The Ransom Decision (Board Edition)
Production is encrypted, a multi-million-dollar demand is on a 72-hour clock, and the board is in the room at midnight. Now the hard part: do you pay? Before anyone answers that, run the OFAC / sanctions screen on the attacker and the wallet — a payment to a sanctioned actor can be illegal regardless of circumstances — then bring in counsel, the insurer and law enforcement, and be clear on who actually has authority to decide. Paying never guarantees a working decryptor or that stolen data stays private, and viable backups change everything. Each decision shows you why.
Pair this drill with the free Ransom Payment Decision Framework & Board Memo — the document that records the call you practise here. Educational drill, not legal advice; sanctions screening and any payment decision require qualified counsel.
The real job. More noise, a tighter clock.
The board has been convened at midnight on a live ransom demand. Work 10 board-room decisions — make the call a court, a regulator and your insurer would find defensible, with the legal gates (sanctions screen, counsel, insurer, law enforcement) coming before any step toward payment. You are graded on how many you get right against the clock.
What this lab is
- A free, browser-based decision drill that drops you into a board convened mid-incident on a live ransomware demand: work ~14 pay / don’t-pay decisions under a ticking deadline.
- The through-line: the legal gates come first — run an OFAC / sanctions screen on the threat actor and the payment wallet before anything, then counsel, the cyber insurer, and law enforcement.
- You practise the real traps: who actually has authority to authorize a payment, why victim status does not cure a strict-liability sanctions violation, that paying never guarantees a working decryptor or that exfiltrated data is deleted, and why viable backups change the whole decision.
- Each decision reveals why the board-defensible answer is right, and you are graded S–D on how many you call correctly against the clock.
- Educational decision drill — not legal advice. Pair it with the free Ransom Payment Decision Framework & Board Memo template.
Frequently asked questions
What is the Ransom Decision Lab?
A free, in-browser decision simulation that puts you on a board convened mid-incident on a live ransomware extortion. You work through the pay / don’t-pay decisions under deadline pressure — run the sanctions screen first, who has authority to decide, when to engage counsel, the insurer and law enforcement, whether backups change the call — and each one has a single board-defensible answer, revealed after you lock it in.
Why does OFAC / sanctions screening come first?
Because facilitating a ransom payment to a sanctioned person, group or jurisdiction can violate US sanctions law on a strict-liability basis — you can be liable even with no intent and even as the victim. OFAC’s ransomware advisory makes the screen of the threat actor and the destination wallet the first gate, before you engage, negotiate or pay. It is a legal question for specialist counsel, not a business call.
Is this legal advice?
No. The lab is an educational drill and the regulatory references (the OFAC ransomware advisory, FBI/CISA guidance, breach-notification duties) are summarised for orientation and can change. Sanctions screening and any ransom payment decision require qualified counsel applied to your specific facts.
Who is it for?
CISOs, general counsel, CFOs, incident-response leads, board directors and anyone who would be in the room when a ransom demand lands — and who wants to rehearse the pay / don’t-pay call, and the gates around it, before it is real.