A shared folder suddenly contains unreadable files. A workstation displays a ransom note. Staff begin restarting computers, moving documents, and asking whether the backups are safe.
The first hour needs a clear response owner and a controlled sequence. Uncoordinated attempts to help can spread confusion, erase evidence, or reconnect systems before responders understand the problem.
The joint StopRansomware Guide recommends identifying and isolating affected systems while preserving evidence. This checklist turns that principle into a business coordination aid. It supplements an incident response plan and qualified responders; it does not replace them.
Activate the Plan and Protect People
Name an incident lead and a scribe. Use a communication channel the suspected attacker cannot readily observe. Identify operational safety concerns immediately, especially where unavailable systems could affect physical processes, care, or essential services.
Tell staff how to report symptoms and what to avoid. They should not open ransom-note links, install recovery tools, reconnect isolated devices, or attempt cleanup without direction. Give them one approved contact path and a clear update time.
Avoid treating the first visible workstation as the complete scope. Record where the problem appeared and when, then let responders investigate related identities, systems, and activity.
Contain With the Right Technical Owner
Authorized responders should isolate affected systems using established tools and procedures. The StopRansomware Guide favors network isolation and notes that powering down can lose volatile evidence; shutdown may be necessary when disconnection cannot stop spread. Let the response lead balance those concerns against immediate operational safety.
Do not turn a checklist into a blanket instruction to switch off the organization. Network, endpoint, identity, backup, and application owners may need different containment steps. Record who authorized each change, what it affected, and whether it succeeded.
| Workstream | First-hour question | Evidence to capture |
|---|---|---|
| Operations | What essential work is unsafe or unavailable? | Impact and continuity owner |
| Containment | Which systems or access paths need isolation? | Action, time, scope, and result |
| Identity | Are privileged or remote accounts involved? | Observed events and response decisions |
| Backups | Are recovery systems protected from affected access? | Backup owner and verified protection state |
| Investigation | Which evidence may expire or be overwritten? | Restricted evidence location and collector |
| Coordination | Who needs to be engaged under the plan? | Contact time, owner, and next action |
Preserve Evidence Without Delaying Urgent Containment
Record the initial symptoms, affected host names, discovery times, and relevant alerts. Have qualified responders preserve logs, ransom notes, and volatile evidence using approved methods. Keep an evidence handling record appropriate to the incident.
Do not email sensitive evidence widely or upload samples to an unapproved analysis service. Avoid running random decryptors, wiping machines, or deleting suspicious files before the incident lead coordinates evidence and recovery needs.
Preservation and containment often proceed together. The team should document decisions when immediate harm requires action before complete collection is possible.
Bring Business Owners Into the Response
Contact the parties required by your plan and contracts, which may include incident response support, insurance, counsel, privacy leadership, and critical suppliers. Confirm applicable engagement requirements before commissioning services where practical, without delaying necessary safety measures.
The FBI’s ransomware guidance recommends reporting to a local field office or IC3 and does not support paying ransom. Payment does not guarantee data recovery. Any extortion decision needs the appropriate executive, legal, insurance, and law enforcement coordination.
Do not promise customers a restoration time based only on the existence of backups. First establish what is recoverable, whether the recovery environment is trustworthy, and which dependencies must return in sequence.
Keep a Copyable Incident Log
Incident ID, lead, scribe, and communication channel:
Discovery time and original observation:
Affected or suspected systems:
Operational safety and service impact:
Containment actions, owner, exact time, and result:
Evidence preserved and restricted location:
Backup and recovery environment status:
External parties contacted and case references:
Confirmed facts, working hypotheses, and unknowns:
Next decision, owner, and update time:Do not declare the incident over when encryption stops. Data theft, persistence, compromised credentials, and unsafe recovery conditions may still need investigation. The first hour should create a controlled response, not force a premature conclusion.
Prepare before an emergency with Z7 Cyber and our managed IT service recovery drill.
Book a ransomware readiness conversation. Use it to test your contact tree, containment authority, and recovery evidence before they are needed.