Expert Briefing: Ransomware Readiness for Executives

A briefing on the decisions, rehearsals and recovery capabilities executives need in place before ransomware reaches the business.

Briefing at a glance	Details
Focus	The decisions, rehearsals and recovery capabilities executives need in place before ransomware reaches the business
Audience	CEOs, CFOs, CIOs and CISOs, general counsel, risk and audit leaders, board members
Scope	Cross-industry / Enterprise

About this briefing

By the time ransomware encrypts anything, most of the attack is over. The intruder has been inside, has found the identity systems, has probably copied data, and has often gone looking for the backups. What leadership sees on the day is the last step.

Mandiant’s latest M-Trends report shows how little warning there can be. The median time from initial access to hand-off to a second group was 22 seconds across its investigations. In ransomware cases, it was the attacker who notified the victim in 44% of them, against 41% found internally. It also reports ransomware groups going after identity services, virtualization management and backup infrastructure to deny recovery.

None of that can be fixed during an incident. This briefing is about what executives can settle beforehand: who decides what, what the business can actually recover and how fast, and what the board should ask to find out whether the answers are real.

What you will leave with

A plain-language view of how a ransomware attack unfolds and where leadership decisions are needed

The decisions that have to be made in advance, and who should own each

A realistic way to think about recovery time, starting with identity

Legal and regulatory points to settle with counsel before they arrive as deadlines

Six questions a board can ask to test readiness

Briefing flow

Segment	Focus	Question it answers
1	Two levers: lock and leak	What is the attacker actually selling?
2	How an attack unfolds	Where does leadership need something ready?
3	Decisions to make in advance	What cannot be improvised?
4	Recovery reality	How long to rebuild, and what comes first?
5	Payment, law and disclosure	What should be settled with counsel now?
6	Questions for the board	How do we test the answers?

Two levers: lock and leak

CISA’s ransomware guide describes double extortion: the attacker encrypts systems and also steals data, then threatens to release it. That gives the attacker two levers. Restoring from backup addresses the first. It does nothing about the second.

The practical consequence is that readiness has two halves. One is the ability to run and rebuild the business. The other is the ability to handle a data theft, with its legal, regulatory, customer and reputational consequences, whether or not any system is ever encrypted.

How an attack unfolds

The sequence below is typical, not universal. Not every attack follows every stage, and the order shifts. It is useful because each stage points to something leadership can have ready.

Stage	What happens	What leadership should have ready
Entry	Exploited vulnerabilities were the most common initial vector at 32% in the investigations M-Trends reviewed, voice phishing was 11%, and in ransomware cases prior compromise was the leading vector at 30%.	Funding and ownership for exposure management and for identity controls, especially help desk verification
Hand-off and expansion	Access passes to the group that runs the extortion, sometimes in seconds. Privileges are escalated and the network is mapped.	Detection that works in hours, not weeks, and a clear owner for the first response
Recovery denial	Attackers target identity services, virtualization management and backups so that restoration is slow or impossible.	Offline, tested backups and a plan to rebuild identity and virtualization first
Data theft and encryption	Data is copied out. Systems are encrypted, often outside working hours.	Pre-agreed authority to isolate systems, and counsel on notification duties
Extortion	A note arrives. Victims are pressured with a deadline and a threat to publish.	A payment position, a communications plan, and out-of-band channels that do not depend on the compromised environment

Decisions to make in advance

The most useful readiness work is dull: writing down who decides what, before anyone is under pressure. CISA’s guide asks organizations to maintain and exercise an incident response and communications plan with written approval from the CEO or equivalent, and to use out-of-band communications during response so attackers are not alerted.

Decision	Who should own it	Why it cannot wait
Authority to isolate or shut down systems, including revenue-generating ones	CEO or delegated executive, with the CISO and the operations lead	Every hour of hesitation lets the attacker spread. The people with the technical answer rarely hold the business authority.
Who declares an incident and decides materiality	General counsel, CFO and CISO, with board visibility	For companies subject to the SEC cybersecurity rules, a material incident is reported on Form 8-K Item 1.05, generally within four business days of the materiality determination. The clock runs from a decision someone has to make.
Outside support on standby	CISO and general counsel	Incident response, forensic and legal support are far easier to engage under an existing agreement than during an outage. Check any cyber insurance conditions on notice and approved providers.
Where the team communicates when email and chat are unavailable	CISO and head of IT	If the attacker is watching the compromised channels, using them can alert them.
Payment position and process	Board and CEO, with counsel	See below. The worst time to set a policy is with a deadline running.
Notification map for regulators, customers and partners	General counsel	Obligations vary by jurisdiction and contract. Finding them mid-incident costs time.

Recovery reality

The question to put to the technology team is specific: starting from nothing, how long to restore the ten systems that run the business, and in what order? An estimate is not an answer. A rehearsal is.

Identity comes first, because almost nothing else can be restored or used without authentication. A restore test that recovers a file server proves little about rebuilding the identity platform, the virtualization layer or the network controls, which are the places M-Trends says attackers target. CISA’s guide recommends offline, encrypted backups that are tested regularly, along with golden images and infrastructure-as-code templates so systems can be rebuilt quickly.

Three questions follow for executives. Are the backups reachable from a compromised domain? Has anyone tested a restore that begins with the identity platform? Which systems return first, and who agreed on that order? If the sequence has never been agreed, it will be argued over during the incident.

Payment, law and disclosure

CISA’s guide does not advise on whether to pay. It points victims to law enforcement, including to ask whether a decryptor exists for the variant. The decision belongs to the organization, and it is better made with counsel before the demand arrives.

For organizations with a U.S. nexus, the U.S. Treasury’s OFAC has been explicit. The U.S. government strongly discourages paying ransom demands. Liability for sanctions violations can be strict, meaning it can apply even when the payer did not know the recipient was sanctioned. OFAC treats prompt self-reporting to law enforcement, full cooperation, and strong preventive practices, such as offline backups, an incident response plan, staff training and strong authentication, as significant mitigating factors. Organizations operating elsewhere should take advice on the rules in each jurisdiction.

There is also a point of logic for leadership. Paying may address one lever at most. It does not rebuild systems, and it does not return control of stolen data. It is a business and legal decision, and a risky one, never a substitute for recovery capability.

For companies within the SEC’s rules, annual filings must also describe the board’s oversight of cybersecurity risk and management’s role and expertise. A board that has run a ransomware rehearsal has a more credible answer than one that has not.

Questions for the board

Question	A good answer sounds like	A warning sign
How long to restore our critical services from nothing?	A tested figure from a recent rehearsal, with the restore order and the assumptions	An estimate no one has tested
Who can order a shutdown, and have they been asked to practice it?	A named person and a deputy, with the authority written down	“We would escalate”
Can the attacker reach our backups from inside our network?	Offline or immutable copies, restore-tested, with access separated from the production domain	Backups on the same domain, never restored under pressure
How would we know within hours that someone is inside?	Detection tested against the behaviors ransomware operators use, with a named responder	Reliance on the attacker’s note
What is our position on payment, and who made it?	A documented position agreed with counsel, including the sanctions check	No position, or one that exists only in an executive’s head
When did the executive team last rehearse this?	A recent exercise that included legal, communications and the business, with actions tracked	A technical-only drill, or none

Questions on the table

How much recovery capability is enough, and how do we weigh the cost against the risk?

Who owns the decision to take revenue systems offline?

What should a ransomware rehearsal for the executive team actually include?

How do third-party and supplier incidents change our planning?

What should we tell customers and regulators first, and when?

What to do in the next 30 days

1. Name the person with authority to isolate systems, write it down, and make sure they know.

2. Ask for the tested restore time for the ten most important services, and the order in which they return. If it is untested, schedule the test.

3. Confirm that at least one backup copy cannot be reached from the production identity domain.

4. Settle the payment position and the sanctions-check process with counsel, and record who decided.

5. Book an executive tabletop that includes legal, communications and the business owners, not only IT.

Putting this to work

Cybrilliant’s Ransomware Response service covers the preparation side, with Ransomware Recovery, Incident Response and Board & Executive Advisory available for teams that need help on rebuilding, running an incident or taking the discussion to the board.

Sources

1. Google Cloud, M-Trends report (latest edition). Mandiant / Google Threat Intelligence Group.

2. #StopRansomware Guide. CISA and the Multi-State Information Sharing and Analysis Center.

3. Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments. U.S. Department of the Treasury, Office of Foreign Assets Control.

4. SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies. U.S. Securities and Exchange Commission.