Create options
before the demand.

THE ORIGINAL DEBATE / 2024

What the survey and commentary actually said.

Proofpoint’s 2024 release said 62% of surveyed CISOs believed their organisations would pay to restore systems and prevent data release if attacked over the following year. This was a stated expectation, not proof that 62% paid, recovered successfully, or were advised to do so.

The CSO article discussed that dilemma. Today’s General Counsel also reported remarks by then-CISA director Jen Easterly about the practicality of a ban. Those are dated US policy discussions, not a statement of current UK law.

The unsupported anecdotal claim of a 30% increase in attacks is not used here. A payment decision needs evidence about the actual incident, recovery prospects, and applicable restrictions, rather than an untraceable sense that attacks are rising.

THE DECISION RECORD

Keep four questions separate.

The Counter Ransomware Initiative guidance strongly discourages payments and recommends expert support for incident decisions. Paying does not establish that data will be restored, that stolen information is deleted, or that access has been removed.

A decision record should show what alternatives were considered. A backup may be available but not yet tested, a service may require rebuilding, or a claimed data theft may remain unverified. Those are different uncertainties and should not collapse into a single demand-driven deadline.

UK CONTEXT

Do not confuse an insurance conversation with legal permission.

OFSI’s ransomware guidance explains that making or facilitating payment can expose those involved to civil or criminal penalties where financial sanctions are breached. Due diligence, engagement with authorities, and the particular facts matter; no generic checklist can guarantee a payment is lawful.

An insurance policy may include conditions relevant to response, notification, or specialist help. It does not override legal restrictions or guarantee reimbursement. Establish those arrangements before an incident and obtain the appropriate advice when one occurs.

The UK consultation response describes proposals on targeted bans, payment prevention, and reporting. A policy response is not itself evidence that every proposed duty has commenced. Check the law applicable at the time of the decision.

PREPARE THE OPTIONS

Reduce the chance that a demand becomes the only apparent path.

Exercise restoration of important services, including identity, configuration, data, and dependencies. Agree the minimum operating position, who accepts residual uncertainty, and how customers or affected people will receive reliable information.

Identify legal, incident-response, banking, and insurance contacts through trusted channels. Keep the process usable if normal email or sign-in is unavailable. Consider the workload and welfare of the staff who may sustain the response.

After containment and recovery, review the cause, continuing exposure, and actions required. The payment debate should never consume all attention while an intruder retains access or the organisation lacks trustworthy records.