After a ransomware incident, follow your incident-response plan, coordinate through a trusted communications channel, isolate affected systems, determine the scope and critical dependencies, preserve evidence, and restore only verified backups in a clean environment. Notify the right internal, government, insurance and regulatory contacts according to your plan and jurisdiction. Do not let an urgent restoration push systems back into an environment that may still be compromised.
This checklist is an operational guide for leadership, IT, security, incident coordinators and communications owners. It does not replace qualified incident responders, legal counsel, your cyber-insurance requirements or sector-specific notification rules.
As an Amazon Associate I earn from qualifying purchases.
Use the first hour to establish control
Ransomware response is easiest to make worse: an improvised shutdown can destroy volatile evidence, while a delayed isolation can let an intruder spread. Start by opening the organization’s incident-response plan and communications plan, assigning an incident lead, and recording decisions with timestamps.
Activate the incident and communications plans
- Name the incident lead and deputies. Identify who can authorize network isolation, who owns technical decisions, who coordinates executives and who handles external statements.
- Move sensitive coordination off potentially monitored systems. Attackers may monitor email, collaboration tools or administrative consoles. Use phone calls or another pre-established out-of-band channel for urgent coordination when appropriate.
- Open a decision log. Record observed symptoms, systems affected, actions taken, people notified, evidence preserved and restoration approvals. Keep copies where the attacker cannot alter them.
- Brief leadership on the immediate objectives. The first objectives are stopping spread, protecting people and critical services, preserving useful evidence and creating a safe path to recovery—not proving the full scope in the first few minutes.
CISA’s September 2023 #StopRansomware Guide places coordination, isolation, reporting, containment, recovery and post-incident activity in one response checklist. Use that sequence with your own plan rather than improvising a separate playbook.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Isolate impacted systems immediately
CISA’s direct instruction is: “Determine which systems were impacted, and immediately isolate them.” Isolation should stop communication with the attacker and prevent lateral movement while preserving as much evidence as practical.
Choose the least destructive effective isolation
| Situation | Immediate action | Evidence or operational caution |
|---|---|---|
| Several systems or subnets show encryption, ransom notes or suspicious activity | Take the affected network segment offline at the switch level if feasible. | A coordinated network shutdown can stop spread faster than disconnecting machines one by one. |
| A single workstation or server is affected and switch isolation is unavailable | Disconnect Ethernet and disable Wi-Fi on the affected device. | Do not reconnect it merely to copy files or “see whether it is fixed.” |
| Cloud-hosted resources are involved | Preserve a point-in-time volume snapshot for later forensic review, then apply the provider’s isolation controls. | Snapshot preservation gives responders a reference while access is restricted; follow the cloud provider’s evidence-preservation procedures. |
| Network shutdown or physical disconnection is not possible | Power down as a last resort. | Powering down can destroy volatile memory and other evidence that may explain how the compromise occurred. |
Do not confuse isolation with deletion
Do not wipe, reimage or delete affected systems before responders decide what evidence is needed. An isolated machine can remain powered and untouched while a qualified responder captures the information needed to identify the initial breach, attacker accounts and persistence. If continued operation creates a safety risk or allows spread, safety and containment take precedence; document why the decision was made.
Track what appears unaffected
Create two lists: systems confirmed or suspected to be affected, and systems believed unaffected. Treat the second list as provisional until credentials, logs, backups and dependencies have been checked. Unaffected systems may still contain stolen credentials or remote-access paths.
Determine scope and set restoration priorities
Do not start by restoring the loudest or most visible system. First map the incident’s scope: affected hosts, identities, data stores, network segments, cloud resources, backup infrastructure, administrative tools and business dependencies.
Build an impact picture
- Record the source or suspected entry point, affected systems and accounts, encrypted or exfiltrated data, and the earliest known indicators.
- Identify dependencies such as identity services, DNS, virtualization, storage, remote access, line-of-business databases and safety systems.
- Separate confirmed facts from assumptions. Mark each system’s status as affected, under investigation or provisionally unaffected.
- Collect enough technical and business data to estimate impact before authorizing restoration. NIST’s Data Integrity project describes this as identifying the source and affected systems and gathering sufficient data for impact analysis.
Rank services by consequence
Set restoration order with business and safety owners. CISA’s checklist points to systems essential to health and safety, revenue generation and critical services. A service that looks independent may depend on identity, networking or a database that must be recovered first.
- Health and safety functions. Restore systems whose loss could endanger people or interrupt essential care or safety operations.
- Critical services and operational dependencies. Recover the identity, network, storage and application components needed to run core services.
- Revenue-generating operations. Restore the minimum viable systems that support customers, transactions or production.
- Lower-consequence systems. Recover remaining systems after the clean environment, credentials and monitoring are ready.
Write the priority and its rationale in the incident log. That record prevents pressure from one department from silently displacing a safety-critical dependency.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Notify the right people and obtain help
Use the notification plan rather than sending a broad message from a potentially compromised account. The incident lead should maintain one current contact list and confirm which channels are trusted.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallInternal stakeholders
- Executive leadership and the designated incident coordinator.
- IT operations, security, identity and infrastructure owners.
- Legal counsel and privacy or compliance staff.
- Communications and public-relations personnel.
- Business owners for affected services and facilities.
- Managed security or incident-response providers already named in the plan.
- The cyber insurer and its required breach or incident hotline, if the organization has a policy.
NIST notes that cyber insurance may ease financial pressure after an incident, but a policy is not an immediate recovery step and cannot be treated as coverage for an incident that already exists. Follow the policy’s notice and evidence requirements before engaging vendors.
Government and external assistance
For a U.S.-based organization, CISA’s guide identifies the local FBI field office, the FBI Internet Crime Complaint Center (IC3), the local U.S. Secret Service field office and CISA incident contacts as reporting or assistance routes. Coordinate those reports with counsel and the incident lead; do not assume that one report satisfies every legal or contractual duty.
The source guidance is U.S.-oriented. Organizations elsewhere should use their national cyber authority, police or sector regulator, and should verify current contact details locally.
Coordinate public statements
Communications staff should control external statements, customer notices and employee guidance. State what is confirmed, what services are affected, what users should do and when the next update will arrive. Avoid publishing technical details that could help an attacker while the compromise is active.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Contain the compromise and preserve evidence
Isolation stops obvious communication; containment addresses the access paths that could bring the attacker back. Work with qualified responders to identify the initial breach, compromised accounts, persistence mechanisms and systems that could enable continued access.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Capture representative technical evidence
If immediate mitigation is not possible, CISA recommends capturing system images and memory from a sample of affected devices. Preserve relevant logs, malware samples and indicators of compromise where feasible. Capture enough variety to represent different operating systems, roles, time zones and symptoms rather than imaging only the first machine discovered.
- Preserve endpoint and server images before reimaging.
- Capture volatile memory where the device is still running and the action is safe.
- Export authentication, endpoint, firewall, VPN, cloud and backup logs before short retention periods overwrite them.
- Store malware samples and indicators in a controlled location and record hashes, collection times and chain-of-custody details.
- Keep copies of ransom notes, file extensions, attacker messages and observed command lines.
Close active access paths
Contain accounts, hosts and services that could enable continued access. Reset credentials through a clean administrative path, starting with privileged, service, remote-access and backup accounts. Review newly created accounts, unusual group membership, delegated permissions, tokens, keys and remote-management tools. Do not make broad credential changes from a machine that may be compromised.
Ask about decryption options without assuming they will work
Law enforcement or qualified incident responders may know of a decryptor for a particular ransomware family. Do not assume that a tool will work for your variant, that it will recover every file or that using it is risk-free. Preserve encrypted originals and test any proposed tool on copies under responder supervision.
Prepare a clean recovery environment
Restoration is a controlled rebuild, not a simple file copy. CISA cautions against reinfection during recovery, and NIST recommends planning, isolating and regularly testing backup and restoration procedures.
Separate recovery from the compromised environment
- Create a recovery VLAN or equivalent isolated network.
- Add only systems that have been rebuilt or verified clean.
- Use trusted installation media, patches and security tooling obtained through a clean administrative path.
- Keep the recovery environment’s credentials, management tools and backup consoles separate from compromised identities.
- Enable logging and monitoring before reconnecting a restored service.
Do not reconnect a restored server simply because its data came from a backup. The host, identity layer or management plane may still contain the attacker’s persistence.
Validate backups before relying on them
Offline and encrypted backups are valuable only when they are intact, accessible and clean enough for the intended recovery. Check backup dates, completeness, encryption keys, access permissions and dependency coverage. Scan and inspect restored data in the isolated environment, and compare it with known-good records where possible.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
A backup that was reachable by the attacker may have been deleted, encrypted or altered. The existence of a backup does not prove that it is safe.
Free tools Windows power users keep installed
One-click scans. No signup required.
Restore in the documented priority order
- Recover the clean network, identity and security foundations required by dependent services.
- Restore health-and-safety and critical-service systems.
- Restore revenue-generating applications and their required data stores.
- Bring back lower-priority services after monitoring confirms that the environment remains clean.
- Validate each service with its owner, record the test result and obtain an explicit approval before opening it to users or partners.
Handle breach notification as a legal and jurisdictional decision
Ransomware can involve loss of availability, unauthorized access, data theft or several of these at once. Notification duties depend on location, sector, the type of information involved, contractual terms and the facts established during the investigation.
Follow the notification requirements in your incident plan and consult counsel or the relevant regulator. Ask counsel to map the affected data and people to each applicable deadline, notice method and documentation requirement. The general checklist cannot determine an individual organization’s legal obligations.
Keep a record of what was known at each decision point, what evidence supported the assessment, which notices were sent, who approved them and when follow-up updates are due. Preserve this record separately from systems that were compromised.
Common failure modes and safer alternatives
| Failure mode | Why it causes harm | Safer alternative |
|---|---|---|
| Shutting down every device immediately | It may stop spread but can destroy volatile memory and other evidence. | Isolate at the network or device level first; power down only when disconnection or network shutdown is not feasible or safety requires it. |
| Restoring the most visible application first | The application may depend on compromised identity, storage or management systems. | Map dependencies and restore according to health, safety, critical-service and revenue priorities. |
| Using the normal email account to coordinate the response | The account or mailbox may be monitored or controlled by the attacker. | Use the established out-of-band channel and verify participants independently. |
| Reconnecting a recovered machine to production for testing | A hidden persistence mechanism can reinfect the network. | Test in the clean recovery VLAN with monitoring and owner sign-off. |
| Assuming an existing backup is safe | Attackers may have reached, altered or deleted backup data. | Validate integrity, keys, completeness and provenance before restoration. |
| Wiping systems before collecting evidence | Reimaging can erase the clues needed to identify the initial breach and scope. | Preserve representative images, memory, logs and malware samples when feasible. |
| Making a universal payment decision | Payment may not restore data, may not end access and may create legal or operational consequences. | Have incident leaders, counsel, the insurer and law enforcement assess the decision for the specific incident. |
If your recovery depends on removable offline storage
Organizations that use external storage for offline backups should treat it as part of the recovery control, not as a cleanup device or decryption solution. Before connecting a removable backup, verify that its encryption, access credentials and compatibility are documented, and inspect it from the clean recovery environment. Keep the media disconnected except during controlled backup or restoration operations, and test restoration regularly.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Choose storage and procedures that match the organization’s capacity, retention, encryption and recovery-time requirements. A single removable drive without tested copies, protected keys and a documented restore process is not a complete backup strategy.
Document the recovery and improve the plan
After critical services are stable, conduct a structured review while facts are still available. NIST’s ransomware guidance recommends keeping response contacts current, exercising recovery procedures and updating plans based on what happened.
Close the incident with an evidence-based record
- Timeline of detection, isolation, containment, notification and restoration decisions.
- Systems, accounts, data and dependencies affected or investigated.
- Evidence collected, where it is stored and who handled it.
- Backup sets used, validation performed and services restored from each set.
- Notifications made, contractual or regulatory deadlines and outstanding follow-up.
- Costs, operational effects and unresolved technical or legal questions.
Turn findings into specific changes
- Update the incident-response, communications and business-continuity plans.
- Replace stale emergency contacts and verify out-of-band channels.
- Improve segmentation, privileged-access controls, logging and backup isolation where the incident exposed gaps.
- Schedule restore tests and recovery exercises with service owners, not just security staff.
- Share useful indicators and lessons with CISA or a sector information-sharing organization when legal and contractual considerations permit.
NIST’s newest ransomware risk-management profile, IR 8374 Rev. 1, was released June 11, 2026. It complements the practical recovery advice in NIST’s “Tips and Tactics for Dealing With Ransomware,” published May 13, 2021 and updated February 3, 2025. The NIST NCCoE data-integrity publication dated December 8, 2020 provides the impact-analysis foundation used in this checklist.
Quick Recap
A compact command checklist for incident leaders
- Activate the incident and communications plans.
- Move coordination to a trusted out-of-band channel.
- Isolate affected networks, devices and cloud resources; preserve snapshots where appropriate.
- Avoid powering down unless necessary because volatile evidence may be lost.
- Map affected systems, data, accounts and dependencies.
- Prioritize health and safety, critical services and revenue operations.
- Notify leadership, technical teams, counsel, communications, the insurer and required authorities.
- Capture representative images, memory, logs, malware and indicators where feasible.
- Contain compromised accounts and access paths.
- Build a clean, monitored recovery environment.
- Validate offline, encrypted backups and restore only clean systems in priority order.
- Meet jurisdiction-specific notification duties and document every decision.
- Review the incident, update plans and exercise the recovery process.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
