Skip to main content
Marsh logo

Article

Ransomware: How to Create a Comprehensive Incident Response Plan

It is crucial to create a comprehensive incident response plan as the first step to prepare for any ransomware incidents that may take place.
Person's name and title

By Kelly Butler , 

Cyber Practice Leader, Marsh Specialty

08/23/2022 · 2 minute read

Ransomware attacks are escalating, with more frequent and sophisticated attacks being seen globally in the past year. In the face of a devastating ransomware attack, many companies experience a “paralysis” that significantly lessens the effectiveness of their response. They are often caught off guard — and these hesitations and slow decisions can have significant financial and operational impacts. It is crucial to create a comprehensive incident response plan as the first step to prepare for any ransomware incidents that may take place.

Over the years, Marsh has helped countless organisations craft ransomware incident response plans and tailor cyber coverage to help them prepare for the unexpected. In this guide, we share our insights to help your organisation avoid response paralysis and recover quickly from an attack.

Pre-Incident

The value of preparing in advance for the possibility of a ransomware attack cannot be overstated. Here, we explore numerous considerations, from identifying your options to developing internal policies and guidance to understanding regulatory implications and potential sanctions.

During the Incident

This is where your planning will pay off. We provide insight into key areas during the incident, such as minimising your exposure and working with your carrier, along with the all-important question of whether to —and how to—pay the ransom.

Post-Incident

The work doesn’t end after a ransomware attack is resolved. We provide specific guidance around recovery, including identifying additional weaknesses to strengthening your plan for the future.

Contact Us

For more information about Cyber Risk and how Marsh can support your business, please contact your Marsh representative.

Remove Response Paralysis with a Comprehensive Incident Response Plan

Download now

Related insights

Estuary at Bair Island Marine Park in Redwood City, CA

Article

Third-party cyber risks impact all organizations

04/22/2025
Container lifting

Article

Effective Cyber Incident Management Strategies for Supply Chain Resilience

01/20/2025
Placeholder Image

Article

Navigating business interruption claims: Maximizing recovery after a cyber attack

01/20/2025
rocks on a beach, piled ontop of each other, grey aestehtic, 16:9, beach photo.

Webcast

Q4 2024 update on the US cyber insurance market

12/13/2024
View more