Cybersecurity and Disaster Preparedness: What a Ransomware Incident Actually Demands From Your Emergency Operations Plan

A ransomware incident can quickly become an operational emergency. Staff may lose access to the systems they need to coordinate care, teach classes, pay employees, manage facilities, or communicate with the public. Even when the initial cause is digital, the consequences may be felt across an entire organization.

That is why a cyber incident should be addressed in more than an IT incident ticket. Your emergency operations plan (EOP) and continuity of operations plan (COOP) should help leaders activate the right people, prioritize essential services, make decisions with incomplete information, and keep communicating while systems are investigated and restored.

This article focuses on execution: what those plans need to support during a ransomware or destructive cyber incident. For broader guidance, see the CISA #StopRansomware Guide, FEMA’s cyber incident planning resources for emergency managers, and NIST Special Publication 800-61 Rev. 3.

Treat a cyber incident as an emergency when operations are at risk

IT teams lead technical investigation and response. But when an incident threatens essential services, safety, significant operations, or the organization’s ability to coordinate, emergency management and continuity leaders also have a role.

Your plan should define activation triggers, not leave the decision to instinct during a crisis. Triggers might include loss of systems that support essential services, suspected compromise of identity or communications platforms, disruption across multiple sites, inability to verify system integrity, or a credible risk to life safety or public service delivery. Set thresholds that fit your organization and define who can activate the EOC or equivalent coordination structure.

Once activated, establish a shared operating picture and clear decision authority. An IT or cybersecurity lead should advise on technical status, containment, and recovery. Emergency management should coordinate the wider response. Business and service owners should explain operational impacts and continuity needs. Communications, legal, privacy, facilities, security, and executive leadership should be involved as the situation requires.

Use a structure your organization already understands, such as an EOC framework or, where appropriate, unified-command principles: to clarify roles, keep decisions visible, and coordinate priorities. This is not about replacing technical response with an EOC. It is about connecting technical actions to real-world consequences.

Keep essential services working without core systems

A COOP should explain how priority functions continue when their usual applications, networks, or devices are unavailable. A list of critical systems is a start, but it is not a workable downtime procedure. For each essential function, document who performs it, what minimum information and resources are needed, how work will be recorded, and how the organization will reconcile records after restoration.

Consider practical procedures for:

• Payroll: Who authorizes time records and payments if the usual platform is unavailable? Where are secure offline forms kept, and how will entries be checked later?

• Scheduling: How will staff, shifts, classrooms, appointments, or service coverage be coordinated from an approved offline roster?

• Health records: What safe, privacy-conscious downtime process supports essential care or public health work? Who can access paper records, and how will they be protected and reconciled?

• Student services: How will an institution handle urgent student needs, essential advising, housing concerns, or service requests without student information systems?

• Access control: What is the approved procedure if electronic badges or door systems fail? How will authorized access be checked and life-safety requirements maintained?

• Building systems: Who assesses whether facilities can operate safely if monitoring, automation, or control systems are disrupted? What is the manual fallback, and when must a space close?

Make sure workarounds are usable, approved, and tested. Printed forms and contact lists need secure storage and regular updates. Manual processes should protect sensitive information and make it possible to track decisions and actions. Ready.gov’s business continuity plan and IT disaster recovery guidance offer useful planning references for connecting business priorities with technology recovery.

A first-72-hours decision sequence

The first three days are not a universal checklist or a promise that an incident will be resolved in that period. They are a useful planning window for organizing decisions, establishing priorities, and revisiting assumptions as facts change.

First hours: establish control and protect people and systems. Activate the response structure when thresholds are met. Confirm what is known, what is suspected, and what is still unknown. Identify potentially affected systems and essential services, and determine whether safety, facilities, or service-delivery decisions are needed immediately. Follow the incident response plan for containment, coordinating IT, security, service owners, and qualified technical support. If communications or identity systems may be compromised, do not rely on them without verifying they are safe.

As the picture develops: preserve evidence and set priorities. Coordinate containment with evidence preservation. CISA’s ransomware response guidance recommends preserving relevant information, including system images, memory captures, and logs where appropriate. Follow your plan and specialist guidance on collection and handling; avoid actions such as indiscriminately wiping or rebuilding affected equipment before evidence needs are considered. At the same time, identify which services must continue, what can be paused, and what conditions must be met before systems are restored.

Through the first days: coordinate notification and recovery decisions. Involve legal counsel and privacy leadership early to assess facts and determine which contractual, regulatory, or other notification obligations may apply. Requirements vary by organization, jurisdiction, data type, and circumstances; the EOP should identify decision-makers and escalation routes, not try to replace legal advice. Keep leadership informed through agreed briefings, document key decisions, and coordinate external reporting or assistance as appropriate. NIST’s current incident response guidance emphasizes integrating response with broader cybersecurity risk management and organizational recovery planning.

Communicate when normal channels may be untrustworthy

A contact list stored only in a potentially affected system is not a backup communications plan. Establish out-of-band channels in advance: for example, a verified emergency notification platform, a maintained call tree, or another pre-approved channel that does not depend on the systems under investigation.

Agree beforehand on who can send messages, how recipients can verify that a message is genuine, and how updates will be handled if a channel becomes unavailable. Keep secured, accessible copies of essential contact information and message templates. Include employees, students, patients or service users where relevant, families, suppliers, regulators, and other stakeholders identified by your organization.

A message does not need to resolve every unknown. It should communicate what is confirmed, what people should do now, where verified updates will appear, and when they can expect another update. Coordinate public messaging with the designated communications lead and legal or privacy advisers. Ready.gov’s crisis communications guidance recommends planning audiences, responsibilities, and communications in advance.

Exercise the technical response and the human decisions

A ransomware tabletop should test more than whether the security team can identify a threat. Give participants realistic decisions across technical response, continuity, leadership, and communications. For example: essential systems are unavailable; the status of backups is uncertain; a manager cannot reach the usual contact list; and a service owner needs an immediate decision about continuing operations.

Ask participants to work through who activates the EOC, who can authorize containment or downtime procedures, which services take priority, how staff receive verified instructions, and who assesses notification obligations. Include alternates and the people who would actually carry out manual workarounds. Exercise channels and forms, not just the written plan.

After the exercise, document what happened, what assumptions proved incorrect, and what needs to change. Assign each corrective action an owner and a deadline, then update the relevant procedures and test the changes. Alpha Research Group’s article on designing corporate crisis exercise simulations offers additional ideas for building useful exercises.

A readiness checklist to run this quarter

Use this short review to identify practical gaps:

• Confirm EOC activation triggers and who has authority to activate.

• Name primary and alternate leads for IT, emergency management, operations, communications, legal, privacy, facilities, and security.

• Identify essential services, their technology dependencies, and minimum operating requirements.

• Write and validate downtime procedures for critical business and public-facing functions.

• Check that emergency contacts and out-of-band communication instructions are available offline.

• Confirm the process for evidence preservation, legal/privacy review, and notification decisions.

• Review backup and restoration priorities with the owners of the business functions they support.

• Run a tabletop that tests technical response, continuity workarounds, and stakeholder communications.

• Track exercise findings to completion and update plans accordingly.

Preparedness means being able to coordinate and sustain essential work while technical teams investigate and recover systems. To discuss customized emergency management training or crisis exercise support, visit Alpha Research Group or contact mardis@alpharesearchgroup.com.