A ransomware recovery plan is a pre-approved runbook for getting from detection to verified restoration without the attacker’s help: isolate, preserve evidence, report, establish which identity systems and backups can be trusted, rebuild identity first and then infrastructure and tier-1 applications in a clean environment, and validate before reconnecting. As of October 2026, the main public references are the joint CISA, FBI, NSA and MS-ISAC #StopRansomware Guide, NIST SP 800-61 Rev. 3, NIST IR 8374 Rev. 1 and the UK NCSC’s July 2026 recovery guidance; this runbook turns them into seven phases with owners.
Related backup and resilience coverage is listed in Enterprise Techie’s topic index.
In this guide
Key facts
| Guidance | Publisher and date | What it adds |
|---|---|---|
| #StopRansomware Guide | CISA, FBI, NSA, MS-ISAC; 2023 | Preparation practices and a response checklist |
| SP 800-61 Rev. 3 | NIST; April 2025 | Incident response aligned to CSF 2.0, including backup and restore integrity checks |
| IR 8374 Rev. 1 | NIST; June 2026 | Ransomware CSF 2.0 Community Profile |
| SP 1800-25 and SP 1800-26 | NIST NCCoE; December 2020 | Example builds for protecting against, detecting and responding to data integrity attacks |
| Recovering from a highly disruptive cyber attack | UK NCSC; July 28, 2026, reviewed October 1, 2026 | First hours, first weeks, rebuild |
| Ransomware payment advisory | US Treasury OFAC; September 21, 2021 | Sanctions risk of paying; reporting as a mitigating factor |
The runbook at a glance
These ransomware recovery steps use example owner roles; map them to your incident command structure.
| Phase | Goal | Key actions | Owner role |
|---|---|---|---|
| 1. Prepare | Recovery without the attacker | Offline or immutable backups that include identity and configuration; tested restores; phishing-resistant MFA; printed plan and contacts | CIO and CISO; CEO approves plan |
| 2. Isolate and preserve | Stop spread, keep evidence | Isolate via out-of-band coordination; capture images and memory; stand up incident command | Incident commander; security operations |
| 3. Report | Get help, meet obligations | CISA, FBI or IC3; NCSC in the UK; insurer; regulators | Legal counsel |
| 4. Scope | Know what is trustworthy | Initial access, persistence, compromised accounts, clean backups, stolen data | Incident response lead; backup owner |
| 5. Rebuild | Minimum viable operations | Identity, then shared infrastructure, then tier-1 apps | Identity, infrastructure and app owners |
| 6. Validate | Keep the attacker out | Scan restored systems, fix root cause, reconnect on written criteria | Security lead; system owners |
| 7. Review | Improve the plan | After-action report, plan updates, shared indicators | CISO |
Before an incident
Backups the attacker can’t reach. CISA’s guide calls for offline, encrypted backups of critical data, tested in a disaster recovery scenario, because many ransomware variants try to find and delete or encrypt accessible backups. The NCSC widens the scope: backups should be able to restore applications, identity systems, trust infrastructure and configuration as well as data, and be immutable where possible. CISA adds a caution that immutable cloud storage does not meet compliance criteria for certain regulations and that misconfiguration can be costly. Enterprise Techie’s 3-2-1-1-0 guide and immutable backup storage comparison cover the build.
CISA and the NCSC ask for regular restore testing and NIST for tested backups, but none of the three sets an interval. Set one per tier; the DR testing cadence guide covers what supervisors expect under DORA.
Identity hardening. CISA recommends phishing-resistant MFA for all services, least privilege and hardened domain controllers, which attackers often use as a staging point. For backup systems, the NCSC adds privileged access workstations, IP allow listing and MFA that isn’t installed on the backup administration device.
A printed plan and contact list. CISA wants a hard copy and an offline version of the incident response plan, approved in writing by the CEO or equivalent, and includes a contacts table to fill in with 24×7 details for leadership, law enforcement, service providers and the cyber insurer. NIST IR 8374 Rev. 1 adds legal counsel to that list and asks for an out-of-band communications strategy.
Decision authority. NIST SP 800-61 Rev. 3 says policy should define which roles can “confiscate, disconnect, or shut down technology assets.” The NCSC asks organizations to settle who makes strategic decisions and at what escalation thresholds, and to retain an incident response firm in advance, noting that firm won’t necessarily rebuild IT systems.
The first hours: isolate, preserve, report
CISA’s checklist starts with identifying affected systems and isolating them, at the switch level if several subnets are hit. Coordinate it over out-of-band channels such as phone calls: attackers may be watching and could deploy ransomware more widely if tipped off.
Don’t wipe or reimage yet. CISA treats powering devices down as a last resort because it loses evidence held in volatile memory, and recommends imaging and memory capture from a sample of affected devices, plus cloud volume snapshots. The NCSC says investigation should, where possible, happen before restoration, because its findings (how attackers got in, whether they kept access) drive rebuild decisions. The NCSC’s first-hours list starts with an incident command structure that has clear authority over containment, recovery and communications, and includes a central record of what was found, when, and which decisions were taken, by whom and why.
Then report. CISA’s guide points US victims to CISA, the FBI, its IC3 or the Secret Service, and suggests asking federal law enforcement about available decryptors. IC3 asks for the variant, cryptocurrency address, demand and whether it was paid. UK organizations can report at report.ncsc.gov.uk, though the NCSC says this does not fulfil legal or regulatory reporting requirements.
Scoping: what can still be trusted
Before any restore, establish whether the attacker is still inside and which identity systems and backups are clean. CISA warns that ransomware may signal an earlier, unresolved compromise and that dropper malware must be found before rebuilding from backups. Its threat-hunting list leads with identity: new Active Directory accounts, escalated privileges, Domain Admin activity, anomalous VPN logins and credential dumping.
The NCSC says to assume backups may have been targeted and to seek assurance they are immutable and uncompromised; NIST SP 800-61 Rev. 3 (RC.RP-03) asks for backups to be checked for indicators of compromise and corruption before use. The NCSC also notes that establishing whether the attacker has been contained is often inconclusive, that recovering while unsure risks restarting the incident, and that teams should assume attackers may have accessed all data until evidence suggests otherwise.
Rebuild order: identity, infrastructure, tier-1 apps
Identity first. The NCSC states that “trusted identity is a critical dependency for recovery” and tells organizations to re-establish a trusted identity source and be prepared to rebuild identity systems, noting that confidence in identity is often required before other recovery activities can proceed.
Then shared infrastructure. The NCSC names identity services, networking, storage and cloud connectivity as the shared infrastructure most services rely on, and asks for documented dependencies and an understanding of restart sequencing. Its recovery guidance prioritizes the infrastructure needed for minimum viable operations (MVO): the lowest capability at which the organization can operate safely and meet its legal and regulatory obligations.
Then tier-1 applications. CISA ranks restoration by a predefined critical asset list (health and safety, revenue, other critical services, plus their dependencies), rebuilt from standard images and infrastructure-as-code templates where possible. Enterprise Techie’s RTO and RPO tier guide helps set targets per tier.
CISA places password resets after the environment has been fully cleaned and rebuilt. Set expectations too: the NCSC says organizations commonly run with limited or no IT services for weeks, and full recovery can take many months.
Recover into a clean environment
CISA calls for restoration on a clean network and warns against reinfection: if a new VLAN is built for recovery, only clean systems join it. The NCSC says backups should connect only to known clean devices. That is the job of a clean room, or isolated recovery environment, where systems are restored, scanned for persistence and validated. Enterprise Techie’s cyber recovery vault comparison explains how vault storage and clean-room compute differ, and its storage-native detection analysis covers what arrays catch.
Validate before reconnecting
NIST SP 800-61 Rev. 3 sets the bar in RC.RP-05: check restored assets for indicators of compromise, remediate root causes before production use, and verify the restoration before a system goes online. The NCSC warns that partners may demand independent assurance before restoring connectivity, so plan that evidence early. Close against written criteria: CISA has the designated IT security authority declare the incident over, and NIST’s RC.RP-06 ties the end of recovery to criteria and an after-action report.
The ransom payment question
This summarizes agency positions and is not legal advice; payment decisions belong with counsel and leadership.
United States. OFAC’s updated advisory of September 21, 2021 says the US government “strongly discourages” paying ransom demands. US persons are generally prohibited from transactions with individuals and entities on OFAC’s SDN List or in comprehensively embargoed jurisdictions, and OFAC may impose civil penalties on a strict liability basis, even if the payer didn’t know or have reason to know the transaction was prohibited. License applications for ransomware payments face “a presumption of denial.” Mitigating factors include offline backups, incident response plans, and a prompt, complete report to law enforcement or CISA, which OFAC treats as voluntary self-disclosure. The advisory itself does not have the force of law. The FBI says on IC3 that it does not support paying, since payment doesn’t guarantee data comes back.
United Kingdom. The NCSC and UK law enforcement do not encourage, endorse or condone payment. The NCSC’s payment guidance, written with the insurance bodies ABI, BIBA and IUA, leaves the decision with the victim but notes that payments to UK-sanctioned entities may be unlawful, promises to delete stolen data can’t be trusted, and backups may prove quicker than a decryptor. It adds that the ICO does not treat payment as risk mitigation or a reason to reduce a penalty. The NCSC’s practical point: well-prepared organizations are more likely to recover without paying.
Post-incident review
NIST SP 800-61 Rev. 3 replaces the old circular lifecycle with a CSF 2.0 model built around continuous improvement, saying lessons should often be shared as soon as they’re identified rather than after recovery ends. The NCSC’s rebuild guidance asks which assumptions failed and which foundational issues increased impact. CISA suggests sharing indicators of compromise with CISA or a sector ISAC. Feed findings into the next exercise; Enterprise Techie’s data breach cost benchmarks help frame the budget case.
Bottom line
- Print the ransomware incident response plan and name who can disconnect systems and who decides on payment.
- Make sure backups can rebuild identity and configuration, and prove restores on a schedule.
- Capture evidence before anything is wiped, and report early.
- Rebuild identity first, restore into a clean environment and reconnect only against written criteria.
Frequently asked questions
What should a ransomware recovery plan include?
Offline or immutable backups that cover identity and configuration as well as data, tested restores, a printed plan and contact list, named decision authority, a rebuild order and reconnection criteria. These elements come from CISA’s guide, NIST IR 8374 Rev. 1 and the NCSC’s preparation guidance.
What are the first steps after a ransomware attack?
Isolate affected systems using out-of-band coordination, and power devices down only if they can’t be disconnected. Capture images and memory, stand up incident command, and report to CISA, the FBI or IC3 in the US, or the NCSC in the UK.
Should Active Directory be restored first?
The NCSC calls trusted identity a critical dependency for recovery, which is why this runbook puts identity first. Check any directory backup for attacker-created accounts and persistence before using it.
Is it illegal to pay a ransomware demand?
OFAC’s 2021 advisory warns that payments involving sanctioned persons or embargoed jurisdictions may violate US regulations, with strict liability civil penalties. The NCSC says payments to UK-sanctioned entities may be unlawful. Get legal advice first.
Sources
- CISA, FBI, NSA and MS-ISAC: #StopRansomware Guide
- NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
- NIST IR 8374 Rev. 1: Ransomware Risk Management, a CSF 2.0 Community Profile
- NIST SP 1800-25: Identifying and Protecting Assets Against Ransomware and Other Destructive Events
- NIST SP 1800-26: Detecting and Responding to Ransomware and Other Destructive Events
- NCSC: Recovering from a highly disruptive cyber attack
- NCSC: Prepare your technical recovery capability
- NCSC: Prepare to make critical decisions
- NCSC: Mitigating malware and ransomware attacks
- NCSC with ABI, BIBA and IUA: Guidance for organisations considering payment in ransomware incidents
- US Treasury OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (PDF)
- FBI Internet Crime Complaint Center: Ransomware
Last checked: October 2026. Agency guidance is revised periodically; check each source page before updating your plan.
Buying? Start from RFPhub’s free Immutable Backup and Cyber Recovery Vault RFP template.