Ransom Payment Decision Framework & Board Memo
Privileged & confidential — prepared at the direction of counsel. This framework structures a board or named-executive decision on a ransomware payment under duress. The legal gates come FIRST: an OFAC / sanctions screen of the threat actor and payment wallet, then counsel, the cyber insurer, and law enforcement — before any step toward engaging or paying the attacker.
01STOP — legal gates before any step toward payment
Do NOT engage, negotiate, or move money until the OFAC / sanctions screen is complete. Facilitating a payment to a sanctioned person, group or jurisdiction can violate US sanctions on a STRICT-LIABILITY basis — you can be liable with no intent and even as the victim (see OFAC’s advisory on ransomware payments). A flagged actor makes this a question for sanctions counsel, not a business decision.
- OFAC / sanctions screen — screen the threat actor, any named group/affiliate, and the destination wallet before anything else. If flagged or uncertain, stop and escalate to sanctions counsel.
- Breach counsel — engage counsel to direct the investigation under privilege and own the legal strategy, including the sanctions analysis.
- Cyber insurer — give prompt notice and obtain required consent/pre-approval; paying outside the policy’s process or without panel-vendor use can forfeit coverage.
- Law enforcement — notify and work with the FBI / CISA; they may hold a decryptor or threat intelligence and expect reporting, even though they discourage paying.
Sanctions screen result
CLEAR / FLAGGED / UNCERTAIN — actor, group, wallet; who screened; date/time
Breach counsel engaged
Firm / lead / date — privilege asserted
Insurer notified & position
Carrier, claim #, consent status, panel vendors required
Law enforcement contact
FBI field office / CISA contact, report reference, date
02Decision factors (assess each before deciding)
Record where each factor stands. The first two often decide the question on their own: viable backups remove the recovery reason to pay, and a sanctions flag can take payment off the table entirely.
| Factor | Assessment |
|---|---|
| Restore-from-backups viability | Clean, tested, offline backups? Time to rebuild? If viable, the recovery case to pay is weak |
| Data exfiltration confirmed | Confirmed / suspected / none — if confirmed, treat as a probable breach; payment will not guarantee deletion |
| Sanctions / OFAC risk | Clear / flagged / uncertain — a flag or uncertainty blocks payment pending counsel |
| Cyber insurer position | Consent given / pending / refused; coverage conditions and sub-limits |
| Legal & regulatory exposure | Breach-notification duties, regulator timelines, contractual notice — these run regardless of payment |
| Decryptor reliability | Unknown / sample tested / known-unreliable — paying buys a promise, not a guaranteed recovery |
Payment does not guarantee a working decryptor, does not prove exfiltrated data was deleted, and does not stop a later leak. Weigh it as buying a criminal’s promise, not a result.
03Decision tree (work the gates in order)
- Screen first — run the OFAC / sanctions screen on the actor and wallet. Flagged or uncertain → STOP, do not pay, escalate to sanctions counsel.
- Backups viable? → If clean, tested backups can restore in an acceptable time, plan to recover and treat payment as a last-resort data-leak question only, not a recovery need.
- Legal clearance → counsel confirms the sanctions analysis and the insurer gives required consent; proceed only with both.
- Authority → confirm the person/body with explicit authority to approve this amount (see the approval matrix) is making the call — not the IR lead unilaterally.
- Decide → make and contemporaneously document the pay / don’t-pay decision and its rationale. If paying, route mechanics through a specialist firm that re-screens the wallet at transfer and tests the decryptor.
Deadline pressure is the attacker’s leverage, not a legal override. Operational panic is exactly how organizations skip the sanctions/counsel gate and make an illegal or uninsured payment. The gates hold regardless of the clock; deadlines are frequently negotiable.
04Authority & approval matrix (who can authorize what)
A ransom payment of material size is a governance decision, not a technical one. Define in advance who authorizes what, so no single person approves a multi-million-dollar, sanctions-sensitive payment under pressure.
| Action | Who authorizes | Pre-conditions |
|---|---|---|
| Run the response / contain / recover | Incident-response lead / CISO | Standing IR mandate |
| Engage counsel, insurer, law enforcement | CISO / GC | Incident declared |
| Open a negotiation channel with the attacker | GC + named executive | Sanctions screen clear or pending counsel approval |
| Approve a ransom payment (any amount) | Board or specifically authorized named executive | Sanctions clearance + insurer consent + documented rationale |
| Approve payment above $ threshold | Full board | All of the above + board minute |
Decision-maker of record for this incident
Name / role / authority basis
Others consulted
GC, CFO, CISO, IR lead, external counsel, insurer
05Board memo skeleton (recommendation & rationale)
Capture the decision contemporaneously and under privilege where appropriate. A defensible ransom decision is a documented one — judged on the process followed with the information available, not on what the attacker later does.
Recommendation
PAY / DO NOT PAY / CONTINUE TO ASSESS — and scope/amount if paying
Rationale
Tie to the decision factors: sanctions result, backup viability, exfiltration, insurer position, legal exposure
Risks of paying
Sanctions/legal exposure, no guarantee of decryptor or deletion, funds/emboldens actors, repeat-targeting, reputational/precedent cost
Risks of not paying
Downtime, recovery time/cost, data-leak likelihood and impact
Parallel obligations
Breach-notification, regulatory and contractual duties that proceed regardless of payment
Conditions on any payment
Specialist payment firm, wallet re-screen at transfer, decryptor sample test, negotiated amount, insurer consent on file
If the board decides not to pay and the attacker leaks anyway, that does not make the decision wrong — payment never guaranteed the data stayed private. Record why the decision was reasonable on the facts known at the time.