{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/ransomware-first-response-checklist/", "item": { "id": "https://update.dsesecurity.com/updates/ransomware-first-response-checklist/", "slug": "ransomware-first-response-checklist", "url": "https://update.dsesecurity.com/updates/ransomware-first-response-checklist/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/ransomware-first-response-checklist.md", "json": "https://update.dsesecurity.com/api/v1/posts/ransomware-first-response-checklist/" }, "title": "Ransomware first response: a calm containment checklist", "summary": "When ransomware or destructive encryption is suspected, activate the incident plan, isolate affected systems in a coordinated way, preserve evidence, use known-safe communications, protect identities and backups, and involve qualified responders before rebuilding.", "format": { "slug": "checklist", "name": "Checklist" }, "priority": { "slug": "advisory", "name": "Advisory" }, "featured": false, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-07-19T19:03:57+00:00", "modified_at": "2026-07-19T19:03:57+00:00", "reviewed_on": "2026-07-19", "reading_minutes": 3, "word_count": 453, "potentially_affected": "Organizations observing ransom notes, rapid file encryption, inaccessible systems, destructive activity, or credible ransomware and data-extortion indicators.", "dse_recommendation": "Activate the approved incident plan and contact the designated response lead immediately from a known-safe channel; do not begin an improvised cleanup.", "primary_source": { "name": "CISA #StopRansomware Guide", "url": "https://www.cisa.gov/resources-tools/resources/stopransomware-guide", "published_on": "2023-10-19", "authority": "Cybersecurity and Infrastructure Security Agency" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "
\n

Suspected ransomware requires fast action, but improvised action can destroy evidence, interrupt unaffected services, or allow the attacker to observe the response. Use the organization’s approved incident-response plan and a known-safe communication channel.

\n\n

What the official source says

\n

Source fact: Part 2 of CISA’s #StopRansomware Guide provides a ransomware and data-extortion response checklist. CISA places the initial steps in sequence: determine which systems are impacted and immediately isolate them; power down devices only when they cannot otherwise be disconnected, recognizing that shutdown can remove evidence held in volatile memory; then continue coordinated containment and analysis.

\n\n

First-response checklist

\n
    \n
  1. Activate the plan. Contact the designated incident lead, executive decision-maker, IT/security responder, and other required advisers using verified contact information.
    2. \n
  2. Start an incident record. Note who observed what, the exact time, affected systems, ransom-note details, unusual account activity, and actions taken. Separate confirmed observations from assumptions.
    3. \n
  3. Isolate in a coordinated manner. Follow responder direction to remove affected devices or network segments from wired, wireless, remote-access, and cloud connectivity. Do not connect removable media.
    4. \n
  4. Preserve evidence. Do not delete ransom notes, reimage systems, run cleanup tools, or broadly reset systems before qualified responders determine what evidence is needed.
    5. \n
  5. Use known-safe communications. Assume ordinary email or collaboration tools may be visible to an attacker until evaluated. Use the approved out-of-band method.
    6. \n
  6. Protect identities and remote access. Qualified administrators should evaluate involved accounts, privileged access, active sessions, remote services, cloud identities, and suspicious enrollment or recovery changes.
    7. \n
  7. Protect backups and logs. Restrict access to backup administration, preserve relevant logs, and avoid attaching known-good backup media to a potentially compromised environment.
    8. \n
  8. Engage required parties. Follow organizational procedures for legal counsel, cyber insurance, law enforcement, CISA, regulators, customers, employees, and communications. Applicability and timing require qualified review.
    9. \n
\n\n

Power and isolation decisions

\n

DSE recommendation: prefer coordinated network isolation when it can be performed safely. CISA notes that powering down may be necessary when a device cannot be disconnected, but it can eliminate volatile evidence. Do not use a universal “always shut down” or “never shut down” rule; follow the approved plan and responder direction.

\n\n

Do not rush into recovery

\n

Recovery should begin only after the team understands the likely entry path, affected scope, persistence risk, credential exposure, and clean recovery environment. Prioritize services using the approved critical-asset list. Validate backups before restoration and change affected credentials after systems are cleaned and persistence is addressed.

\n\n

This checklist is operational education, not digital-forensics, legal, regulatory, insurance, or ransom-payment advice. DSE should not be represented as providing those specialized services unless expressly contracted.

\n\n

Practical next step: print or securely store the incident contacts and isolation authority before an event. During an event, record every action and obtain qualified direction before cleanup or restoration.

\n
", "content_text": "Suspected ransomware requires fast action, but improvised action can destroy evidence, interrupt unaffected services, or allow the attacker to observe the response. Use the organization’s approved incident-response plan and a known-safe communication channel.\n\n What the official source says\n Source fact: Part 2 of CISA’s #StopRansomware Guide provides a ransomware and data-extortion response checklist. CISA places the initial steps in sequence: determine which systems are impacted and immediately isolate them; power down devices only when they cannot otherwise be disconnected, recognizing that shutdown can remove evidence held in volatile memory; then continue coordinated containment and analysis.\n\n First-response checklist\n \n Activate the plan. Contact the designated incident lead, executive decision-maker, IT/security responder, and other required advisers using verified contact information.\n Start an incident record. Note who observed what, the exact time, affected systems, ransom-note details, unusual account activity, and actions taken. Separate confirmed observations from assumptions.\n Isolate in a coordinated manner. Follow responder direction to remove affected devices or network segments from wired, wireless, remote-access, and cloud connectivity. Do not connect removable media.\n Preserve evidence. Do not delete ransom notes, reimage systems, run cleanup tools, or broadly reset systems before qualified responders determine what evidence is needed.\n Use known-safe communications. Assume ordinary email or collaboration tools may be visible to an attacker until evaluated. Use the approved out-of-band method.\n Protect identities and remote access. Qualified administrators should evaluate involved accounts, privileged access, active sessions, remote services, cloud identities, and suspicious enrollment or recovery changes.\n Protect backups and logs. Restrict access to backup administration, preserve relevant logs, and avoid attaching known-good backup media to a potentially compromised environment.\n Engage required parties. Follow organizational procedures for legal counsel, cyber insurance, law enforcement, CISA, regulators, customers, employees, and communications. Applicability and timing require qualified review.\n \n\n Power and isolation decisions\n DSE recommendation: prefer coordinated network isolation when it can be performed safely. CISA notes that powering down may be necessary when a device cannot be disconnected, but it can eliminate volatile evidence. Do not use a universal “always shut down” or “never shut down” rule; follow the approved plan and responder direction.\n\n Do not rush into recovery\n Recovery should begin only after the team understands the likely entry path, affected scope, persistence risk, credential exposure, and clean recovery environment. Prioritize services using the approved critical-asset list. Validate backups before restoration and change affected credentials after systems are cleaned and persistence is addressed.\n\n This checklist is operational education, not digital-forensics, legal, regulatory, insurance, or ransom-payment advice. DSE should not be represented as providing those specialized services unless expressly contracted.\n\n Practical next step: print or securely store the incident contacts and isolation authority before an event. During an event, record every action and obtain qualified direction before cleanup or restoration.", "content_markdown": "Suspected ransomware requires fast action, but improvised action can destroy evidence, interrupt unaffected services, or allow the attacker to observe the response. Use the organization’s approved incident-response plan and a known-safe communication channel.\n\n## What the official source says\n\nSource fact: Part 2 of CISA’s #StopRansomware Guide provides a ransomware and data-extortion response checklist. CISA places the initial steps in sequence: determine which systems are impacted and immediately isolate them; power down devices only when they cannot otherwise be disconnected, recognizing that shutdown can remove evidence held in volatile memory; then continue coordinated containment and analysis.\n\n## First-response checklist\n\n- Activate the plan. Contact the designated incident lead, executive decision-maker, IT/security responder, and other required advisers using verified contact information.\n\n- Start an incident record. Note who observed what, the exact time, affected systems, ransom-note details, unusual account activity, and actions taken. Separate confirmed observations from assumptions.\n\n- Isolate in a coordinated manner. Follow responder direction to remove affected devices or network segments from wired, wireless, remote-access, and cloud connectivity. Do not connect removable media.\n\n- Preserve evidence. Do not delete ransom notes, reimage systems, run cleanup tools, or broadly reset systems before qualified responders determine what evidence is needed.\n\n- Use known-safe communications. Assume ordinary email or collaboration tools may be visible to an attacker until evaluated. Use the approved out-of-band method.\n\n- Protect identities and remote access. Qualified administrators should evaluate involved accounts, privileged access, active sessions, remote services, cloud identities, and suspicious enrollment or recovery changes.\n\n- Protect backups and logs. Restrict access to backup administration, preserve relevant logs, and avoid attaching known-good backup media to a potentially compromised environment.\n\n- Engage required parties. Follow organizational procedures for legal counsel, cyber insurance, law enforcement, CISA, regulators, customers, employees, and communications. Applicability and timing require qualified review.\n\n## Power and isolation decisions\n\nDSE recommendation: prefer coordinated network isolation when it can be performed safely. CISA notes that powering down may be necessary when a device cannot be disconnected, but it can eliminate volatile evidence. Do not use a universal “always shut down” or “never shut down” rule; follow the approved plan and responder direction.\n\n## Do not rush into recovery\n\nRecovery should begin only after the team understands the likely entry path, affected scope, persistence risk, credential exposure, and clean recovery environment. Prioritize services using the approved critical-asset list. Validate backups before restoration and change affected credentials after systems are cleaned and persistence is addressed.\n\nThis checklist is operational education, not digital-forensics, legal, regulatory, insurance, or ransom-payment advice. DSE should not be represented as providing those specialized services unless expressly contracted.\n\nPractical next step: print or securely store the incident contacts and isolation authority before an event. During an event, record every action and obtain qualified direction before cleanup or restoration." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo.png" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/ransomware-first-response-checklist/", "url": "https://update.dsesecurity.com/updates/ransomware-first-response-checklist/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-07-19" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/ransomware-first-response-checklist/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Ransomware first response: a calm containment checklist", "item": "https://update.dsesecurity.com/updates/ransomware-first-response-checklist/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/ransomware-first-response-checklist/#article", "identifier": "https://update.dsesecurity.com/updates/ransomware-first-response-checklist/", "url": "https://update.dsesecurity.com/updates/ransomware-first-response-checklist/", "headline": "Ransomware first response: a calm containment checklist", "description": "When ransomware or destructive encryption is suspected, activate the incident plan, isolate affected systems in a coordinated way, preserve evidence…", "abstract": "When ransomware or destructive encryption is suspected, activate the incident plan, isolate affected systems in a coordinated way, preserve evidence, use known-safe communications, protect identities and backups, and involve qualified responders before rebuilding.", "articleBody": "Suspected ransomware requires fast action, but improvised action can destroy evidence, interrupt unaffected services, or allow the attacker to observe the response. Use the organization’s approved incident-response plan and a known-safe communication channel.\n\n What the official source says\n Source fact: Part 2 of CISA’s #StopRansomware Guide provides a ransomware and data-extortion response checklist. CISA places the initial steps in sequence: determine which systems are impacted and immediately isolate them; power down devices only when they cannot otherwise be disconnected, recognizing that shutdown can remove evidence held in volatile memory; then continue coordinated containment and analysis.\n\n First-response checklist\n \n Activate the plan. Contact the designated incident lead, executive decision-maker, IT/security responder, and other required advisers using verified contact information.\n Start an incident record. Note who observed what, the exact time, affected systems, ransom-note details, unusual account activity, and actions taken. Separate confirmed observations from assumptions.\n Isolate in a coordinated manner. Follow responder direction to remove affected devices or network segments from wired, wireless, remote-access, and cloud connectivity. Do not connect removable media.\n Preserve evidence. Do not delete ransom notes, reimage systems, run cleanup tools, or broadly reset systems before qualified responders determine what evidence is needed.\n Use known-safe communications. Assume ordinary email or collaboration tools may be visible to an attacker until evaluated. Use the approved out-of-band method.\n Protect identities and remote access. Qualified administrators should evaluate involved accounts, privileged access, active sessions, remote services, cloud identities, and suspicious enrollment or recovery changes.\n Protect backups and logs. Restrict access to backup administration, preserve relevant logs, and avoid attaching known-good backup media to a potentially compromised environment.\n Engage required parties. Follow organizational procedures for legal counsel, cyber insurance, law enforcement, CISA, regulators, customers, employees, and communications. Applicability and timing require qualified review.\n \n\n Power and isolation decisions\n DSE recommendation: prefer coordinated network isolation when it can be performed safely. CISA notes that powering down may be necessary when a device cannot be disconnected, but it can eliminate volatile evidence. Do not use a universal “always shut down” or “never shut down” rule; follow the approved plan and responder direction.\n\n Do not rush into recovery\n Recovery should begin only after the team understands the likely entry path, affected scope, persistence risk, credential exposure, and clean recovery environment. Prioritize services using the approved critical-asset list. Validate backups before restoration and change affected credentials after systems are cleaned and persistence is addressed.\n\n This checklist is operational education, not digital-forensics, legal, regulatory, insurance, or ransom-payment advice. DSE should not be represented as providing those specialized services unless expressly contracted.\n\n Practical next step: print or securely store the incident contacts and isolation authority before an event. During an event, record every action and obtain qualified direction before cleanup or restoration.", "datePublished": "2026-07-19T19:03:57+00:00", "dateModified": "2026-07-19T19:03:57+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/ransomware-first-response-checklist/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@id": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": "https://update.dsesecurity.com/assets/dse-updates-share.png", "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Checklist", "Advisory priority" ], "genre": "Checklist", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 453, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "CISA #StopRansomware Guide", "url": "https://www.cisa.gov/resources-tools/resources/stopransomware-guide", "datePublished": "2023-10-19" } } ] } }