What belongs in a ransomware recovery plan?
The technical half of a ransomware recovery plan is the familiar part: isolate, verify the backups, restore in a known order. The other half is the set of decisions nobody has made in advance. Who authorizes paying or refusing. Who decides the data that left is a notifiable breach. Who tells customers, and when. Those three belong in the plan, with names against them, and they are the reason a clean restore does not end the incident.
Why a clean restore is not the end
Because the data often leaves too. In one large carrier’s claims data, 70 percent of ransomware claims involved data theft as well as encryption, at an average cost of USD 302,000, roughly twice the cost of encryption alone (Coalition, 2026 Cyber Claims Report, 2026).
Restoring from backup answers the outage. It does nothing about the copy somebody else now holds, and any obligation you have about that copy applies whether or not you paid and whether or not you recovered.
Among that carrier’s policyholders, refusing has become the norm rather than the exception: 86 percent of those hit by ransomware in 2025 refused to pay (Coalition, 2026 Cyber Claims Report, 2026).
What does the Cyber Centre say to prepare?
The Cyber Centre’s ransomware playbook covers backups, payment and rehearsal.
On backups: Storing your organization’s backups offline offers you the most protection against ransomware incidents, with multiple backups in multiple locations, and a schedule to test them regularly (Canadian Centre for Cyber Security, Ransomware playbook, ITSM.00.099, 2026). Before you restore, scan and analyze it with a known uncorrupted system to ensure it has not been compromised.
On payment, it declines to tell you what to do and tells you what to know instead: The decision to pay the ransom is up to your organization, but it is important to be fully aware of the risks associated with paying, and Paying the ransom will not guarantee access to your encrypted data or systems (Canadian Centre for Cyber Security, Ransomware playbook, ITSM.00.099, 2026).
On rehearsal, it is direct: Conduct a tabletop exercise to ensure all participants are aware of their roles and required actions in the event of a ransomware attack (Canadian Centre for Cyber Security, Ransomware playbook, ITSM.00.099, 2026).
Which decisions belong in the plan?
| Decision | Who owns it | What they need before deciding |
|---|---|---|
| Declare and isolate | Incident lead | The blast radius, even roughly, and authority to disconnect |
| Restore order | Operations, with the executive sponsor | Which operations the business cannot run without, agreed in advance |
| Pay or refuse | Executive sponsor, with legal and the insurer | Whether backups are viable, what left, and what the policy says |
| Notify the regulator | Legal | Whether the exfiltrated data crosses the harm threshold |
| Tell customers | Executive sponsor, with communications | A holding statement that already exists |
| Report to authorities | Legal or the incident lead | Who to call, which the guidance names |
The Cyber Centre points organizations at their local police service, the Canadian Anti-Fraud Centre and the Cyber Centre’s own portal, and invites organizations, if they are comfortable doing so, to share what the threat actor did (Canadian Centre for Cyber Security, Ransomware playbook, ITSM.00.099, 2026).
How do you know the plan works?
You run it with the people named in it, and you find out which of those six rows nobody agrees on.
Write the outcome down. The plan you tested and the record that you tested it are two different assets, and the record is the one your carrier can read.
Is a ransomware recovery plan the same as an incident response plan?
No. The incident response plan covers any incident and sets the decision structure. A ransomware recovery plan sits underneath it as a playbook and deals with the specific sequence: isolate, verify the backups are clean, restore in an order somebody agreed in advance, and handle the data that left.
Should the plan say whether we will pay?
It should say who decides and what they need to know, which a bare policy does not. The Cyber Centre's ransomware playbook leaves the decision to the organization while being blunt that paying does not guarantee you get your data or systems back.
How often should backups be tested?
The Cyber Centre's ransomware playbook suggests a schedule, monthly as an example, and separately says to scan a backup with a known clean system before restoring from it. A backup nobody has restored from is a hypothesis.