# Ransomware recovery and incident response plan: a UK guide

> What a ransomware incident response plan should contain, the four stages the NCSC sets out for handling an attack, who to tell and when, and how to recover from backups without letting the attacker back in.

- Published: 2026-10-27
- Topic: [Backup & Recovery](https://futuretechnologyhq.com/topic/backup-recovery/)
- URL: https://futuretechnologyhq.com/article/ransomware-recovery-incident-response-plan/
- Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article.

## Key points

- The NCSC says an incident response plan helps you make good decisions under pressure, whether your organisation is 10 people or 10,000
- Its four core response stages are analyse, contain, remediate and recover, and it says to confirm remediation has worked before moving to recovery
- The NCSC recommends playbooks for your top 3-5 most likely and high-risk incident types, covering at least the first few hours of each
- If a personal data breach is likely to pose a risk to people, the ICO must be told as soon as possible and where feasible within 72 hours
- The government urges organisations to have offline backups, tested plans to operate without IT for an extended period, and a well-rehearsed strategy for restoring from backups

## Article

A ransomware attack is the worst time to work out who does what. Systems are down, email may be gone, and the attackers are pushing for a fast decision. The NCSC says that whether your organisation is 10 people or 10,000, putting guidance in place on how to handle incidents will help you make good decisions under the pressure of a real incident. This guide sets out what a ransomware response plan should contain, the stages of a response, who to tell, and how to recover.

## What a ransomware attack looks like

The NCSC describes the usual pattern. Attackers gain access to your network, establish control and plant malicious encryption software. They may also take copies of your data and threaten to leak it. Then the malware is activated, locking devices and encrypting data across the network, and you usually get an on-screen message explaining the ransom and how to pay, normally in a cryptocurrency.

Two points from that matter for planning. First, the attackers are often inside before anything is encrypted, so recovery has to deal with how they got in. Second, the NCSC warns there have been cases where attackers destroyed copied files or disrupted recovery processes before launching the attack, so your backups are a target too.

## What the plan should contain

The NCSC's guidance on incident response processes sets out the ingredients of a basic plan. In summary:

**Key contacts.** Your incident response team or provider, IT, senior management, legal, PR, HR and insurance. The NCSC says to consider the risk of people being unavailable, and ideally include at least 2 contact methods and 2 or more people for each.

**Roles and coordination.** The NCSC says there must be a central point of coordination, whoever is involved, so that findings are correlated and actions are planned.

**Severity and type.** The NCSC suggests rating severity by whether the availability of data or systems is affected, whether sensitive data has been accessed, leaked or stolen, and whether data or systems may have been altered so they cannot be trusted. It recommends a matrix of example outcomes, rated for severity, tailored to your organisation.

**Escalation and decisions.** Document who to escalate to, with out-of-hours contact details, and how quickly. The NCSC says the people escalated to need the authority to make critical decisions, such as taking a critical service offline, and that you should plan deputies in case they are unavailable.

**Record keeping.** The NCSC says a careful record of decisions, actions and data captured is useful for post-incident reviews, especially if you need to show your response to a regulator. Its payment guidance adds that during an incident it is sensible to record decisions offline, or on systems not affected by the incident.

**Communications.** The NCSC says to consider secure or alternative communications for when normal channels are unavailable because of a network, email or phone outage.

**Linked plans.** The NCSC says the incident response plan should be linked to disaster recovery, business continuity and crisis management plans. Our guide to [backup vs disaster recovery, and BC vs DR plans](/article/backup-vs-disaster-recovery-bc-vs-dr/) explains how those fit together.

## Write a ransomware playbook

A playbook is a detailed response plan for one type of incident. The NCSC recommends starting with your top 3-5 most likely and high-risk incident types, and says threats that apply globally, such as major ransomware attacks, should be considered. As a minimum, it says to document simple instructions covering at least the first few hours of each incident, because those can be the most critical and time pressured.

## The four stages of the response

The NCSC sets out four core response stages: analyse, contain, remediate and recover.

**1. Analyse.** Work out enough about what has happened to act. The NCSC says the initial priority is usually to understand enough to take containment actions and ultimately remediate the attack, with tasks prioritised and findings constantly reviewed.

**2. Contain.** Once it is safe to do so, reduce the impact and stop things getting worse. The NCSC says this usually involves blocking activity, isolating systems and resetting accounts, and may need critical decisions such as taking a core business system offline. It warns that the attacker might react to your actions or bury themselves deeper in the network, and that in some cases it may be better to monitor and analyse further first.

**3. Remediate.** Fully remove the threat from your network and systems. The NCSC says this is sometimes coordinated so all actions happen at once, and that it is important to confirm remediation has been successful before moving to recovery, which may involve monitoring for a period.

**4. Recover.** Return systems to business as usual. The NCSC says clean systems and data are put back online, and final actions may be taken to handle regulatory, legal or PR issues.

## Recovering from backups

The government's ransomware announcement urges organisations to have offline backups, tested plans to operate without IT for an extended period, and a well-rehearsed strategy for restoring systems from backups. The NCSC says up-to-date backups are the most effective way of recovering from a ransomware attack, and that it is essential to always have a recent offline backup of your most important files and data.

Order matters. Restoring before the attacker is removed risks putting the same weakness back. The NCSC's payment guidance makes the same point about paying: making a payment without finding out how the compromise happened, and then taking mitigation actions, leaves you open to further incidents. In our view the same applies to a restore, so follow the NCSC order and restore once remediation is confirmed.

The NCSC also warns that even with a decryption key, a return to business as usual is unlikely to be immediate, because running a key across complex networks can take time. In our view, decide in advance which systems come back first. Our guides to [RPO, RTO and MTD](/article/rpo-rto-mtd-explained/) and [how often to test disaster recovery plans](/article/how-often-test-disaster-recovery-plan/) cover setting those targets and rehearsing them.

## Who to tell, and when

**The ICO.** If personal data is involved, you must assess the likely risk to people's rights and freedoms. The ICO says that if a risk is likely, you must notify it as soon as possible and where feasible within 72 hours. If the risk to people is high, you must also tell those people without undue delay. The ICO accepts you may not have the full picture within 72 hours, and says to provide what you have and add details later without undue delay. Its self-assessment tool helps decide whether to report, and the ICO says you do not need to report every breach.

**The NCSC.** The NCSC says UK organisations that have experienced a cyber incident can report it to the NCSC.

**Your insurer and IT provider.** The NCSC's payment guidance says that if you have cyber insurance you should report the attack to your insurer or broker, and that if you outsource your IT network you should engage your IT provider.

**Expert help.** The same guidance says objective external experts, such as insurers, the NCSC, law enforcement or cyber incident response companies, can improve the quality of decisions. The NCSC runs an assured scheme for cyber incident response providers.

Put all of these, with numbers that work out of hours, in the plan's contact list.

## The ransom decision

The NCSC and UK law enforcement do not encourage, endorse or condone paying ransom demands. The NCSC and insurance industry bodies advise slowing down rather than rushing: attackers use pressure tactics, and you may have viable backups or other ways to recover. They also warn that after payment an attacker may lie about deleting stolen data.

The government has also set out proposals, to be taken forward with industry and not yet law: public sector bodies and operators of critical national infrastructure would be banned from paying ransoms, other businesses would be required to notify the government of any intent to pay, and a mandatory reporting regime is being developed. Our guide to [whether you should pay a ransomware demand](/article/should-you-pay-ransomware-uk/) covers the UK position in detail.

## After the incident

The NCSC says a post-incident review should cover lessons from the incident itself and lessons from the response, across people, process and technical capabilities. The ICO says to reflect on whether your risk assessment is comprehensive enough and how effective your controls are. Update the plan and playbooks with what you learn, and test the changes.

## FAQ

### What should a ransomware incident response plan include?

The NCSC's basic plan covers key contacts with at least two people and two contact methods each, roles, a way to rate severity, escalation to people who can make critical decisions, the response stages, record keeping and a post-incident review. It recommends a playbook for each of your most likely incident types.

### What are the stages of responding to a ransomware attack?

The NCSC sets out four core stages: analyse, contain, remediate and recover. It says to confirm that remediation has been successful before moving to the recover stage, which may involve monitoring for a period.

### Do I have to report a ransomware attack to the ICO?

If personal data is affected and the breach is likely to pose a risk to people's rights and freedoms, you must notify the ICO as soon as possible and where feasible within 72 hours. If the risk to people is high, you must also tell those people without undue delay.

### Should we restore from backups straight away?

Not until you are confident the attacker has been removed. The NCSC says to confirm remediation has worked before recovery, and warns that paying without finding out how the compromise happened leaves you open to further incidents. The same applies to restoring.

### Should we pay the ransom?

The NCSC and UK law enforcement do not encourage, endorse or condone paying ransom demands. The NCSC and insurance bodies advise slowing down, checking whether you have viable backups, and getting objective expert advice before any decision.

## Sources

- [Cyber incident response processes](https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes)
- [Incident management collection](https://www.ncsc.gov.uk/collection/incident-management)
- [Mitigating malware and ransomware attacks](https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks)
- [What you need to know about ransomware](https://www.ncsc.gov.uk/ransomware/home)
- [Guidance for organisations considering payment in ransomware incidents](https://www.ncsc.gov.uk/guidance/organisations-considering-payment-in-ransomware-incidents)
- [Personal data breaches: report a breach](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/)
- [Self-assessment for data breaches](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach-assessment/)
- [UK to lead crackdown on cyber criminals with ransomware measures](https://www.gov.uk/government/news/uk-to-lead-crackdown-on-cyber-criminals-with-ransomware-measures)