Quick answer: A cyber attack incident response plan for ransomware should cover the first hour: confirm and declare the incident, isolate affected systems, preserve evidence, protect backups and call the response team. Then decide on communications and reporting duties.

A cyber attack incident response plan is most useful when it is specific. Ransomware is a common and damaging scenario, so it deserves its own playbook. First, the plan should tell people exactly what to do in the first hour, because early choices shape the whole recovery.

This playbook sits alongside your general plan. If you do not have one yet, start with our cyber incident response plan template and our incident response service page.

The First Hour of a Cyber Attack Incident Response Plan

First-hour steps in a cyber attack incident response plan for ransomware
  1. Confirm and declare. The incident lead confirms the signs and starts the plan.
  2. Isolate affected systems. Disconnect them from the network, but do not wipe or reinstall them yet.
  3. Preserve evidence. Keep logs, ransom notes and affected machines for investigators.
  4. Protect backups. Disconnect backup systems and check they are untouched.
  5. Call the response team. Include IT, leadership, legal, communications and your insurer.

Print this list. If the network is down, nobody can open a digital copy.

Prepare holding statements in advance, too. A short, honest message for staff and customers, approved by legal, can go out within the hour. Without it, rumours fill the gap.

Roles in the Response Team

Table of roles in a ransomware incident response team

Most plans fail on decisions, not technology. Name one person for each role, with a backup. For example, the incident lead directs the response, the technical lead handles containment and the communications lead manages staff, customers and media.

Also, name who can authorise shutting down systems and who speaks to regulators. Write those decision rights down before an attack happens.

Finally, rehearse the handover. When the incident lead changes shifts, the next person needs a short written summary of decisions made, systems isolated and people already contacted.

Need a tested playbook? Our cyber incident response and recovery team writes plans and runs exercises with your staff.

Reporting and Notification Duties in Australia

Cards showing reporting and notification duties after a ransomware attack in Australia

Several duties may apply. Report the incident to the Australian Cyber Security Centre through ReportCyber. If personal information is involved, the Notifiable Data Breaches scheme may require you to notify the OAIC and affected people.

Since 30 May 2025, some organisations must also report ransomware payments to the Australian Signals Directorate. Because thresholds and rules change, confirm the current requirements with your legal adviser. Our guide to a data breach response plan covers the notification side in detail.

Should You Pay the Ransom?

Checklist of questions to answer before deciding on a ransom demand

The ACSC advises against paying. Payment does not guarantee you get data back, and it can mark you as a future target. Instead, decide in advance who makes the call and what information they need.

  • Can we restore from clean backups, and how long will it take?
  • Was data stolen as well as encrypted?
  • What do legal, insurance and sanctions rules say?
  • Who must approve the final decision?

Having those questions answered in the plan keeps the discussion calm during a crisis.

Recovery and Lessons Learned

Restore from backups only after you have found and closed the way in. Otherwise, the attackers may return. Rebuild systems in a clean state, reset credentials and monitor closely for several weeks.

Afterwards, hold a review within a few weeks. Record what worked, what failed and what you will change. Pair the playbook with a business continuity plan so the business can keep serving customers while systems are restored.

Ransomware Incident Response: What a Ransomware Response Plan Must Cover

A ransomware response plan is a written, rehearsed set of steps that tells your team how to isolate infected systems, preserve evidence, notify the right people and restore from clean backups. Ransomware incident response works when the first decisions are made in minutes, not hours.

At a minimum, your ransomware incident response plan should cover five things:

  • Detection and triage: who confirms the incident and how severity is rated.
  • Containment: which systems are isolated first and who can authorise shutting them down.
  • Evidence: logs, ransom notes and disk images kept for investigators and insurers.
  • Notification: the ACSC, your insurer, legal counsel and, where required, the OAIC and affected people.
  • Recovery: restoring from tested, offline backups before reconnecting anything to the network.

Treat the plan as a living document. Test it at least once a year with a tabletop exercise, and read our cyber incident response plan guide to align the ransomware steps with your wider response procedure. The Australian Cyber Security Centre also publishes ransomware guidance worth mapping into your plan.

Want a ransomware playbook written and tested for your organisation?

Get in Touch
FAQ

Frequently Asked Questions

Roles, a severity scale, first-hour steps, evidence handling, communications, reporting duties and recovery steps.

Isolate them from the network first. Check with your responders before wiping or powering off, to preserve evidence.

Report to the ACSC through ReportCyber. Other duties, such as the Notifiable Data Breaches scheme, may also apply.

The ACSC advises against it. Decide in advance who makes the call and what rules apply.

At least yearly, using a tabletop exercise with a realistic ransomware scenario.

An incident response plan covers every type of security incident. A ransomware response plan is a focused playbook inside it, with specific steps for isolating encrypted systems, handling ransom demands and restoring from clean backups.