Ransomware Response Playbook: The First 24 Hours (2026)

A ransomware response playbook for the first 24 hours has four jobs in strict order: isolate the affected systems, preserve evidence and call in help, scope the intrusion by hunting for the attacker's access, then restore from clean backups on a clean network. CISA's checklist says to take the first three steps in sequence, and skipping ahead to restore is the most expensive mistake.

This playbook follows the #StopRansomware Guide published by CISA, the FBI and partner agencies, checked on 17 October 2026, and turns its checklist into time blocks a small security team can run. It does not replace your own incident response plan; it is the version to print and keep beside it.

Dupple data: of the 1,748 vulnerabilities in CISA's KEV catalog as of 16 October 2026, 361 are flagged as known to be used in ransomware campaigns, and 117 of those 361 are Microsoft products, counted from CISA's KEV feed. Edge devices follow: Fortinet has 14 such entries, SonicWall 13 and Ivanti 12.

The first 24 hours at a glance

The table is the order of operations, not a promise that each block fits its window. A large environment may spend the whole first day on hours 0 to 4, which is fine as long as nobody restores before the scoping is done.

Hour 0 to 1: isolate, quietly

The first hour decides how much of the network the attacker still controls at hour 24, so speed beats completeness here. CISA's first instruction is to determine which systems are affected and isolate them immediately; if several systems or subnets look hit, take the network offline at the switch level.

Three details from the guidance matter more than they look:

• Isolate without tipping them off. CISA warns that attackers often watch the victim's own email and chat after gaining access. Coordinate isolation by phone, or on a separate messaging channel set up in advance, so they do not rush to encrypt everything before you cut them off.
• Unplug before you power off. Pull the network cable or drop the device from Wi-Fi. Powering a machine down destroys evidence in memory, so CISA reserves it for devices you cannot disconnect any other way.
• Snapshot the cloud. For cloud workloads, take a snapshot of volumes first, so investigators have a point-in-time copy later.

What this means in practice: someone in the first hour needs the authority to pull a whole site offline without waiting for a meeting. Name that person in your plan now, together with a deputy, because the incident will not wait for the CEO to land.

Hour 1 to 4: preserve evidence and call for help

Once the spread is slowed, the next three hours are about not losing what you will need later, for the investigation, the insurer and possibly a court. CISA recommends a system image and memory capture of a sample of affected devices, plus logs and samples of any precursor malware. Volatile evidence goes first: memory, Windows Security logs, firewall log buffers.

Make the calls in this order, because each one changes what happens next:

1. Cyber insurer. Read the policy's notice clause before anything else; some policies name the response firms they will pay for, and hiring a different responder first can leave you paying twice.
2. Outside counsel. Engaging responders through counsel can matter for privilege over the findings, a question for your lawyer, not for the IT team.
3. Incident response firm or MDR provider. If you already have a retainer or a managed detection service, activate it now. Our MDR services guide and incident response platforms guide cover the options if you do not.
4. Government. CISA's guide tells victims to report to CISA, the local FBI field office, the FBI's IC3 or the Secret Service, and to consult federal law enforcement about decryptors, since researchers have found flaws in some ransomware strains.

Leadership needs a short update on a fixed schedule from here on, even when there is little news. A stated next update time stops executives from calling the people doing the work.

Hour 4 to 12: scope the intrusion

Ransomware is usually the last step of a longer intrusion, not the first. CISA notes that a ransomware event may be evidence of an earlier, unresolved compromise, and that access brokers often sell the foothold. If you restore before you find that foothold, the attacker walks back in through it.

The hunt list in CISA's guide is specific, and it is the most useful part of the document:

• New or elevated accounts. Newly created Active Directory accounts, accounts added to privileged groups such as Domain Admins, and unusual activity on privileged accounts.
• Remote access. Unusual VPN logins, and any unexpected remote monitoring and management (RMM) software, including portable versions that were never installed.
• Backup tampering. Use of vssadmin, wbadmin, bcdedit, fsutil or wmic against shadow copies and boot settings, which attackers use to block recovery.
• Attacker tooling. Cobalt Strike beacons named like Windows processes, unexpected PowerShell or PsExec use, and credential dumping with tools such as Mimikatz or NTDSutil.
• Data leaving. Abnormal outbound volume, and tools such as Rclone, Rsync or tunnels over port 443 that move stolen files.

While the hunt runs, close the doors. CISA suggests disabling VPNs, remote access servers, single sign-on resources and other public-facing assets when credentials may have been stolen in bulk. That is painful for a business still trying to operate, which is exactly why the decision belongs to leadership, briefed by the responders.

The exposure that let them in is often already public. Check the KEV additions tracker for your edge devices, and read our report on backup destruction by the N0N ransomware group before trusting any backup the attacker could reach.

Hour 12 to 24: decide how to recover

By the end of day one the team should be able to answer three questions: which systems matter most, whether the backups are clean, and which legal clocks have started.

Critical systems first. CISA recommends restoring on a clean network in order of a predefined critical asset list: health and safety systems, revenue systems, and the systems they depend on, such as identity and DNS. Systems that were not affected go to the back of the queue.

Backups are evidence too. Restore only from offline, encrypted backups, and check them for the dropper malware the hunt found. If a new VLAN is built for recovery, only clean systems join it. Rebuild from standard images where you can, then reset passwords for every affected account and rotate customer-managed encryption keys.

Legal clocks. Public companies file a Form 8-K under Item 1.05 generally four business days after determining an incident is material, not four days after detection. Breach-notification rules for health, financial and personal data run on their own timelines, so counsel should map them on day one.

Payment is a legal question as well as an ethical one. The Treasury's OFAC has issued an advisory on the sanctions risks of facilitating ransomware payments, and says it will treat prompt reporting to and cooperation with law enforcement as mitigating factors. No payment decision should be made in the first 24 hours without counsel and the insurer in the room, and any negotiator should be vetted: see our report on a recovery firm CEO charged over secret ransom payments.

The mistakes that cost the most

• Restoring before scoping. A clean restore onto a network where the attacker still holds a domain admin account is a second incident.
• Wiping machines to "get back to work". Rebuilding the first infected laptop destroys the evidence that shows how the attacker got in.
• Discussing the response on compromised email. If the attacker reads your mailbox, they read your plan.
• Assuming no encryption means no ransomware. Some groups only steal and extort. The checklist applies the moment someone threatens to publish your data.
• Forgetting the help desk tools. RMM software is a favourite persistence route, so audit every remote access agent, including the ones your MSP installed.

What to prepare before it happens

Every step above runs faster if it was decided in advance. Write down who can take the network offline, keep an offline copy of this playbook and of key phone numbers, and store contacts for the insurer, counsel and an IR firm outside your corporate email.

Test one restore from offline backup each quarter and time it. Run a two-hour tabletop exercise against the timeline above once a year, and cut the odds of hour zero with phishing controls that hold when someone clicks and security awareness training. Endpoint detection with a 24/7 response team shortens hour 0 to 1 more than any other single purchase; see our EDR and endpoint protection rankings and our Huntress review for one option priced for small teams.

How this playbook was built

Every response step here comes from CISA's #StopRansomware Guide, read on 17 October 2026; the time blocks and call order are our framing of that checklist for a small team. Legal timelines come from the SEC's own announcement and Treasury's OFAC notice. The KEV ransomware counts come from CISA's feed, catalog version 2026.10.16. Dupple runs no test lab and has not run these steps in a live incident; treat this as a structured summary of official guidance, and follow your counsel and responders where they differ.

FAQ

What should you do first in a ransomware attack?

Isolate the affected systems immediately, using phone or another out-of-band channel to coordinate. CISA's guide says to take the network offline at the switch level if several systems or subnets are hit, and to unplug devices rather than power them off, so memory evidence survives.

Should you pay the ransom?

That decision belongs to leadership with counsel and the insurer, and never in the first hours. Treasury's OFAC has warned of sanctions risks in ransomware payments and treats prompt reporting to law enforcement as a mitigating factor. Ask the FBI or CISA first whether a decryptor already exists for the strain.

Who do you report a ransomware attack to?

CISA's #StopRansomware Guide lists CISA, the local FBI field office, the FBI's Internet Crime Complaint Center (IC3) and the local Secret Service field office. Notify your cyber insurer early, and let counsel handle any regulator or customer notifications.

How long does a public company have to disclose a ransomware attack?

Under the SEC rule, a Form 8-K Item 1.05 is generally due four business days after the company determines the incident is material. The clock starts at the materiality determination, not at detection, so document when and how that decision was made.

Which vulnerabilities do ransomware groups exploit most?

In CISA's KEV catalog as of 16 October 2026, 361 of 1,748 entries are flagged as used in ransomware campaigns. Microsoft products account for 117 of them, with Windows alone at 48, followed by Fortinet with 14, SonicWall with 13 and Ivanti with 12.

Can you restore from backup right away?

Not until the intrusion is scoped. CISA warns that a ransomware event may sit on top of an earlier compromise, and that dropper malware must be found before rebuilding from backups. Restore from offline backups onto a clean network, starting with the critical asset list.

Cite this: Cyberpresso, "Ransomware Response Playbook: The First 24 Hours (2026)", October 2026.

Cyberpresso tracks the ransomware groups, exploited flaws and response lessons that matter to security teams, in one daily brief. Join at cyberpresso.com.

Some offers on this page may be paid placements or contain affiliate links.