The First 24 Hours of a Ransomware Attack

Updated November 8, 2026 · Sources checked November 8, 2026

In the first 24 hours of a ransomware attack, a team makes three decisions that someone will review later: who isolates systems, what evidence is preserved before anything is touched, and who authorizes restoration to begin. This case follows a fictional company hour by hour and separates what the team knew from what it only assumed.

It is written for audit, privacy, risk and compliance professionals who do not run the security console but do sign off on these decisions or audit them afterward. If you want the technical explanation of the attack first, read CS-014 Ransomware in our Cybersecurity Reference Library. This case is the practical follow-up to that one-page sheet.

The Short Answers

• Isolating a system is authorized by the role your incident response plan names for it. NIST lists that authority among the elements most incident response policies include (NIST SP 800-61 Rev. 3, Section 2.3).
• Evidence that disappears on its own goes first: memory and logs with short retention, such as firewall log buffers (CISA #StopRansomware Guide, step 9).
• A machine you can disconnect from the network should not be powered off, because powering down erases the evidence in memory (CISA, step 2).
• Restoring a critical system should be approved jointly by the business owner of that system and the head of security, against criteria written before the incident. IT carries it out. This is our recommendation, supported by NIST SP 800-61 Rev. 3, Section 2.2 and NIST CSF 2.0, RS.MA-05.
• A backup taken before the encryption can still postdate the intrusion. Check it before you use it (NIST CSF 2.0, RC.RP-03).

What Happens in the First 24 Hours of a Ransomware Attack?

The team works to contain the damage while it preserves evidence, and it has to decide when operations can resume, almost always with incomplete information. CISA's guide says to take the first three steps of its response checklist in order: determine which systems were impacted and isolate them immediately, power down only devices that cannot be disconnected, and triage impacted systems for restoration (CISA #StopRansomware Guide, Part 2, steps 1 to 3).

That applies to any organization with an approved response plan. Without one, every one of these decisions gets argued in the middle of the crisis. Three conditions change the answer:

• When the attack touches personal data, legal deadlines start running; which ones depends on the jurisdiction (see the legal deadlines).
• With cloud resources, CISA recommends taking a snapshot of volumes for the forensic investigation (step 1).
• When a managed security service provider runs the response, its contract should say what it may do on the organization's behalf (NIST SP 800-61 Rev. 3, Section 2.2).

The Case: Vantoria Logistics (Fictional)

• A distributor headquartered in Latin America with a subsidiary in Spain, inside the European Union. It has 900 employees, 120 of them at the subsidiary.
• Systems in the case: two file servers (FS-01 and FS-02), a jump server for remote administration (JUMP-01), the order and billing ERP (ERP-01) and an online backup server (BK-01). There is also an immutable cloud copy with a 14-day retention lock.
• Section 4.2 of the response plan: the on-call analyst may isolate an individual endpoint or server without asking, and tells the incident lead within 15 minutes. Disconnecting a network segment or a system on the critical asset list requires the chief information security officer (CISO), after consulting the business owner.
• Section 6.1 of the plan: restoring a critical system is approved jointly by the business owner and the CISO, once the incident lead confirms that the criteria in Annex C are met.
• A GRC analyst keeps the decision log. She does not touch the console: she records who decided what and on what evidence, with the time.

An Illustrative Timeline, Hour by Hour

All times are headquarters time. Hour 0 is Tuesday at 2:10 a.m.

Where Things Stand at Hour 24 (Wednesday, 2:10 a.m.)

Confirmed, with the evidence stored:

• FS-01, FS-02 and JUMP-01 were encrypted. All three have memory and disk images preserved.
• svc-inventory signed in without multifactor authentication 9 days ago and is now disabled.
• 38 GB left FS-02, which held the personnel files of 120 subsidiary employees.
• The remote management tool from JUMP-01 is blocked across the network.

Still assumed, with the person who checks it and the deadline:

• That svc-inventory was the way in. The forensics firm confirms it in its preliminary report.
• That the human resources folder was among the copied data. The forensics firm checks the proxy logs by noon Wednesday.
• That the ERP database was not altered. Finance reconciles orders against the bank at 10:00 a.m. Wednesday.
• That the subsidiary falls within the scope of NIS2. This is the most serious open item: if it does, the early warning was due within 24 hours of becoming aware of the significant incident, and legal did not settle the question in the first hours.

Who Can Authorize Isolating a System?

The role your incident response plan names for it before the attack. NIST lists roles, responsibilities and authorities among the elements most incident response policies include, such as which roles have the authority to confiscate, disconnect or shut down technology assets (NIST SP 800-61 Rev. 3, Section 2.3). It also notes that leadership may hold decision-making authority on high-impact actions, such as shutting down or rebuilding critical services (Section 2.2).

What the plan has to settle before the first alert:

• Who isolates an individual endpoint or server without asking, for example the on-call analyst. NIST CSF 2.0 gives, as a containment example, letting incident responders select and perform containment actions manually (RS.MI-01).
• Who disconnects a network segment or a critical system, which stops part of the business.
• Who gets the call if that person does not answer, and after how many minutes the backup decides.
• What happens when several systems or subnets look affected: CISA recommends taking the network offline at the switch level and prioritizing the isolation of systems essential to daily operations (step 1).
• Which channel the team coordinates on: CISA recommends isolating in a coordinated way and using out-of-band communication, such as phone calls, so the attacker is not tipped off (step 1).
• What a third party may do on its own. The provider's contract should define its authority to act on behalf of the organization (NIST SP 800-61 Rev. 3, Section 2.2).

For auditors, the test is to compare the log with the plan. If the segment disconnection lacks the sign-off of the role the plan requires, the control failed even if the decision was right. CSF 2.0 asks that roles, responsibilities and authorities be established, communicated, understood and enforced (GV.RR-02).

What Evidence Should You Preserve, and in What Order?

Start with what disappears on its own: memory on the affected machines and logs that get overwritten quickly. Then take disk images of a sample of machines, the security tool logs, the ransom note and some encrypted files (CISA, step 9). Powering a machine down destroys the evidence in memory, and CISA recommends it only when there is no other way to disconnect the machine (step 2).

• A memory capture and system image of a sample of affected devices: workstations, servers, virtual servers and cloud servers (CISA, step 9).
• Evidence that is highly volatile or limited in retention, such as system memory, Windows Security logs and data in firewall log buffers (CISA, step 9).
• Snapshots of cloud volumes (CISA, step 1).
• Logs from the EDR, the VPN, the firewall, the proxy and the domain controllers.
• Leave the ransom note in place and keep a copy. CISA warns not to remove that file, or decryption may not be possible (Reporting and Notification section).
• A sample of encrypted files and, if found, the precursor malware binaries (CISA, step 9).
• For every item, record who took it and when, where it came from, and its hash. CSF 2.0 asks that the integrity and provenance of incident data and metadata be preserved (RS.AN-07).
• The decision log itself. CSF 2.0 asks that actions taken during an investigation be recorded (RS.AN-06), and NIST accepts even a paper logbook (SP 800-61 Rev. 3, Table 3).

For privacy professionals: in the European Union, the GDPR requires the controller to document any personal data breach, including the facts, its effects and the remedial action taken (Regulation (EU) 2016/679, Article 33(5)). The evidence list and the decision log are the backbone of that documentation.

Who Decides When Restoration Can Begin?

Our recommendation: the business owner of the system and the head of security, together, against criteria written before the incident. IT carries out the restoration but does not decide it alone. NIST supports that split in three places: leadership may hold authority over high-impact actions such as rebuilding critical services (SP 800-61 Rev. 3, Section 2.2); the policy should set guidelines for initiating recovery (Section 2.3); and CSF 2.0 calls for applying criteria to initiate recovery (RS.MA-05).

NIST adds a detail this case uses in every row: those criteria are applied to the known and assumed characteristics of the incident, and they account for the operational disruption that recovery itself causes (SP 800-61 Rev. 3, Table 3, RS.MA-05). That is why the log keeps confirmed facts apart from assumptions.

Minimum criteria before you authorize a restoration:

• The known way in is closed and compromised accounts are disabled (CISA, steps 12 and 13).
• The team has hunted for persistence, and whatever it found is removed or blocked (CISA, step 15).
• The backup you plan to use was checked for indicators of compromise before use (NIST CSF 2.0, RC.RP-03). CISA says to identify precursor malware before rebuilding from backups (step 4).
• Any evidence the restoration would destroy is already preserved.
• The order follows the critical asset list (CISA, step 3), and the restoration happens on a clean network, such as a recovery VLAN that only clean systems may join (step 19).
• Before production use, the integrity of the restored system is verified (NIST CSF 2.0, RC.RP-05).
• Whatever is still assumed is written down, with the name of the person who will check it and the time.

In CISA's guide, the designated IT or IT security authority declares the incident over based on established criteria (step 18), and reconnecting systems and restoring data from offline backups comes after that (step 19). Vantoria restores ERP-01 before that declaration, but inside an isolated recovery network. It is a risk decision, which is why it goes into the log with its assumptions and a condition for reversing it.

Which Legal Deadlines Start Running?

That depends first on where the organization operates and whether personal data was affected, and the sector matters too, so always name the jurisdiction. In this case, Vantoria's subsidiary is in Spain and falls under European Union law. Headquarters is in Latin America, where the answer changes from country to country.

European Union

• In the case of a personal data breach, the controller notifies the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. A late notification must give the reasons for the delay (GDPR, Article 33(1)).
• Information that is not available all at once may be provided in phases without undue further delay (GDPR, Article 33(4)).
• When the breach is likely to result in a high risk to people's rights and freedoms, the controller also communicates it to the data subjects without undue delay (GDPR, Article 34).
• Essential and important entities under NIS2 send their CSIRT or competent authority an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report no later than one month after that notification (Directive (EU) 2022/2555, Article 23(4)).
• NIS2 binds organizations through each member state's national law, which member states had to apply from October 18, 2024 (Article 41). Check the national law to see whether the entity is in scope.
• In Spain, the GDPR supervisory authority is the Agencia Española de Protección de Datos (AEPD), which publishes what a breach communication to affected people must contain (AEPD, page last modified December 10, 2025, in Spanish).

Latin America and the United States

Notification duties in Latin America change by country and sector, and we do not summarize them here without the official text in front of us. Check the country's data protection law and the rules for your sector, such as financial services. Our Spanish-language guide to compliance by country is a starting point, never a substitute for the statute.

If Vantoria were a US company, CISA's guide tells victims to report the incident to CISA, the local FBI field office, the FBI's Internet Crime Complaint Center (IC3) or the local US Secret Service field office (step 7). Other US obligations depend on the sector and the states involved.

This application of the law to a fictional case is editorial analysis for training. For a real incident, ask counsel.

A Completed Decision Log Entry

This is entry D-07, the decision to restore. It shows how the conclusion follows from the evidence and what remains open.

Why the decision holds up:

• Option A fails on a confirmed fact, not on caution: Sunday's copy of JUMP-01 contains the attacker's tool.
• Option C ignores the cost of waiting, which NIST says to weigh when deciding when recovery starts (SP 800-61 Rev. 3, Table 3, RS.MA-05).
• Option B accepts two assumptions, and each one has an owner and a time to test it.
• The backup was checked before use, as CSF 2.0 RC.RP-03 asks, and the restoration happens on a clean network, as CISA step 19 asks.
• Both roles the plan requires signed it, and the facts behind the decision are on record.

A Blank Decision Log Template

Use it in a tabletop exercise, in an audit of the response plan or in your portfolio. It has the same 16 columns as entry D-07: the entry number with its date and time, decision requested, options, confirmed facts with evidence, assumptions with how they will be tested, risk of acting, risk of waiting, proposed by, authorized by and under which plan section, consulted, informed, evidence preserved, decision and time, condition for revisiting it, and recorded by.

Free download, no sign-up. The PDF is US Letter, landscape. The spreadsheet has a second tab with the completed D-07 entry as an example.

Interview Question: What Do You Need to See Before Approving Restoration?

"It is 8 a.m. Ransomware encrypted two file servers overnight, and the COO wants to restore everything from Sunday's backup. You are the risk or compliance person on the response committee. What do you need to see before you support that decision, and who should sign it?"

What a strong answer explains (GRC Careers editorial judgment):

• Who holds the authority under the plan, and that IT carries out the restoration but does not decide it alone.
• Whether containment is done: the way in is closed and compromised accounts are disabled.
• Whether the hunt for persistence has started, and what it has found so far.
• When the intrusion began compared with the date of the backup. A backup that predates the encryption does not necessarily predate the attack.
• That the backup is checked before use (CSF 2.0, RC.RP-03) and restored first on a clean network (CISA, step 19).
• That evidence is preserved before anything is rebuilt.
• What is still assumed and who will test it by when, all written in the log.
• Which legal deadlines run in parallel, without holding up recovery.

Signs of a weak answer:

• Restore now from the latest backup, without asking when the attacker got in.
• Saying the decision belongs to IT.
• Confusing the time of encryption with the time of intrusion.
• No mention of evidence or of recording the decision.

What Does This Case Show in an Audit, Privacy, Risk or Compliance Portfolio?

• Audit: that you can test whether the plan names authorities and whether the log shows they were respected (CSF 2.0, GV.RR-02 and RS.AN-06).
• Privacy: that you can identify personal data on affected systems, fix the time of awareness and document the breach (GDPR, Article 33).
• Risk: that you weigh the risk of acting against the risk of waiting and leave acceptance of residual risk with the business owner.
• Compliance: that you name the jurisdiction behind each deadline and catch a scope question like the NIS2 one early.

To turn it into a portfolio piece, pick a system you know, write half a page of authority rules for a fictional plan, fill in three entries of the template (isolate, preserve, restore) and mark each fact as confirmed or assumed, with its source. To go further, Project 4 of the AI Assurance Engineering Skills Map shows how to run an incident tabletop. Our guides to AI incident response skills and GRC evidence and documentation skills cover the habits this case tests.

Sources

• NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, April 2025, superseding Rev. 2 from 2012. We use Section 2.2 (roles and responsibilities), Section 2.3 (policies) and Table 3 (RS.MA-05, RS.AN-06 and RS.AN-07).
• CISA and partners, #StopRansomware Guide, published October 2023 (version 3.0; CISA's page lists a revision date of October 19, 2023). We use Part 2, the Ransomware and Data Extortion Response Checklist, steps 1 to 4, 7, 9, 12, 13, 15, 18 and 19, and the Reporting and Notification section. The guide's page at CISA.
• NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29, published February 26, 2024). Subcategories GV.RR-02, RS.MA-05, RS.MI-01, RS.AN-06, RS.AN-07, RC.RP-03 and RC.RP-05.
• Regulation (EU) 2016/679 (GDPR), Articles 33 and 34, on EUR-Lex.
• Directive (EU) 2022/2555 (NIS2), Articles 23 and 41, on EUR-Lex.
• Agencia Española de Protección de Datos, page on communicating personal data breaches to affected people, last modified December 10, 2025 (in Spanish).

We checked these sources on November 8, 2026. CISA and NIST revise their guidance; when one of them publishes a new version, we review this page.

Keep Reading

• CS-014 Ransomware: the one-page reference sheet
• CS-095 Incident Response: Containment
• CS-097 Incident Response: Recovery
• CS-099 Digital Evidence and CS-101 Memory Forensics
• IT auditor job description and cybersecurity compliance analyst job description
• Cybersecurity jobs

Lire ce cas en français

Where to go next

• Browse the jobs that use these skills
• Follow a career roadmap into the role you want
• Hiring for this? Start from a job description template
• Free certification study games, 652 practice questions

More in this series

• 9 Essential Data Governance Skills for the AI Era
• 10 Internal Audit Skills for Modern Assurance Careers
• 12 Transferable GRC Skills You May Already Have
• Technical vs. Nontechnical GRC Skills: What Employers Actually Need
• AI Governance Skills Employers Actually Hire For
• GRC Analyst Skills: What the Job Actually Requires
• Compliance Analyst Skills
• Risk Assessment Skills
• Controls Testing Skills
• Policy Writing Skills
• Regulatory Change Management Skills
• Third-Party Risk Skills
• Model Risk Management Skills
• AI Impact Assessment Skills
• AI Auditing Skills
• AI Evaluation and Testing Skills for Governance Careers
• Data Lineage Skills
• Data Quality Skills
• Privacy Engineering Skills
• AI Security Skills
• AI Incident Response Skills
• Governance Program Management Skills
• Stakeholder Communication Skills
• Executive Risk Reporting Skills
• Evidence Documentation Skills
• Control Mapping Skills
• Framework Crosswalking Skills
• Vendor Due Diligence Skills
• Responsible AI Skills
• GRC Tools and Automation Skills
• How to Build the 9 Data Governance Skills: A 12-Month Career Plan
• 10 In-Demand Compliance Skills for Today’s GRC Careers
• 10 Essential Risk Management Skills Employers Value
• 10 In-Demand Data Privacy Skills for Privacy Professionals
• 10 Cybersecurity Skills for GRC and Security Careers
• 9 AI Assurance Skills for Audit, Risk, and Governance Professionals
• Writing a Resume for AI Cybersecurity Jobs
• AI Assurance Engineering Skills Map: Four Role Families and Five Portfolio Projects
• Would You Approve This AI Release? A Worked Case on Changes After Evaluation