A company decides whether to pay a ransomware demand by working through four checks: whether it can recover without paying, whether a free route to its files already exists, what outside experts advise, and whether it can later show a regulator how it reached its decision. The National Cyber Security Centre, which wrote its payment guidance jointly with the insurance bodies ABI, BIBA and IUA, is explicit that the final call belongs to the victim, and that the guidance never overrides a law that already applies.
more
What forces the question
The NCSC describes the attack plainly: a criminal group gets unauthorised access to a network, uses malware to encrypt files and lock out devices, then demands a ransom, usually in cryptocurrency, for the key that decrypts them. The Cybersecurity and Infrastructure Security Agency adds a twist. Attackers increasingly copy a victim’s data before they encrypt it, then threaten to publish what they stole as well as demanding payment for the decryption key, a combination CISA calls double extortion. Some skip encryption entirely and threaten only to leak the stolen files.
NIST sets out how the chain usually starts on the ground. Someone clicks a malicious link, downloads a file from an outside site, and runs it without knowing what it is. The file then exploits weaknesses to spread to other machines on the network before it encrypts files everywhere at once and puts a payment demand on every screen. NIST frames what follows as a dilemma for management: pay and hope the attackers keep their word about restoring access, or refuse and rebuild operations with the organisation’s own resources.
Why the first instinct is to slow down
The NCSC’s opening advice is not to rush. Ransomware operators build their pressure tactics to push a victim towards a fast decision, and the agency says that slowing down to review the real options leads to a better outcome.
That review starts before payment is even considered. A company checks whether it has backups that still work, whether some other route back into its systems exists, and whether a free decryption key for that particular strain of ransomware is already available through a third party such as law enforcement. CISA’s own guide, produced with the FBI and the NSA as co-authors through the Joint Ransomware Task Force, tells organisations to keep offline, encrypted backups and test them regularly against a disaster-recovery scenario long before an attack happens. A backup that survives the attack can remove the ransom question before it is asked.
Who else gets pulled into the room
The NCSC advises bringing in outside experts where possible. It points a victim towards its insurer, the NCSC itself, law enforcement, or a cyber incident response firm that knows ransomware cases, and it keeps its own list of recommended CIR companies. Insurers often recommend a panel of their own, so a company with cyber cover is told to report the attack to its insurer or broker straight away, through whatever number or app the policy provides out of hours. A company that outsources its IT should bring that provider in too.
Few situations pull senior decision-makers into a call this fast, and the NCSC’s guidance says the options should never reach them half-formed. They need the strongest evidence base the organisation can put together, and the technical staff who understand the attack need a seat at that table rather than a decision handed down without them.
What a payment does not settle
Even a company that pays is not buying certainty. The NCSC warns that a victim can still find, after paying, that the attacker lied about deleting the stolen data: the criminals may sell it to another group anyway, or bring back the leak threat months or years later. NIST’s framing of the choice as hope rather than certainty points at the same gap. Paying can be expensive, and there is no guarantee the data comes back at all. If customer data was stolen along the way, that alone can trigger a state’s data breach notification laws.
The record a later regulator will ask for
Alongside the decision itself, the NCSC tells organisations to keep a careful, contemporaneous record of what happened, what was decided and what was done, ideally stored offline or on systems the attack never touched. That record matters afterwards, for a post-incident review, for lessons learned, and for any evidence a regulator asks to see.
The guidance a company draws on has itself moved with the threat. CISA’s current guide is an update of one first published in 2020, rewritten with the FBI and NSA as the tactics it responds to grew more damaging. None of that guidance can make the payment decision for a company. It can only make sure that, whichever way a company decides, it decided with the fullest picture the ransomware operator did not want it to have.
