system: isolation, access controls, backup architecture, and restore testing matter. CISA #StopRansomware Guide
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
