Summary. This checklist turns ransomware readiness and response into specific, assignable tasks, each tied to the governing authority. The readiness phases cover governance and the incident response plan, technical resilience and backups, insurance terms that decide whether a ransom and its related costs are covered, pre-arranged counsel and vendor relationships, and a regulatory map built before it is needed. The response phases cover the first twenty-four hours, investigation and law enforcement contact, the short-clock regulatory reports, negotiation and sanctions screening, the payment decision, execution of a decision to pay or not to pay, breach notification, and litigation and post-incident work. Red-flag boxes mark the points where responses most often fail, and a deadlines table collects the clocks in one place. A short worked example involving a North Carolina county and a list of common failure points close the checklist.

How to use this checklist

Use Phases 1 through 5 as an annual readiness review, ideally with a tabletop exercise that tests them. Use Phases 6 through 13 during an incident, assigning an owner and a date to every item on the first day. Items marked [Regulated] apply only to organizations within a particular regime; items marked [Public] apply to government entities. Where a step requires judgment, the note explains what the judgment should consider.

The legal analysis behind the items is in Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers. The day-by-day narrative of the response phases, with a worked example, is in Responding to a Ransomware Attack: A Practical Guide for the First Two Weeks. Templates for the documents this checklist calls for are in the Ransomware Response Toolkit: Decision Memos, Sanctions Screening Records, and Notification Templates. For broader program requirements, see the Cybersecurity Regulatory Compliance Checklist: A Practical Checklist.

Readiness

Phase 1: Governance and the incident response plan

  • Adopt a written incident response plan with a ransomware annex. The annex should name who may engage with an attacker, who decides on payment, and who is consulted. Authority: 16 C.F.R. § 314.4(h) (FTC Safeguards Rule incident response plan); 45 C.F.R. § 164.308(a)(6) (HIPAA security incident procedures); 23 N.Y.C.R.R. § 500.16 [Regulated].
  • Write a payment authority matrix. State who may authorize engagement, a payment up to a set amount, and any larger payment, and require board or committee approval above a threshold. Note: the matrix should require a completed sanctions screening memo and written insurer consent before any authorization.
  • Assign board oversight of cyber risk to a committee and calendar regular briefings. Authority: Marchand v. Barnhill, 212 A.3d 805 (Del. 2019) (oversight of mission-critical risk); In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996). Note: the dismissals in Firemen's Retirement System of St. Louis v. Sorenson (Del. Ch. 2021) and Construction Industry Laborers Pension Fund v. Bingle (Del. 2023) turned on documented board reporting.
  • For public companies, align the plan with disclosure controls. Name the disclosure committee members who will make the materiality determination and how the incident team escalates to them. Authority: 17 C.F.R. § 229.106 (Item 106 governance disclosure); Form 8-K Item 1.05 under 17 C.F.R. Part 249 [Regulated].
  • Keep an offline copy of the plan, contact lists, the insurance policy, and vendor retainers. Note: attackers read the network; a policy found on a file share can anchor the demand at the limit.
  • Establish out-of-band communications. Pre-provision a messaging platform and devices that are not joined to the corporate domain.
  • Run a ransomware tabletop at least annually, including a payment decision with a sanctions complication, an exfiltration scenario, and a public-company materiality determination where relevant.
  • [Public] Confirm whether state law prohibits payment or communication with attackers. North Carolina (N.C. Gen. Stat. § 143-800) prohibits both for state agencies and local governments; Florida (Fla. Stat. § 282.3186) prohibits payment by state agencies, counties, and municipalities. Check current law in other states.

Phase 2: Technical resilience

  • Maintain immutable or offline backups of critical systems and test restoration on a schedule, measuring how long a full restore actually takes. Authority: 45 C.F.R. § 164.308(a)(7) (HIPAA data backup and disaster recovery plans); 23 N.Y.C.R.R. § 500.16 [Regulated]. Note: the restore time is the single most important number in a later payment decision.
  • Require multifactor authentication for remote access, privileged accounts, and email. Authority: 16 C.F.R. § 314.4(c); 23 N.Y.C.R.R. § 500.12 [Regulated].
  • Maintain an asset inventory and patch internet-facing systems promptly, prioritizing known-exploited vulnerabilities.
  • Deploy endpoint detection and centralized log retention long enough to support an exfiltration analysis (a retention period measured in months, not days).
  • Segment the network so that operational, clinical, and backup systems are not reachable from ordinary user accounts.
  • Map the framework. Align controls with NIST's Cybersecurity Framework 2.0 and NIST's ransomware profile (NIST IR 8374), and with CISA's #StopRansomware guidance. Note: OFAC's 2021 advisory treats meaningful steps to reduce ransomware risk, such as those in CISA's guidance, as mitigating factors.

Phase 3: Insurance

Red flag: the policy is only on the network. If the attacker encrypts the file share that holds the policy, the response team will not know the notice hotline, the consent condition, or the panel, and the attacker may know the limit.

Phase 4: Pre-arranged relationships

  • Sign a retainer with outside breach counsel that permits counsel to engage forensic firms on the company's behalf.
  • Pre-negotiate a counsel-directed forensic engagement letter that will be signed fresh at the time of an incident, separate from any managed security contract. Authority: Fed. R. Civ. P. 26(b)(3); In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014). Note: courts ordered production where the forensic firm worked under a pre-existing services agreement, In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. May 26, 2020), or where there was no separate business track, Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021).
  • Identify a negotiator and a sanctions screening provider, confirm their fee basis (not a percentage of the ransom), and confirm that any firm that will transmit funds is registered with FinCEN where required under 31 C.F.R. Part 1022.
  • Introduce the company to the local FBI field office and note CISA's reporting channels.
  • Identify a notification and call center vendor and a credit monitoring provider.

Phase 5: The regulatory map

  • List every incident-reporting regime that applies, with trigger, clock, recipient, form, and owner (see the deadlines table below).
  • [Regulated] Determine whether the organization is, or may be, a CIRCIA covered entity under CISA's rule implementing 6 U.S.C. § 681b. Note: as of this checklist's date, CISA had not published its final rule (the proposal dates from April 2024), so the reporting duties are not yet in force; check whether the rule has since issued and when it takes effect.
  • [Regulated] NYDFS covered entities: build the 24-hour extortion payment notice and the 30-day justification into the plan (23 N.Y.C.R.R. § 500.17(c)).
  • List contractual notice obligations in customer, vendor, and financing agreements; many are 24 to 72 hours.
  • For HIPAA entities, document how the ransomware breach presumption will be assessed under 45 C.F.R. § 164.402.

Red flag: no one owns the clocks. In most failed responses, the deadline that was missed belonged to a regime that no one had listed. Build the map before the incident.

Response

Phase 6: The first twenty-four hours

  • Activate the plan and convene the core team (general counsel, CISO, CIO, operations, communications, and the executive who will brief the board).
  • Isolate affected systems without powering off or wiping them. Note: memory and local logs are evidence.
  • Export logs before retention periods overwrite them (firewall, VPN, identity provider, endpoint detection, cloud audit logs).
  • Move response communications out of band.
  • Notify the insurer before hiring any vendor whose cost the insurer would pay. See Placing and Tendering a D&O or Cyber Claim: A Practical Guide.
  • Retain breach counsel; have counsel retain the forensic firm under a new engagement letter. Keep remediation on a separate track and separate reports.
  • Issue a litigation hold. Authority: Fed. R. Civ. P. 37(e). See the Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.
  • Start the deadline map with the time of discovery and the time of any determination that will start a clock.

Phase 7: Investigation and law enforcement (Days 1 to 3)

  • Report to the FBI, CISA, or the Secret Service, and log every contact (date, time, agency, person, what was shared, what was requested). Note: OFAC treats a self-initiated, timely, and complete report, and ongoing cooperation, as significant mitigating factors.
  • Share facts and indicators, not the privileged forensic report.
  • Ask law enforcement whether a decryptor or information about the group is available.
  • Direct the forensic firm to answer four questions: entry point, scope of encryption, scope and timing of exfiltration, and condition of backups.
  • Capture the ransom note, portal address, wallet addresses, and any attacker communications with timestamps and hashes.
  • Check for free decryptors for the identified variant through reputable sources.

Phase 8: Short-clock reports (Days 1 to 5)

  • [Regulated] Banking organizations: notify the primary federal regulator within 36 hours of determining that a notification incident occurred. Authority: 12 C.F.R. Part 53 and parallel Federal Reserve and FDIC rules.
  • [Regulated] Credit unions: notify the NCUA within 72 hours. Authority: 12 C.F.R. Part 748.
  • [Regulated] NYDFS covered entities: notify the Department within 72 hours of determining that a reportable incident occurred, including at an affiliate or third-party service provider (23 N.Y.C.R.R. § 500.17(a)).
  • [Regulated] CIRCIA covered entities: report a covered cyber incident to CISA within 72 hours of reasonable belief, if the final rule is in effect. Authority: 6 U.S.C. § 681b; definitions in 6 U.S.C. § 681.
  • [Regulated] Defense contractors: report within 72 hours under DFARS 252.204-7012. Authority: 48 C.F.R. Part 252.
  • [Regulated] Public companies: make and document the materiality determination without unreasonable delay; file Item 1.05 within four business days of a materiality determination. Authority: 17 C.F.R. Part 249; 15 U.S.C. § 78m. Note: close the trading window for insiders who know about a potentially material incident.
  • Send contractual notices on the deadlines the contracts set.
  • Supplement earlier reports when substantial new information becomes available (for example, publication of data).

Red flag: the report says more than is known. "No customer data was affected" in a 72-hour notice is the statement most likely to be contradicted by the forensic report. Report what is known, say the investigation continues, and update.

Phase 9: Negotiation and sanctions screening (Days 2 to 5)

  • Decide with counsel and the insurer whether to open the attacker's channel. [Public] In North Carolina, do not communicate with the attacker.
  • Retain the negotiator through counsel, with written instructions covering goals (proof of life, file listing, time, attribution data), limits (no commitment to pay, no statements about regulators, no side deals), and daily reporting to counsel.
  • Obtain proof of life and a file listing, and route the listing to the notification team.
  • Attribute and screen before any price discussion. Screen group names, aliases, affiliates, wallet addresses, handles, and individuals against the SDN List and threat intelligence about rebrands. Authority: 50 U.S.C. § 1702; 50 U.S.C. § 1705 (penalties, strict civil liability); 31 C.F.R. Part 578; 31 C.F.R. Part 510; 31 C.F.R. Part 589; OFAC's Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (Sept. 21, 2021).
  • Have sanctions counsel review the results and write a screening memo stating what was checked, when, by whom, the results, and what remains uncertain.
  • If a sanctions nexus appears, stop. Consider whether a license application under 31 C.F.R. Part 501 is realistic (OFAC presumes denial) and whether voluntary disclosure is warranted.

Red flag: "no SDN match" treated as clearance. Groups rebrand after designation. A memo that does not address affiliations and rebrands is not a screening memo.

Phase 10: The payment decision (Days 3 to 7)

  • Prepare a written decision memo covering restoration timelines with and without a key, backup condition, safety and operational consequences, exfiltration and notification consequences (unchanged by payment), the screening result, the insurer's position, law enforcement input, decryptor reliability, deletion-promise reliability, legal constraints, and a recommendation.
  • Present the memo to the board or designated committee; meet, ask questions, decide, and minute it. See Fiduciary Duties of Directors and Officers: The Business Judgment Rule, Loyalty, and Caremark Oversight.
  • Obtain the insurer's written position on consent and coverage.
  • Revisit the decision if facts change (backups restored, new designation, free decryptor, publication).

Phase 11: Executing the decision (Days 4 to 10)

If paying:

  • Obtain written insurer consent.
  • Re-screen all identifiers immediately before payment.
  • Use an experienced payment intermediary that is registered with FinCEN where required and performs its own screening; expect its bank or exchange to file any required SAR. Authority: 31 C.F.R. Part 1020; 31 C.F.R. Part 1022; 31 U.S.C. § 5318(g).
  • Sign a written payment authorization naming the decision maker and reciting the screening result and consent.
  • [Regulated] File the 24-hour payment notices: NYDFS (23 N.Y.C.R.R. § 500.17(c)) and, if in effect, CIRCIA (6 U.S.C. § 681b).
  • [Regulated] Calendar the NYDFS 30-day written justification.
  • Test the decryptor on isolated copies under forensic supervision before using it on production systems; continue restoring from backups in parallel.

If not paying:

  • Instruct the negotiator how to close or suspend the channel.
  • Accelerate restoration and document business interruption losses for the insurance claim.
  • Monitor the leak site and capture any posts with timestamps.
  • Prepare communications and notifications for publication.

Phase 12: Breach notification (Days 5 to 60)

  • Have counsel engage a data-mining vendor to identify affected individuals and data elements in the exfiltrated set.
  • [Regulated] HIPAA: treat ransomware encryption of protected health information as a presumed breach unless a documented four-factor assessment shows a low probability of compromise; notify individuals within 60 days of discovery, HHS, and media (for more than 500 residents of a state). Authority: 45 C.F.R. §§ 164.402 to 164.414; 42 U.S.C. § 17932; HHS's Ransomware and HIPAA fact sheet (2016).
  • [Regulated] Business associates: notify the covered entity within 60 days of discovery (45 C.F.R. § 164.410).
  • [Regulated] FTC Safeguards Rule: notify the FTC within 30 days of discovering a notification event involving 500 or more consumers (16 C.F.R. § 314.4(j)).
  • [Regulated] Broker-dealers and advisers: apply Regulation S-P's customer notice rule (17 C.F.R. Part 248).
  • Apply each state's statute (definitions, timing, attorney general and consumer reporting agency notices). Example: Cal. Civ. Code § 1798.82, which since January 1, 2026 requires notice to residents within 30 calendar days of discovery and a sample notice to the Attorney General within 15 days of notifying more than 500 residents. See Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation.
  • Do not treat a payment or a deletion promise as reducing the notification population.
  • Notify on a rolling basis for clearly affected groups rather than waiting for the full data mining.
  • Arrange credit monitoring and identity restoration where the data elements warrant it.

Phase 13: Litigation and post-incident

Deadlines table

Regime Trigger Deadline Recipient
Bank regulators (12 C.F.R. Part 53 and parallels) Determination of a notification incident 36 hours Primary federal regulator
NCUA (12 C.F.R. Part 748) Reasonable belief of a reportable incident 72 hours NCUA
NYDFS § 500.17(a) Determination of a reportable incident 72 hours NYDFS portal
NYDFS § 500.17(c) Extortion payment 24 hours; justification within 30 days NYDFS
CIRCIA (6 U.S.C. § 681b) Reasonable belief of covered incident; ransom payment 72 hours; 24 hours CISA (once the final rule is effective)
DFARS 252.204-7012 Discovery of a cyber incident affecting covered defense information 72 hours Department of Defense
SEC Item 1.05 Materiality determination Four business days Form 8-K filing
HIPAA (45 C.F.R. Part 164) Discovery of a breach 60 days for individuals; HHS and media for 500 or more Individuals, HHS, media
FTC Safeguards Rule (16 C.F.R. § 314.4(j)) Discovery of a notification event with 500 or more consumers 30 days FTC
State statutes Discovery or determination Most expedient time possible, or fixed periods commonly 30 to 60 days Individuals, attorneys general, others
Insurance policy Discovery or claim As the notice condition requires; before vendor retention Insurer
Contracts As defined Often 24 to 72 hours Counterparties

Worked example: Brightwater County, North Carolina

Brightwater County's IT director discovers on a Monday that the county's tax, permitting, and 911 dispatch support systems are encrypted, with a ransom note demanding $900,000. The county manager's first instinct is to ask the county's cyber insurer whether it will pay. The county attorney stops the conversation at the first checklist item in Phase 1: as a local government entity, the county may not pay the ransom and may not communicate with the attacker under N.C. Gen. Stat. § 143-800, and it must report the incident to the state's Department of Information Technology.

That rule removes Phases 9 through 11's payment branch and simplifies the rest. The county notifies its insurer (which still covers forensics, restoration, notification, and liability), retains counsel through the policy, and has counsel retain a forensic firm. It reports to the FBI and to the state, which sends an incident response team. Dispatch runs on backup procedures. The forensic firm finds that a database of permit applicants, including some driver's license numbers, was copied. The county does not open the negotiation channel, monitors the leak site through the forensic firm, restores from backups that are eleven days old, and, when the permit data appears online, notifies affected residents under North Carolina's breach statute. Because the county's documents may be public records, counsel keeps the forensic report within the privileged track and drafts the public summary with that in mind.

Common failure points

  1. The insurer hears about the incident after the vendors are hired.
  2. The forensic report is prepared under the existing security vendor's contract and is later produced.
  3. Systems are wiped before imaging, destroying the exfiltration evidence.
  4. Law enforcement is contacted only after a payment decision.
  5. Price is discussed before sanctions screening begins.
  6. The screening memo ignores rebrands and affiliates.
  7. The board decision is undocumented.
  8. The 24-hour payment notice or the 30-day NYDFS justification is missed.
  9. The notification population is reduced because the attacker promised deletion.
  10. Public statements overstate what is known.
  11. [Public] A public entity negotiates or pays in a state that prohibits it.

This document is general information, not legal advice for any particular situation; reporting and payment rules in this area change, and each incident's facts matter.

Related Documents

Related Articles

Related Guides

Related Checklists

Related Toolkits