Ransomware Response Playbook And Checklist (Free DOCX).

Copy this page into your own incident response plan, fill in every [bracket] and keep a printed copy that does not depend on your network. The tables are meant to be filled in. The numbered steps are meant to be ticked off, with a name and a time next to each.

The order follows the response checklist in the CISA #StopRansomware Guide (Part 2) and the incident response functions in NIST SP 800-61 Rev. 3, which is written around the six functions of NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond and Recover. We paraphrase both. Read the originals for the full detail.

Phase 4 is where this playbook goes beyond the public frameworks. Ransomware leaves traces outside your network before, during and after the attack: stolen logins, access offered for sale, a leak site post, a message from the extortionist. The diagram on this page shows where each one enters. Use it to decide who checks what and when.

Who should own the document: the incident lead keeps it current, the security leader approves it, and IT infrastructure owns the recovery tables. Analysts own phase 2 and phase 4.

CISA’s preparation advice comes down to a few things: offline and tested backups, golden images to rebuild from, a written response plan with a communications plan, and a printed copy of both. Fill in the two tables below now, not during the incident.

Contact sheet

Include a phone number that works when email and chat are down. Check it every [quarter].

Critical systems and restore order

CISA asks for a predefined list of critical assets, including systems for health and safety, revenue and other critical services, and what they depend on. List the dependencies too. A system cannot come back before the one it needs.

Preparation checklist

For a plan that covers all incident types, start from the incident response plan template. For background, see What is incident response and how to build it and the incident response plan glossary entry. To reduce the exposure that attackers use as a way in, see attack surface reduction.

Start the incident record first. Write down who noticed what and when. CISA says to move through the first three steps in sequence: find and isolate affected systems, power down only if you cannot disconnect, then triage what to restore first.

Incident header

Detect and analyze checklist

Hunting list

CISA’s guide gives a longer list. These are the main places to look:

• New accounts, accounts with raised privileges and recent use of administrator accounts.
• Unusual VPN or other logins.
• Tools used to switch off backups, shadow copies or boot recovery. This is MITRE ATT&CK T1490 Inhibit System Recovery.
• Remote management software that nobody installed on purpose.
• Signs of stolen credentials, such as dumping from memory or directory data.
• Large or odd outbound traffic and file transfer tools, a sign of T1567 Exfiltration Over Web Service.
• New services, scheduled tasks or software that no one can explain.

If the files were encrypted by T1486 Data Encrypted for Impact, the ransom note and any readme file are evidence. Do not delete them. CISA warns that removing the readme file can make decryption impossible.

Attackers may be watching your email and chat. CISA advises isolating systems in a coordinated way and using phone calls or other out-of-band channels, so they cannot move faster or deploy ransomware widely before the network is offline.

Ask law enforcement whether a decryptor exists for this variant, even if you can contain the attack yourself. Researchers sometimes find flaws that allow recovery.

Your logs show what happened inside. Outside sources show what the attacker has, what is for sale and what they will say next. Assign one analyst to this phase as soon as the incident is declared, and repeat it daily.

CISA notes that attackers who sell or buy network access may copy data first and then threaten to publish it. That is why the outside checks below belong in the first day, not after recovery.

The same checks run continuously are described in the ransomware early warning and leaked credential monitoring use cases. Supplier checks are covered in supply chain and vendor risk. To send suppliers a questionnaire after an incident, use the vendor cyber risk questionnaire template. Our ransomware and data leak site glossary entries explain the terms.

How do you check an extortion contact?

Extortion messages arrive by email, through the ransom note, by phone or on a leak site. Not every message is what it claims to be. Some may refer to an attack that did not happen or to data from an older incident. Verify before you act, and do not answer from normal systems.

1. Route every contact to the incident lead and legal counsel. No one else replies.
2. Save the message, headers, chat logs, wallet addresses and any file samples. Do not open links or attachments from the sender.
3. Compare the claim with your own evidence. Does the sample data match your systems, and is it current? Does it match what your logs show was accessed?
4. Check whether the contact channel is the one named in your ransom note or on the leak site entry. A different channel needs a second look.
5. Treat unsolicited offers of help or data recovery in the same way. Check who they are before sharing anything.
6. Record the result as verified, not verified or false, with the reason, and who decided.

Leak site listing record

If you are choosing a service to watch these sources, the threat intelligence evaluation checklist and the guide on feeds, platform or managed service can help you compare options.

CISA tells victims to follow the notification rules in their own response and communications plans, keep leaders updated on a regular schedule and consider reporting to CISA, the FBI, the FBI Internet Crime Complaint Center or the U.S. Secret Service. If you are outside the United States, replace these with your national authority. Deadlines differ by law and sector. Our post on incident reporting deadlines under NIS2, CRA, SEC and CIRCIA lists what the sources say. Ask legal counsel for the final answer.

Evidence to collect

CISA lists items that investigators may want, if your organization can legally share them:

• A copy of the ransom note and the readme file, left untouched.
• Malware samples, names and recovered executables.
• Encrypted file samples.
• Log files, such as Windows event logs and firewall logs.
• Memory captures and images of affected systems.
• Accounts created and machines added during the attack.
• Attacker email addresses, other contact accounts and wallet addresses.
• The ransom amount, whether it was paid, and copies of any conversation with the attackers.

Should you pay?

The CISA guide refers to the U.S. Treasury OFAC advisory on sanctions risks and says to contact the local FBI field office about mitigating factors. The decision belongs to executive leadership with legal counsel. This table keeps a record.

Do not rebuild until you know how the attacker got in and what they left behind. Restoring onto a network where the way in is still open, or from a backup that holds the attacker’s tools, invites a second attack.

Recovery tracker

Criteria to declare the incident over

• [All critical systems restored and verified]
• [No sign of attacker access for [number] days under monitoring]
• [Original way in closed and checked]
• [All affected credentials reset]
• [No new claims or listings about us outside for [number] days]
• [Notifications completed]

Backups matter most at this step. CISA warns that automated cloud backups may not be enough, because encrypted local files can sync to the cloud and overwrite good copies. See the ransomware recovery and detection guide for more on this.

NIST SP 800-61 Rev. 3 treats lessons learned as a loop: what you learn in each phase feeds improvement in all of them. Hold the review while memory is fresh, then change the plan, not only the notes.

Keep watching the outside sources for your name, domains, staff accounts and suppliers for [number] days after the incident. Stolen data can be posted later, and old credentials may be reused. For board reporting, see the ROI and board report template. Then practise the revised playbook with a tabletop exercise. CISA’s tabletop exercise packages include cyber scenarios, with ransomware among the threat types.

Sources: CISA #StopRansomware Guide (October 2023 version), NIST SP 800-61 Rev. 3 (April 2025), NIST CSF 2.0 (February 2024), MITRE ATT&CK. Paraphrased, not quoted. Check the originals for the full text.

Related reading: Akira ransomware advisory stages and tools and leaked credentials from ransomware groups.