Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
During a ransomware incident, incident responders investigate and contain the compromise, recovery specialists help restore systems and operations, and negotiators handle communications with attackers and advise on demands. Their services can overlap, but negotiation is not technical recovery—and no negotiator can guarantee that criminals will decrypt files, delete stolen data, or stop attacking.
What each ransomware specialist does
| Specialist | Primary job | Typical work | What the role does not guarantee |
|---|---|---|---|
| Incident responder | Investigate and contain the compromise | Identify affected systems and likely entry points; scope attacker access and possible data exposure; preserve evidence; coordinate containment and eradication; support recovery planning. | That systems can be restored quickly, or that every affected system or exposed file can be identified immediately. |
| Recovery firm | Help restore systems and business operations | Assess clean backups or available decryptors, rebuild systems, restore data, and sequence restoration around business priorities. | That a backup is usable, a decryptor exists, or restored systems are clean unless validation is part of the agreed scope. |
| Negotiator | Manage attacker communications and support decisions about demands | Seek time, clarify claims, communicate the organization’s position, and help assess a demand if payment is being considered. | That a criminal will provide a working decryptor, return all data, delete stolen data, or end the attack. |
These are functional distinctions, not uniform professional licenses or fixed service packages. A single provider may offer more than one service, so determine the exact scope in writing. CISA’s #StopRansomware Guide describes containment, evidence preservation, and restoration precautions; a provider’s service description illustrates how one incident-response offering can include containment, investigation, decryption-key validation, and recovery planning. That vendor description is an example of stated scope, not an independent service standard.
Incident responders: investigate, contain, and preserve evidence
Responders help establish what happened and limit further damage. Their findings can inform technical remediation, legal and notification decisions, and the safe order for restoring systems. CISA recommends identifying impacted systems and isolating them, preserving relevant system images, memory, and logs, and notifying appropriate stakeholders and authorities.
Ask whether the responder will investigate the likely entry point, assess possible data theft, preserve evidence, coordinate containment and eradication, and produce findings that the recovery team can use. Clarify who is responsible for each task: internal IT, a managed security provider, outside counsel, the insurer, or an external response team.
#1 Best Overall
Recovery firms: rebuild and restore operations
Recovery work begins alongside containment, but restoration should not undo it. The organization sets business priorities; specialists can advise on technical dependencies and sequence systems, but they cannot decide which services matter most to the organization.
CISA advises scanning backups where possible, restoring from offline, encrypted backups, and avoiding reinfection by reconnecting unclean systems. A recovery provider’s scope should say which systems and data it will restore, what access and work it needs from internal IT, how it will validate restored systems, and where forensic investigation ends and rebuild work begins. “Recovery firm” is not a standardized designation, so these details matter more than the label.
Negotiators: manage communications, not the technical recovery
A negotiator may communicate with attackers, clarify their claims, seek time, or help evaluate a demand if payment is under consideration. That role may overlap with incident response, insurer procedures, legal advice, or payment facilitation, but it does not replace forensic investigation or system restoration.
Payment is not a dependable recovery plan. CISA, the FBI, and NSA “strongly discourage paying a ransom to criminal actors,” citing the risk of encouraging further criminal activity and the absence of any guarantee that payment will restore files. The Counter Ransomware Initiative likewise strongly discourages payment, stating that “Acceding to ransom payment demands fuels the ransomware business model.” Its guidance recommends examining the technical and operational situation, alternatives to payment, and applicable legal requirements. Check whether the organization’s insurance policy includes or requires a negotiator, and involve legal counsel before making decisions. Laws and obligations vary by jurisdiction.
How the specialists should work together
The roles may be provided by separate firms or combined. A responder’s findings can shape recovery sequencing and inform any negotiation. The organization should coordinate its IT team, leadership, legal counsel, insurer, communications staff, and external specialists through its incident plan. CISA identifies IT, managed security providers, insurers, and organizational leaders as relevant stakeholders; Counter Ransomware Initiative guidance also points to insurers, technical authorities, law enforcement, and incident-response companies familiar with ransomware as potential sources of help.
A combined provider may reduce handoffs, but official guidance does not establish that one-provider or multi-provider response is always better. Compare the actual written scopes and coordination plan instead:
- Scope and ownership: Who investigates, contains, restores, communicates with attackers, and makes each decision?
- Coordination: How will the provider work with internal IT, the insurer, legal counsel, and any other specialists?
- Evidence handling: What data, logs, images, and records will be preserved, and how will findings be shared?
- Restoration validation: Who checks that systems are clean before they are returned to service?
- Policy and legal requirements: Does the insurer require an approved provider panel, hotline, or process? What local legal or contractual duties apply?
- Business control: Does the organization retain authority over business priorities and decisions?
Immediate steps and public-sector help in the United States
- Follow the incident response plan. Use established contacts and decision processes rather than improvising under pressure.
- Isolate affected systems. CISA’s joint guidance recommends isolating impacted systems and preserving relevant evidence, including system images, memory, and logs.
- Bring in the appropriate specialists and authorities. The guidance recommends reporting to or requesting help from CISA, the FBI, the FBI Internet Crime Complaint Center, or the U.S. Secret Service. Federal asset response offers technical help to mitigate impact and speed recovery; federal threat response involves law-enforcement and intelligence work. Contacting agencies does not replace the organization’s own remediation or business decisions.
- Assess exposure and notification duties. Determine whether data may have been exfiltrated, how sensitive it is, and whether legal or contractual notification requirements apply. Counter Ransomware Initiative guidance recommends documenting decisions and assessing the sensitivity and extent of exposed data.
- Restore cautiously. Scan backups where possible, restore from offline, encrypted backups, and do not reconnect systems until they are considered clean to avoid reinfection.
This is U.S.-weighted operational guidance, not a complete procedure for every country. Reporting rules, legal obligations, insurer terms, and available assistance depend on jurisdiction and policy.
Prepare before an incident
Confirm the insurer’s policy terms, approved provider panel, and incident-response hotline before an emergency. Keep contact details for internal decision-makers and relevant external specialists in the incident plan. CISA recommends offline backups; an external hard drive can be one component, but hardware alone does not create a secure backup system. Isolation, access controls, architecture, and restore testing also matter.
CISA’s #StopRansomware Guide resource record lists a revision date of 19 October 2023 and says the guide was developed through the Joint Ransomware Task Force with contributions from CISA, MS-ISAC, NSA, and the FBI. See the CISA guide resource page.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
