Start with the right question
A ransomware incident creates several parallel tasks: protecting operations, understanding exposure, communicating, and preserving evidence. A documentation lead can keep those tasks aligned while technical specialists handle the systems. This page is an organizational aid, not an incident-response playbook.
Work through the checks
Record discovery precisely
Write down who observed what and when, including time zone and the source of each report. Distinguish the first observed symptom from the unknown start of the intrusion. Avoid guessing the full scope.
Track response decisions
Record actions, responsible people, and the advice behind them. Preserve decision timing without publishing credentials, vulnerabilities, or sensitive forensic details in a broadly shared log.
Separate facts and hypotheses
Maintain a list of confirmed affected systems and a separate list under investigation. Mark assumptions about data access or exfiltration. Do not communicate an unverified conclusion as a settled fact.
Organize costs and contacts
Track invoices, service interruptions, insurer contacts, and legal or regulatory questions. Keep relevant policy documents available, but do not assume coverage or a notification duty from a generic checklist.
A record you can use
- Observation and source
- System reference
- Decision, owner, and time
- Confirmed versus under investigation
- Cost or notification question
Keep this record locally. Use document references rather than publishing account numbers or other people's personal details. An empty field means the information is still missing; it should not be filled with an AI guess.
Worked example
A fictional business sees encrypted files on one workstation. The incident log records that observation while responders investigate other systems. It does not announce that every customer record was stolen or that no data was exposed. Later findings are added with their source and date.
This example is fictional and illustrates the method, not a real case result.
Limits and next steps
Do not destroy evidence, contact attackers, pay a demand, or make public assurances based on this page. Technical containment and legal notification decisions require qualified, situation-specific assistance.
Use the FTC's business breach guidance with your response team. Maintain a restricted master record and prepare separate, reviewed communications for different audiences rather than sharing the raw incident log publicly.