Direct answer
Declare a recovery event based on impact and loss of trust, not only the presence of a ransom note. Useful triggers include loss of privileged identity confidence, cross-segment encryption, backup-control compromise, inability to contain within a defined window, or outage beyond a business threshold.
How to frame the decision
A recovery objective is useful only when it names the service boundary, measurement point, dependencies and authority to accept a miss. Exercises should record actual elapsed time rather than optimistic estimates.
For this decision, document the protected service, assumed compromise, required recovery point and the maximum acceptable time to a trusted business state. Keep product capability, configured capability and tested capability as three separate fields: they are rarely identical.
Decision table
The following factors convert the decision into requirements that can be reviewed, tested and retained as evidence.
| Factor | Practical guidance | Evidence to retain |
|---|---|---|
| Impact threshold | Set service, safety, financial and regulatory conditions that activate continuity governance. | A decision matrix approved by business leadership. |
| Trust threshold | Include conditions where systems appear available but administrative trust is lost. | Examples covering stolen privileged credentials and backup tampering. |
| Authority | Name primary and alternate declarers with an emergency communication route. | A tabletop that activates the alternate when the primary is unavailable. |
Validation procedure
Run this procedure in a non-production or isolated recovery environment. Define a named owner and time limit before the test begins.
- Run the sequence with named owners and a measured clock.
- Translate the requirement into a pass/fail test for ransomware disaster declaration criteria.
- Capture timestamps, logs, restored-object counts and operator actions for each decision factor.
- Repeat the test with one dependency unavailable so the result reflects a hostile recovery, not a clean demo.
A pass means the recovery outcome and supporting evidence meet the pre-declared requirement. A partial restore, undocumented manual workaround or result that depends on an unavailable production service should be recorded as an exception—not rounded up to a success.
Common failure modes
These conditions can make a compliant-looking design unusable during an actual recovery.
- Declaration waits for technical certainty while damage expands.
- Only executives can declare but their contact systems are unavailable.
- Backup compromise is not treated as a material escalation trigger.
Failure modes should become tabletop injects and technical tests. If the team has never performed the recovery while one normal dependency is unavailable, the runbook describes a best-case restore rather than a ransomware recovery.
Evidence checklist
Keep this evidence with the recovery plan so that a reviewer can distinguish a documented capability from a reproduced result.
- Make every target measurable and tied to a business service.
- A tested requirement exists for: Impact threshold.
- A tested requirement exists for: Trust threshold.
- A tested requirement exists for: Authority.
- Evidence includes a date, environment, operator and reproducible procedure.
- The exception path identifies who can accept residual risk.
Frequently asked questions
These answers state the decision in plain language and preserve the conditions that can change it.
When should ransomware trigger disaster recovery?
Declare a recovery event based on impact and loss of trust, not only the presence of a ransom note. Useful triggers include loss of privileged identity confidence, cross-segment encryption, backup-control compromise, inability to contain within a defined window, or outage beyond a business threshold. The deciding factors in this guide are impact threshold, trust threshold, authority.
Who declares a cyber disaster?
Treat the answer as conditional on the actual environment and plan. Include conditions where systems appear available but administrative trust is lost. Retain examples covering stolen privileged credentials and backup tampering.
What if systems work but admin trust is lost?
Do not rely on the product label or a successful backup job alone. Test the requirement directly: name primary and alternate declarers with an emergency communication route. Record the result with a date, operator and named exception owner.