Ransomware Response Checklist: Finance, Legal and Tech Controls
Reviewed by CA Nikhil Gupta · Last reviewed 6 June 2026
A ransomware playbook integrating isolation, backups, privacy assessment, payment governance, insurer notice, fraud controls and recovery.
For broader context, see the Data Privacy, DPDP and Cyber Law — Full Compliance Hub.
Ransomware is a business shutdown, data-breach risk and fraud opportunity at the same time.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
Ransomware can encrypt systems, steal data, compromise credentials or combine all three.
CERT-In reporting may apply within six hours, while future DPDP and current sector duties need separate assessment.
Paying a ransom does not guarantee decryption or deletion and can create sanctions, criminal, insurance and governance issues.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- Ransomware can encrypt systems, steal data, compromise credentials or combine all three.
- CERT-In reporting may apply within six hours, while future DPDP and current sector duties need separate assessment.
- Paying a ransom does not guarantee decryption or deletion and can create sanctions, criminal, insurance and governance issues.
- Backups help only if isolated, tested and free from attacker persistence.
The five-point review
| Check | What to examine |
|---|---|
| Containment | Identity, network, endpoint and cloud. |
| Data | Exfiltration and affected people. |
| Continuity | Critical services and clean backups. |
| Payment | Legal, sanctions, insurer and board. |
| Recovery | Reset, rebuild and monitoring. |
Practical example
Attackers encrypt files and send fake supplier bank changes from compromised email. Finance must freeze bank-detail changes and verify them out of band while technology isolates the environment.
How to apply the framework
Create separate workstreams for containment, forensics, continuity, communications and fraud.
Restore from known-clean images and reset credentials before reconnecting systems.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review containment, data and continuity together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Implementation checkpoint
Before closing the review, assign a named owner, a completion date and a live-system test that proves the control works. A policy statement is not enough when the product, vendor, support team, payment process or access configuration behaves differently. Preserve the test result, exception approval and remediation ticket so management can distinguish an operating control from an intention that has not yet been implemented.
Action checklist
- Isolate systems.
- Preserve evidence.
- Activate continuity.
- Assess reporting and insurer notice.
- Apply dual approval.
- Rebuild and monitor.
Evidence to keep
- Ransom note
- Forensic images
- Backup tests
- Board decisions
- Recovery evidence
Warning signs
- Backups connected to infected network
- One employee negotiates alone
- Passwords reset from infected devices
- Bank changes approved by email
- No-evidence public promise
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.
Frequently Asked Questions
Source and review trail
Use the current official instrument, portal or regulator publication before acting. This panel separates the category authority from page-specific references.
- Primary category
- Data Protection, Cyber & IT Law
- Official starting point
- www.meity.gov.in