Ransomware at Your Business? Start With a Clear Response

Act carefully. Preserve information the response team may need and coordinate decisions through the people responsible for IT, insurance and the business.

Have your IT or response lead disconnect affected devices from the network where feasible.

Alert business leadership, the IT lead and the people named in your incident response plan.

Record what happened, when it began, affected systems and actions already taken. Do not delete evidence.

Contact CNS and your insurer’s incident hotline. The policy may specify responders or authorization steps.

You do not need to identify the ransomware variant or finish an inventory before calling. Tell us when the issue began, what systems are affected, which operations have stopped and whether an insurer or current IT provider is involved.

CNS will explain the next technical and business steps and define the role it can take on.

Do not wipe or rebuild affected systems before evidence needs are decided.

Do not assume a backup is clean until it is evaluated.

Do not assume ransom payment guarantees recovery or privacy.

The response plan depends on affected systems, evidence, usable backups and the authority to make changes.

Identify immediate business impact, known symptoms and the systems that need attention first.

Reduce further impact through coordinated changes to affected devices, accounts and networks.

Prioritize critical functions, evaluate viable backups and agree on a safe restoration sequence.

Align internal IT, leadership, insurer-appointed teams and specialist support under clear ownership.

John Guarienti will help your team organize the situation, understand the decisions in front of you and coordinate CNS’s authorized role. CNS will be direct when outside forensic, legal or insurer-appointed support is required.

• Explain what is affected and what has stopped
• Confirm insurance and existing response-team involvement
• Identify the systems and business functions that matter first
• Define CNS’s role, authority and immediate scope

Once operations stabilize, use the incident findings to improve administrator access, endpoint monitoring, email protection, backup testing, employee training and response ownership.

Test restoration paths and document recovery priorities before another incident.

Tighten administrator access, MFA, account review and sign-in controls.

Connect monitoring, patching and response ownership to daily IT work.

These resources explain reporting, coordination and response considerations. Your insurer, counsel and response lead may set additional requirements for a specific event.

• CISA: StopRansomware guide
• FBI: Ransomware guidance and reporting
• FTC: Ransomware guidance for businesses

Tell the representative you are calling about a possible ransomware incident. CNS will assess the situation and confirm the appropriate response and scope.