The first 60 minutes of a ransomware incident — a CISO playbook

The Sophos State of Ransomware 2025 report shows median dwell time before encryption is now under 24 hours, with the encryption phase itself completing in 4 to 18 minutes on a typical SME network. By the time staff notice the desktops behaving oddly, encryption is already done. What you do in the next 60 minutes determines whether you pay a ransom, restore from backup, or end up in court explaining a 72-hour GDPR notification you missed.

The single most expensive mistake we see is treating the first alert as an IT problem. Activate the incident-response process immediately and isolate.

• Declare the incident formally — name an Incident Commander (usually the IT lead) and a Communications Lead
• Disconnect affected hosts from the network (unplug Ethernet, disable Wi-Fi). Do NOT power them off — RAM holds forensic gold
• Disable VPN and remote-access for the affected segment at the firewall, not on the host
• Suspend the compromised user accounts in Entra ID / AD; revoke active OAuth tokens and refresh tokens
• Pull backup systems offline immediately — modern ransomware specifically targets backup repositories first

You will need the forensic trail for insurance, regulator and possibly law enforcement. Doing this badly invalidates cyber-insurance payouts.

• Take memory dumps of affected hosts before powering down (winpmem, DumpIt)
• Snapshot affected VMs at the hypervisor level — do not write to them
• Export the last 7 days of Windows event logs, EDR telemetry, firewall logs, mail-gateway logs
• Preserve the ransom note exactly — file path, file hashes, full text, attacker contact channels
• Record everything in a contemporaneous timeline document with timestamps and decision-makers

You need to know what is encrypted, what is exfiltrated, and what is still at risk. Modern ransomware is double-extortion: encryption + data leak threats.

• Use EDR (Bitdefender GravityZone, CrowdStrike, SentinelOne) to identify patient zero, lateral-movement path and remaining beaches
• Check for data exfiltration in firewall/proxy logs — large outbound transfers to MEGA, AnonFiles, Tor exits, or unfamiliar cloud storage
• Notify your insurer immediately — most policies require notification within 24h or coverage is voided
• Engage external IR (your retainer or, failing that, a national CERT — INCIBE, ANSSI, NCSC-NL all run free triage)
• Notify the board / CEO. Document the notification.

GDPR Article 33 gives you 72 hours to notify the supervisory authority of a personal-data breach. NIS2 Article 23 gives you 24 hours for the early warning. Start the clock now, not when remediation is finished.

• GDPR Art. 33: notify the lead supervisory authority within 72h if personal data is at risk (AEPD, CNIL, AP)
• GDPR Art. 34: notify affected data subjects without undue delay if the breach is "high risk" — usually yes for ransomware with exfiltration
• NIS2 Art. 23: 24-hour early warning to the national CSIRT if you are an essential or important entity
• PCI DSS Req. 12.10: notify card brands and acquirer within hours if cardholder data is in scope
• Sector regulators: financial (SEPBLAC/AMF/DNB), health, telecoms — separate notification clocks

Whether to pay is a board-level decision driven by three factors: do you have clean backups, is exfiltrated data sensitive enough to justify paying for non-publication, and is paying legal in your jurisdiction. The ENISA position (and OFAC sanctions guidance) makes payment very risky if the threat actor is on a sanctions list — most notable Russian groups are. Speaklogix never recommends paying without legal review and an OFAC/EU-sanctions check on the wallet address.

Every ransomware incident we have triaged for SMEs traces back to one of four root causes: missing MFA on email, an unpatched perimeter device, an over-permissive shared admin account, or a backup target reachable from a compromised endpoint. All four are fixable in two weeks for under €5k.

• Enforce MFA on all email and admin accounts — phishing-resistant (FIDO2/WebAuthn) for admins
• Deploy EDR (Bitdefender GravityZone Premium tier minimum) — not just AV
• Move backups to immutable, air-gapped storage (S3 Object Lock, Veeam Hardened Repository, Wasabi immutable buckets)
• Patch perimeter monthly: VPN concentrators, firewalls, RDP gateways, Exchange — and disable RDP exposed to the internet
• Run a tabletop exercise quarterly — the team that has done this twice handles the real thing in 60 minutes; the team that hasn’t takes 6 hours

We offer a fixed-price ransomware retainer that includes a 1-hour remote SLA, an on-call Incident Commander, the Bitdefender + immutable-backup stack pre-deployed, and quarterly tabletop exercises. If you have to call us during the first hour of a real incident, we have already done 90% of the work. Book a discovery call and we will quote within one business day.