A ransomware response plan gives your team clear next steps when systems or data are suddenly unavailable. Without one, people may lose time debating who is in charge, whether to shut systems down, and who should be informed. A useful plan does not need to predict every twist. It should name decision-makers, set practical triggers for action, explain how to communicate safely, and outline how to restore operations. Prepare it before an incident, then test and update it.
Assign Roles and Backups
Name an incident lead who can coordinate the response and keep a record of decisions. Assign owners for technical investigation, business operations, legal and privacy review, communications, and contact with insurers or outside responders. In a small organization, one person may cover more than one role, but each responsibility should have a named owner and a backup.
Include current contact details and a clear way to reach the team if email or workplace systems are unavailable. Store the plan and essential contacts somewhere accessible from a separate, protected device or paper copy. Make sure staff know how to report suspected ransomware and whom to contact first; they should not have to guess or investigate on their own.
Set Decision Points
Define what triggers the response plan, such as files becoming inaccessible, a ransom note appearing, unusual account activity, or security tools detecting encryption. Tell staff to report signs promptly and avoid deleting files, restarting affected devices, or attempting repairs unless the response lead or technical team directs them to do so.
Identify who can authorize actions such as isolating a device or network segment, disabling accounts, pausing a business service, or bringing in external specialists. Spell out how the team will weigh operational impact, evidence preservation, safety, and the risk of further spread. The plan should direct people to follow legal, regulatory, contractual, and insurance requirements; do not assume that paying a ransom will restore data or prevent disclosure.
Plan Communications
Choose backup communication channels that do not depend on potentially affected email, chat, or shared drives. List approved methods for reaching employees, leadership, technology providers, legal counsel, insurers, customers, and other stakeholders. Keep messages factual: what is affected, what people should do, and when they can expect another update.
Assign one person to approve external statements and maintain a timeline of notifications. Before sending notices, confirm what information can be shared and whether privacy, legal, contractual, or regulatory obligations apply. Tell employees not to post incident details publicly or speculate about the cause. A prepared holding message can help the organization communicate promptly while facts are still being checked.
Recover and Improve
Document how to contain affected systems, preserve relevant evidence, and determine which services are safe to restore. List critical systems in order of business priority, along with the people and vendors needed to recover them. Recovery instructions should cover backups, access credentials, clean devices, and checks to confirm restored systems are secure before reconnecting them.
Plan to validate that backups are usable and protected from the same attack, rather than assuming a backup exists. Record who approves restoration and how the team will check data integrity and essential business functions. After the incident, capture the timeline, decisions, gaps, and follow-up tasks. Run a tabletop exercise using a realistic scenario, then update the plan when roles, systems, contacts, or business priorities change.
A ransomware response plan works best when people can find it, understand their responsibilities, and practice using it. Start with roles, decision authority, safe communications, and a tested recovery sequence; then review the details with the teams and providers involved. Beacon Backup can help your organization assess its preparedness and turn a written plan into actionable steps.