Ransomware readiness: why the first hour matters most

Ransomware remains one of the most disruptive threats any organisation can face. Systems are encrypted, operations stop, and attackers increasingly steal data before encrypting it so they can threaten to publish it too.

When an attack is discovered, the first hour is critical. The decisions made in those minutes can determine whether you face a contained incident or a weeks-long recovery.

What the first hour looks like without a plan

Without preparation, the first hour is often chaotic. People don’t know who to call. Systems get switched off in a panic, destroying evidence. Someone emails the whole company about the attack, from a mailbox the attacker can read. Senior leaders are out of reach, and nobody feels authorised to make big decisions.

Every one of those problems is avoidable.

The priorities in the first hour

Contain the spread. Isolate affected systems from the network to stop the ransomware reaching more devices. Disconnect them rather than powering them off where possible, so evidence is preserved.

Activate your response team. Bring together the people who need to make decisions: IT, leadership, legal, communications and your external incident response partner.

Communicate safely. Assume your normal channels may be compromised. Agree an alternative way to communicate, such as phone calls or a separate messaging group set up in advance.

Preserve evidence. Logs, ransom notes and affected systems help investigators understand how the attacker got in and what they accessed. That understanding is essential for a safe recovery and for any regulatory reporting.

Don’t rush to pay. Paying a ransom doesn’t guarantee your data back, doesn’t stop stolen data being leaked, and can mark you out as a willing payer. It’s a decision for leadership, made with expert advice, never a reflex.

Preparing before it happens

The best time to prepare for the first hour is months before it arrives.

• Write a ransomware playbook that sets out roles, decisions and contacts. Keep a printed copy, because your systems may not be available.
• Know your critical systems and the order you’d need to restore them.
• Test your backups. Make sure at least one copy is offline or immutable, and that you can actually restore from it within a time the business can tolerate.
• Agree authority in advance, including who can approve taking systems offline and engaging external help.
• Have an incident response partner on standby, with contracts agreed before you need them.

Practise, then practise again

A plan nobody has rehearsed is a plan nobody will follow under pressure. Tabletop exercises let your team walk through a realistic scenario, find the gaps and build confidence, without any real-world risk.

A first-hour checklist to keep on paper

Print this, adapt it to your organisation and keep it somewhere everyone on the response team can find it.

1. Confirm what’s happening: which systems are affected, and since when?
2. Isolate affected devices from the network, but don’t power them off unless advised.
3. Call your incident response partner and your internal response lead.
4. Switch to agreed backup communication channels.
5. Inform senior leadership and agree who is making decisions.
6. Preserve evidence: ransom notes, screenshots, logs and timelines.
7. Check the status of backups, and protect them from further access.
8. Start a written log of every action and decision, with times.
9. Consider legal, regulatory and insurance notification requirements.
10. Agree a holding statement for staff, in case word spreads.

The log in step eight is easy to forget and hugely valuable. In the days that follow, you’ll need to explain what happened and when, to investigators, insurers, regulators and possibly customers. A clear record made in the moment is far more reliable than trying to reconstruct events afterwards.

Review this checklist every six months, and whenever key people or systems change.