What to Do in the First 24 Hours After a Ransomware Attack

First hour: activate and preserve

Activate leadership and preserve evidence before making irreversible changes.

Hours 1–8: contain with evidence

Contain affected access while protecting critical business continuity.

• Business context and critical dependencies
• Technical and operational evidence
• Owner, priority, timing and validation

Hours 8–24: decide recovery and communication

Coordinate legal, insurance, communications and technical work through one incident structure.

What makes the result actionable?

A named owner, decision rationale, evidence, timing and a validation method.